api-database-typeorm
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill describes patterns for ingesting untrusted data (e.g., search queries and API request parameters) into database queries. It mitigates this risk by providing strict instructions on the use of parameter binding and explicitly identifying string interpolation as a high-priority security risk.
- Ingestion points: API request bodies and filter parameters processed in examples/query-builder.md and examples/transactions.md.
- Boundary markers: The skill recommends using TypeORM's :parameter syntax to separate data from SQL commands.
- Capability inventory: Full database access including schema modification, data insertion, updates, and deletion across all provided scripts.
- Sanitization: The skill provides multiple 'CRITICAL' reminders and 'RED FLAGS' to ensure the agent uses parameterized queries and avoids vulnerable string concatenation.
Audit Metadata