persistence-and-migrations

Pass

Audited by Gen Agent Trust Hub on Oct 18, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
  • [DYNAMIC_EXECUTION]: The auditing tools (check-persistence.mjs, inspect-database.mjs) use dynamic import() to load and execute TypeScript modules from the target project. This allows the checker to perform migration replays and runtime validation of data schemas.\n- [COMMAND_EXECUTION]: The skill uses child_process.execFileSync and spawnSync to execute mobile development tools like adb and xcrun simctl. This functionality is used to extract application databases and perform kill-test cycles on emulators and simulators.\n- [INDIRECT_PROMPT_INJECTION]: The skill's auditing scripts process user-provided project configuration files (such as persistence.json) and SQL source files. While this creates an ingestion surface for untrusted data, the logic is limited to validation and health checks within a developer workflow.\n- [DATA_EXFILTRATION]: The auditing tools include functionality to copy the application's SQLite database from connected devices to the local filesystem for diagnostic inspection. While used locally for auditing, this represents access to the application's underlying data storage.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 18, 2026, 11:23 AM