z-go-pgvector
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documents how to process external data, such as text content and vector embeddings, for database operations. It mitigates this risk by demonstrating industry best practices.
- Ingestion points: External data enters the system through the
contentandembeddingvariables used in theSearchandINSERTexamples inSKILL.md. - Boundary markers: The skill consistently uses and recommends parameterized SQL queries (e.g.,
$1,$2), which effectively prevents data from being misinterpreted as commands. - Capability inventory: The code demonstrates database interaction capabilities (INSERT and SELECT queries) using the
pgxpoollibrary. - Sanitization: The data is sanitized by the
pgxdriver and thepgvector-gocodec, ensuring that input is treated as literal values rather than executable SQL code.
Audit Metadata