pscale-neki
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill is designed to interact with the PlanetScale CLI (
pscale). It instructs the agent to execute various commands for database management, configuration, and inspection. - Evidence: Usage of
pscale branch changes,pscale branch data-topology,pscale branch shard,pscale branch config-profile, andpscale role getthroughoutSKILL.md. - Safety Measures: The skill mandates using
--format jsonfor reliable parsing, explicit--orgflags, and user approval for all destructive or cost-incurring mutations. - [INDIRECT_PROMPT_INJECTION]: A potential vulnerability surface exists where the agent is instructed to update the branch data topology from a local JSON file (
topology.json). If the content of this file is untrusted, it could influence the agent's context. - Evidence:
pscale branch data-topology update <database> <branch> --org <org> --format json < topology.jsoninSKILL.md. - Mitigation: The instructions explicitly state that "Empty input, arrays, scalars, and malformed JSON are rejected" and require the user to "Review the complete JSON object... before applying it."
- [SAFE]: The skill demonstrates defensive security practices by providing checksums for the CLI binaries used to generate the documentation, ensuring that the commands described are from verified versions.
- Evidence: Reference to SHA-256
61eadf71c9d5e6423587fbf01fd698800d8a944775a06519a1c2ac38fcb89287and others inreferences/commands.md.
Audit Metadata