dbt-analyze
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill documents the use of the
altimate-dbtCLI, which includes commands likeexecuteandcompile-query. These allow for the execution of arbitrary SQL statements against the configured data warehouse as part of the analysis workflow. - [EXTERNAL_DOWNLOADS]: The
altimate-dbt depsandadd-packagescommands are used to fetch and install dbt packages from external registries. This represents standard dependency management for dbt projects. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from git history and SQL model files to perform its analysis, which creates a potential surface for indirect prompt injection.
- Ingestion points: Git diff output, dbt model SQL files (
.sql), andmanifest.jsonmetadata. - Boundary markers: The workflow does not explicitly describe the use of markers or delimiters to isolate untrusted file content from the agent's instructions.
- Capability inventory: Shell command execution via
bashand database interaction via thealtimate-dbtCLI. - Sanitization: There is no mention of sanitization or filtering applied to the analyzed SQL content before it is processed by the agent.
Audit Metadata