api-database-sequelize
Pass
Audited by Gen Agent Trust Hub on Nov 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [SAFE]: The skill serves as a comprehensive guide for using Sequelize ORM. It prioritizes secure coding practices, such as using
declarein TypeScript models to avoid data corruption and ensuring transactions are properly scoped to prevent data inconsistency. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates processing of untrusted data from SQL databases. Ingestion points: Data retrieved via
User.findAll,Model.findOne, andsequelize.query(examples inexamples/core.mdandexamples/advanced.md). Boundary markers: The instructions recommend usingreplacementsandbindfor parameters but do not define specific LLM prompt delimiters for the ingested data. Capability inventory: SQL execution viasequelize.queryandsequelize.literal, and file-based migrations viaqueryInterface. Sanitization: Best-practice guidance is provided for SQL injection prevention using parameterized queries inexamples/advanced.md. - [DYNAMIC_EXECUTION]: The skill demonstrates the use of
sequelize.queryfor raw SQL execution. However, it emphasizes safe implementation using bind parameters and replacements rather than string concatenation, aligning with security best practices.
Audit Metadata