sql-bi-reporting
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill documents the use of
sp_executesqlfor generating dynamic PIVOT queries. It includes clear security guidance recommending theQUOTENAMEfunction to sanitize dynamic identifiers and mitigate SQL injection risks. - [COMMAND_EXECUTION]: The skill provides reference information for the
bcp(Bulk Copy Program) command-line utility, which is a standard SQL Server tool used for exporting and importing data. - [INDIRECT_PROMPT_INJECTION]: The skill identifies an attack surface for indirect prompt injection by providing patterns for ingesting data from external files (via
BULK INSERT) and processing database records. As this is the primary purpose of a BI reporting skill, the inclusion of defensive coding practices (like input sanitization) is noted as a mitigation.
Audit Metadata