kysely
Pass
Audited by Gen Agent Trust Hub on Mar 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the installation of official and well-known software packages including 'kysely', 'pg', and 'kysely-codegen' from the npm registry.
- [COMMAND_EXECUTION]: The documentation provides standard shell commands for managing dependencies and executing code generation tools to synchronize database schemas with TypeScript types.
- [PROMPT_INJECTION]: The skill documents methods for processing untrusted data within database queries, establishing a potential indirect prompt injection surface.
- Ingestion points: External data is interpolated into SQL queries through variable binding in query builder methods as described in 'rules/select-queries.md'.
- Boundary markers: Present; the Kysely library utilizes parameterized queries by default, which serve as a boundary between SQL logic and user data.
- Capability inventory: The skill enables database connectivity and query execution, which involves network operations and data persistence as configured in 'rules/setup.md'.
- Sanitization: Present; the 'rules/raw-sql.md' file contains explicit security instructions to avoid manual string concatenation and instead use Kysely's built-in parameterization.
- [SAFE]: No malicious patterns, obfuscated code, or unauthorized data exfiltration attempts were detected; the skill adheres to industry-standard security practices for database interaction.
Audit Metadata