tl-pg-boss
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill describes patterns for background job processing where workers ingest data stored in a PostgreSQL database, creating a potential surface for indirect prompt injection if payloads are not handled securely by the implementing application.
- Ingestion points: Job handlers receive untrusted payloads via the
job.dataproperty inSKILL.mdandreferences/typescript-patterns.md. - Boundary markers: No explicit natural language delimiters or 'ignore' instructions are provided for job data payloads in the example code.
- Capability inventory: The documented handlers perform various tasks including sending emails, processing images, and executing database queries.
- Sanitization: The skill recommends using idempotent handlers and upserts as a reliability best practice, though it does not provide specific data sanitization examples.
- [EXTERNAL_DOWNLOADS]: The skill recommends installing well-known Node.js packages including
pg-boss,@pg-boss/dashboard, and the third-partypg-boss-admin-dashboardutility via standard package managers.
Audit Metadata