skills/bmsuisse/skills/ducklake/Gen Agent Trust Hub

ducklake

Pass

Audited by Gen Agent Trust Hub on Jul 26, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions to install the ducklake extension within DuckDB and fetches example data from blobs.duckdb.org. These operations target the official infrastructure of the DuckDB project.
  • [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent on how to ingest data from external sources, which is a standard feature of the database tool.
  • Ingestion points: Data is loaded into tables from external URLs and local paths (e.g., FROM 'https://...' in SKILL.md).
  • Boundary markers: None explicitly provided in the skill instructions.
  • Capability inventory: The skill uses DuckDB SQL capabilities to read/write files and perform maintenance tasks (detailed in SKILL.md and references/maintenance.md).
  • Sanitization: Relies on the underlying DuckDB engine's data parsing logic.
  • [COMMAND_EXECUTION]: Provides standard CLI examples for opening databases using the duckdb command-line interface.
  • [DATA_EXFILTRATION]: While the skill describes connecting to external PostgreSQL and SQLite catalogs, these are standard database operations for a lakehouse format and do not involve unauthorized data movement.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 26, 2026, 09:35 AM
Security Audit — agent-trust-hub — ducklake