charting
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data through several ingestion points, creating a vulnerability surface for indirect prompt injection.
- Ingestion points: The skill performs an 'Inventory' step (Section 2, Step A) where it scans database schemas and samples row data. It also ingests raw user-provided data for transformation.
- Boundary markers: No explicit boundary markers or instructions to ignore embedded commands within the processed data are defined in the instructions.
- Capability inventory: The skill is designed to auto-generate and execute SQL or pandas code for data transformations (Section 2, Step B) and run validation queries (Section 2, Step D). This combination of reading external data and executing generated code is a known risk factor.
- Sanitization: There is no evidence of sanitization, escaping, or schema validation for the data ingested from database samples or schema metadata before it is interpolated into the transformation pipeline logic.
- [COMMAND_EXECUTION]: The skill is instructed to 'Auto-generate SQL or pandas code' and 'Run a tiny sample query first' (Section 2, Steps B & D). While intended for data processing, the execution of agent-generated code based on external data inputs requires caution.
Audit Metadata