upstash-vector-js
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: References the official
@upstash/vectorSDK for interacting with Upstash Vector services. These are vendor-provided resources from a recognized technology service provider. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion and retrieval of user-provided data through its vector operations, creating a surface where retrieved data could potentially be interpreted as instructions if processed by a downstream agent without sanitization.
- Ingestion points:
upsert,query, andfetchmethods located insdk-methods.mdandfeatures/filtering-and-metadata.md. - Boundary markers: The instructions do not provide specific prompt boundary markers for data retrieved from the database.
- Capability inventory: Network access to the Upstash Vector API; execution of vector and metadata queries.
- Sanitization: The skill relies on the Upstash API's internal handling of structured metadata and vector data.
Audit Metadata