persistence-and-migrations
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [DYNAMIC_EXECUTION]: The auditing tools (
check-persistence.mjs,inspect-database.mjs) use dynamicimport()to load and execute TypeScript modules from the target project. This allows the checker to perform migration replays and runtime validation of data schemas.\n- [COMMAND_EXECUTION]: The skill useschild_process.execFileSyncandspawnSyncto execute mobile development tools likeadbandxcrun simctl. This functionality is used to extract application databases and perform kill-test cycles on emulators and simulators.\n- [INDIRECT_PROMPT_INJECTION]: The skill's auditing scripts process user-provided project configuration files (such aspersistence.json) and SQL source files. While this creates an ingestion surface for untrusted data, the logic is limited to validation and health checks within a developer workflow.\n- [DATA_EXFILTRATION]: The auditing tools include functionality to copy the application's SQLite database from connected devices to the local filesystem for diagnostic inspection. While used locally for auditing, this represents access to the application's underlying data storage.
Audit Metadata