database-patterns
Pass
Audited by Gen Agent Trust Hub on Apr 19, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/detect-model-changes.pyuses the Pythonsubprocessmodule to executegitandalembiccommands. These calls are used to introspect the current project state (staged files, current migration revision) to assist the user in generating database migrations. The commands are constructed using argument lists, which follows security best practices for subprocess execution. - [COMMAND_EXECUTION]: The file
scripts/create-migration.mdutilizes dynamic context injection syntax (!command) to run shell commands such asalembic current,git diff, anddatewhen the skill is loaded. These commands are used to gather contextual metadata (current revision, recent model changes) for the agent's migration generation task. The user-supplied$ARGUMENTSvariable is used in descriptive text but is not interpolated into the shell commands themselves, mitigating command injection risks. - [DATA_EXFILTRATION]: No exfiltration patterns were found. Files containing database connection strings (e.g.,
references/alembic-advanced.md,rules/migration-rollback.md) use placeholder values such aspostgresql://user:pass@localhost/mainfor demonstration purposes.
Audit Metadata