db-generate
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions direct the agent to execute a shell command
npx medusa db:generate <module-name>using the Bash tool. This involves running the Medusa CLI tool (a vendor-owned resource) to generate code artifacts. - [INDIRECT_PROMPT_INJECTION]: The skill exhibits a command injection surface by interpolating a user-provided variable (
<module-name>) directly into a shell command string without specified sanitization or escaping mechanisms. - Ingestion points: User-supplied argument provided to the
/medusa-dev:db-generatecommand. - Boundary markers: None identified in the prompt instructions to delimit the argument.
- Capability inventory: The skill uses the Bash tool to execute commands in the environment.
- Sanitization: No validation or sanitization logic is defined for the
<module-name>input before it is passed to the shell.
Audit Metadata