ktx-ai-data-context-layer
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: Documentation examples (Example 3) demonstrate unsafe use of
execSyncwith direct string interpolation of user input:ktx sl "${query}". This coding pattern is vulnerable to shell command injection if the query contains metacharacters like;,&&, or|. - [PROMPT_INJECTION]: The skill is designed to ingest large volumes of external data, establishing a surface for indirect prompt injection.
- Ingestion points: Metadata and content are ingested from databases (Postgres, Snowflake, etc.), dbt manifests, Looker/Metabase metadata, and Notion wikis (SKILL.md).
- Boundary markers: No explicit instruction delimiters or boundary markers (e.g., 'ignore embedded instructions') are described in the ingestion configuration.
- Capability inventory: The skill exposes CLI tools and an MCP server (
ktx mcp start) that the agent uses to perform semantic searches and query execution based on ingested context. - Sanitization: No sanitization or validation of the ingested external content is mentioned prior to context building.
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
@kaelio/ktxpackage from the npm registry, introducing a dependency on a third-party organization.
Audit Metadata