prisma-postgres-setup

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill interacts with the official Prisma Management API to manage database resources.
  • Evidence: curl requests targeting https://api.prisma.io/v1/regions/postgres, https://api.prisma.io/v1/projects, and https://api.prisma.io/v1/databases/.
  • [COMMAND_EXECUTION]: The skill instructs the agent to install necessary dependencies and execute database migration and verification tools.
  • Evidence: npm install prisma @prisma/client @prisma/adapter-pg pg dotenv.
  • Evidence: npx prisma migrate dev, npx prisma init, and npx tsx test-connection.ts.
  • [INDIRECT_PROMPT_INJECTION]: The skill includes a workflow step where the agent generates a database schema based on natural language descriptions provided by the user.
  • Ingestion points: User-provided data model descriptions in Step 6.
  • Boundary markers: Not explicitly defined in the skill instructions; the agent relies on its own output validation.
  • Capability inventory: The skill can write to prisma/schema.prisma and execute schema migrations via the CLI.
  • Sanitization: No specific sanitization logic is provided in the instructions for the user's natural language input.
  • [DATA_EXFILTRATION]: The skill transmits service tokens and connection strings to the vendor's API. This is identified as safe behavior as it originates from the official vendor (Prisma) and targets the vendor's verified infrastructure.
  • Evidence: Authorization headers containing $PRISMA_SERVICE_TOKEN sent to api.prisma.io.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 05:07 PM
Security Audit — agent-trust-hub — prisma-postgres-setup