duckdb-js
Pass
Audited by Gen Agent Trust Hub on Aug 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill acts as a technical reference for DuckDB conventions and does not include any executable code or dangerous instructions.
- [COMMAND_EXECUTION]: Provides documentation for standard DuckDB SQL operations including data definition (CREATE), manipulation (INSERT, UPDATE, DELETE), and querying (SELECT). These are standard database operations.
- [EXTERNAL_DOWNLOADS]: Mentions reading data from external sources such as HTTPS URLs and S3 buckets (e.g.,
read_parquet('https://example.com/data.parquet')). These are documented as standard DuckDB features for analytical processing. - [CREDENTIALS_UNSAFE]: Includes examples for setting S3 credentials using
SET s3_access_key_idandSET s3_secret_access_key. These examples use safe placeholders ('key', 'secret') and follow standard configuration practices. - [DATA_EXFILTRATION]: Documents the
COPYcommand for exporting data to files or S3, which is a core feature of the database engine for data management. - [REMOTE_CODE_EXECUTION]: References the official
@duckdb/node-apipackage for Node.js integration, which is a standard library for interacting with DuckDB from JavaScript environments.
Audit Metadata