dbt-analyze

Pass

Audited by Gen Agent Trust Hub on Sep 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill documents the use of the altimate-dbt CLI, which includes commands like execute and compile-query. These allow for the execution of arbitrary SQL statements against the configured data warehouse as part of the analysis workflow.
  • [EXTERNAL_DOWNLOADS]: The altimate-dbt deps and add-packages commands are used to fetch and install dbt packages from external registries. This represents standard dependency management for dbt projects.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from git history and SQL model files to perform its analysis, which creates a potential surface for indirect prompt injection.
  • Ingestion points: Git diff output, dbt model SQL files (.sql), and manifest.json metadata.
  • Boundary markers: The workflow does not explicitly describe the use of markers or delimiters to isolate untrusted file content from the agent's instructions.
  • Capability inventory: Shell command execution via bash and database interaction via the altimate-dbt CLI.
  • Sanitization: There is no mention of sanitization or filtering applied to the analyzed SQL content before it is processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 30, 2026, 06:13 PM