arkiv-data-modeling
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references an external conversion tool (
postgres-to-entity-0.3.1.tgz) hosted on an untrusted GitHub repository (SantiagoDevRel/postgres-to-entity). While the documentation notes that installation is not required for the skill to function, the tool is promoted as a converter for SQL DDL to Arkiv entities. Users should manually verify the integrity of third-party archives before use. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data in the form of PostgreSQL DDL and schema descriptions to produce entity models.
- Ingestion points: SQL DDL and schema workload descriptions provided in the
postgres-to-entity.mdmapping workflow. - Boundary markers: Absent; there are no explicit delimiters or instructions to the agent to ignore potentially malicious content embedded in the source SQL.
- Capability inventory: The skill includes code templates that perform network operations on the
tiramisunetwork via the@arkiv-network/sdk(e.g.,createEntity,executeBatch,getEntity, andpredictEntityKeys). - Sanitization: Absent; the skill relies on the agent to interpret a subset of
CREATE TABLEstatements without defined validation or escaping of the input content.
Audit Metadata