z-go-goose
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches and installs the
goosemigration utility from its official GitHub repository (github.com/pressly/goose). The installation command specifies a pinned version (v3.29.0), which is a recommended security practice to ensure tool integrity. - [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to manage and execute SQL migration files, which constitutes a surface for indirect prompt injection if those files are sourced from untrusted parties.
- Ingestion points: SQL files within the
migrations/directory (e.g.,00001_init.sql). - Boundary markers: Absent; the content of the SQL files is processed directly by the database driver.
- Capability inventory: The skill enables full Data Definition Language (DDL) and Data Manipulation Language (DML) capabilities on the target database through
goosecommands. - Sanitization: None; the migration tool is intended to execute the provided SQL code verbatim.
Audit Metadata