python-pymysql
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of data from external MySQL databases, which presents a surface for indirect prompt injection if the retrieved content is processed by an AI agent without adequate boundary markers or sanitization.\n
- Ingestion points: Data is retrieved using methods like
cursor.fetchone(),cursor.fetchmany(), andcursor.fetchall()as documented inSKILL.mdandreferences/cursor-guide.md.\n - Boundary markers: The skill does not provide instructions for the use of delimiters or 'ignore' instructions when providing database output to the agent's context.\n
- Capability inventory: The skill involves installing the library via
pip, establishing network connections to database servers, and reading local configuration files viaread_default_file.\n - Sanitization: The skill strongly promotes the use of parameterized queries (e.g.,
cursor.execute(query, args)) as a primary defense against SQL injection, which partially mitigates the risk of malicious data entry at the database level.
Audit Metadata