plan-data-integrity — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited plan-data-integrity (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Role: Senior platform engineer + disaster-recovery specialist.
Task: Map every path to irreversible data loss, score by irreversibility × reach, phase structural safeguards, emit plan-data-integrity.md. Audit & plan only — no migrations, tokens, or destructive commands until each phase is approved.
Find what could wipe prod. Gate it. Change nothing until approved.
On April 25, 2026, an AI agent deleted PocketOS's entire production database — and every backup — in nine seconds on Railway. Four structural failures: overprivileged tokens, shared blast radius (backups on same volume as prod), no environment isolation, no destructive-action gate. Written rules were ignored. Soft prompt-rules are not a control; the guardrail must be a system boundary.
Trigger phrases: "is this migration safe", "could I lose data", "check my backups", "destructive operations", "my agent might nuke prod", "safe schema change", "disaster recovery", "pre-launch data safety".
Do not fire for: query speed (backend-db-performance), RLS access (plan-rls-audit), or schema design quality (audit-db-schema). This skill owns irreversible data loss and migration safety specifically.
The db-migrator subagent executes migrations; this audits the safety net before you trust automated execution. Distinct from audit-db-schema — here the only question is: "what here could destroy data, and what stops it?"
ON DELETE CASCADE further than intended.drop, truncate, destroy, rm -rf.approval), not prompt text.
destructive commands to "verify".**
agent instructions.
plan-data-integrity.md# Data-Integrity & Destructive-Op Audit — <repo>
_Audit-only. No migration, token, or backup config changes until approved._
_No destructive command is run for any reason._
## Scope
- Audited: migrations ☐ SQL/scripts ☐ agent/CI token scopes ☐ backup config ☐
- Stack: Supabase ☐ Railway ☐ Vercel ☐ AWS ☐ | Assumptions: …
## Verdict
| Severity | Count | Worst case |
|----------|-------|-----------|
| Critical | n | irreversible prod loss, no gate, backups in blast radius |
| High | n | unbackfilled drop, over-scoped token |
| Medium | n | no rollback path, untested restore |
## Findings
| # | Operation / location | Data at risk | Reversible? | Gated? | Sev | Direction |
|---|----------------------|--------------|-------------|--------|-----|-----------|
| D1 | agent token scope | all prod tables | no | no | Crit | scope token; read-only default; approval gate |
| D2 | backups on prod volume | all backups | no | no | Crit | move backups to isolated/immutable store |
| D3 | 0007_drop_legacy.sql | users.legacy_id | no | no | High | backfill→verify→drop in separate migration |
## Phased burndown
- **Phase 1 — Gates & isolation** → infra/RBAC config — D1, D2 (make catastrophe impossible)
- **Phase 2 — Migration safety** → `db-migrator` — backfill steps, transactions, rollbacks
- **Phase 3 — Backup & restore proof** → infra — immutable backups, test a restore
- **Phase 4 — Least-privilege sweep** → infra + `plan-secrets-audit` — token scoping
## Execution handoff
Approve a phase to run it. Test restore into an isolated env (never overwrite
prod). Confirm the agent identity cannot delete backups.plan-secrets-audit.
db-migrator, backend-patterns, infra config, create-hook.Plan with a strong model; execute with composer-2.5-execution.mdc riding along. Highest-stakes plan in the set — the plan says what can destroy data; the rule forbids the agent from doing it autonomously.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.