ezorm-skills
Pass
Audited by Gen Agent Trust Hub on Feb 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches documentation, schema references, and example YAML files from the author's official GitHub repository at
https://raw.githubusercontent.com/ezbuy/ezorm/. This is performed during initialization viascripts/init.shscripts.\n- [REMOTE_CODE_EXECUTION]: Downloads and executes theezormtool binary from the vendor's GitHub releases page (https://api.github.com/repos/ezbuy/ezorm/releases/latest). This is a standard installation process used to ensure the code generation utility is present.\n- [COMMAND_EXECUTION]: Executes thegoimportsutility to format generated Go source files and runs driver-specific plugin binaries usingexec.Commandas part of the core generation logic.\n- [PROMPT_INJECTION]: The skill exhibits surface area for indirect prompt injection through user-provided database schemas.\n - Ingestion points:
cmd/gen.goreads schema files from user-defined paths.\n - Boundary markers: Absent.\n
- Capability inventory: The skill has file system write access (
os.OpenFile) and shell command execution capabilities (exec.Command).\n - Sanitization: Not explicitly identified for YAML/SQL metadata content.
Audit Metadata