harvard-art-museums-data-pipeline
Fail
Audited by Gen Agent Trust Hub on Jun 12, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to clone and install dependencies from a third-party GitHub repository (https://github.com/Manali0711/Harvard-Artifacts-Collection-Data-Engineering-Analytics-App.git) which is not a verified source or official vendor repository.- [COMMAND_EXECUTION]: The Streamlit dashboard implementation includes a 'Custom Query' feature that executes raw SQL strings directly from user input (pd.read_sql(custom_query, conn)). This pattern allows for arbitrary SQL command execution without sanitization or parameterization.- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests artifact metadata from the Harvard Art Museums API (api.harvardartmuseums.org). If the API response contains adversarial content, it could influence the agent's behavior during data analysis.
- Ingestion points: fetch_artifacts function reads from api.harvardartmuseums.org in SKILL.md.
- Boundary markers: Absent; the API data is processed and displayed without delimiters or safety instructions.
- Capability inventory: The skill possesses database read/write capabilities (mysql.connector) and data visualization capabilities.
- Sanitization: No sanitization or validation of the API-provided artifact fields is performed before they are used in the application logic or displayed.
Recommendations
- AI detected serious security threats
Audit Metadata