db-migration-helper
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
npx prisma db pullandnpx prisma introspectto fetch schema definitions from the configured database environment.\n- [COMMAND_EXECUTION]: It employsgrepto scan project source files such as*.ts,*.py, and*.goto identify entity and model definitions.\n- [EXTERNAL_DOWNLOADS]: Installation involves cloning or fetching content from the author's repository atgithub.com/wu529778790/shenzjd-skills.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content from project-level model and schema files, which creates a surface for indirect prompt injection.\n - Ingestion points: Processes content from
prisma/schema.prisma,*.entity.ts,*.model.ts, andschema.rb.\n - Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present in the core patterns.\n
- Capability inventory: SQL statement generation and database schema introspection tools.\n
- Sanitization: No explicit filtering or sanitization of ingested model code before processing.
Audit Metadata