api-database-sequelize

Pass

Audited by Gen Agent Trust Hub on Nov 9, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [SAFE]: The skill serves as a comprehensive guide for using Sequelize ORM. It prioritizes secure coding practices, such as using declare in TypeScript models to avoid data corruption and ensuring transactions are properly scoped to prevent data inconsistency.
  • [INDIRECT_PROMPT_INJECTION]: The skill facilitates processing of untrusted data from SQL databases. Ingestion points: Data retrieved via User.findAll, Model.findOne, and sequelize.query (examples in examples/core.md and examples/advanced.md). Boundary markers: The instructions recommend using replacements and bind for parameters but do not define specific LLM prompt delimiters for the ingested data. Capability inventory: SQL execution via sequelize.query and sequelize.literal, and file-based migrations via queryInterface. Sanitization: Best-practice guidance is provided for SQL injection prevention using parameterized queries in examples/advanced.md.
  • [DYNAMIC_EXECUTION]: The skill demonstrates the use of sequelize.query for raw SQL execution. However, it emphasizes safe implementation using bind parameters and replacements rather than string concatenation, aligning with security best practices.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 9, 2026, 06:27 PM