tech-drizzle
Pass
Audited by Gen Agent Trust Hub on Feb 19, 2026
Risk Level: SAFE
Full Analysis
- Prompt Injection (SAFE): No patterns of prompt injection, role-play bypasses, or instructions to ignore safety filters were detected. The content is strictly focused on database development.
- Data Exposure & Exfiltration (SAFE): The skill demonstrates positive security practices by explicitly recommending the exclusion of sensitive fields (e.g.,
passwordHash,resetToken) during database queries. - Evidence:
rules/rqb-select-columns.mdandrules/rqb-with-eager-loading.mdprovide code examples for column filtering. - Command Execution (SAFE): All included command-line examples are standard development operations (
pnpm,git,cat) intended for local use. There are no patterns of piping remote content to a shell or suspicious subprocess spawning. - Indirect Prompt Injection (SAFE): While the skill processes user input for code generation, it is a static knowledge base with no ingestion of untrusted external data (APIs, web pages) and no high-risk capabilities like file writing or network requests.
- Unverifiable Dependencies (SAFE): The documentation references well-known, industry-standard tools (
drizzle-orm,drizzle-kit) and does not suggest the installation of suspicious or unversioned packages.
Audit Metadata