using-duckdb

Pass

Audited by Gen Agent Trust Hub on Jul 21, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes the duckdb CLI to perform data queries and uses a utility named fab to retrieve environment IDs (Workspace, Lakehouse, Warehouse) required for generating OneLake paths.
  • [EXTERNAL_DOWNLOADS]: The skill downloads and installs the official DuckDB azure and delta extensions from DuckDB's registry to enable cloud storage access and Delta Lake format support.
  • [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from external sources and possesses significant processing capabilities.
  • Ingestion points: Reads Delta tables and raw file formats (CSV, Parquet, JSON) from Microsoft Fabric OneLake (SKILL.md, references/in-notebook-setup.md).
  • Boundary markers: Absent. There are no instructions or delimiters provided to the agent to treat the content of the queried data as untrusted or to ignore instructions embedded within the files.
  • Capability inventory: The skill uses the duckdb CLI for shell-based execution and the DuckDB Python API for in-notebook execution. It also includes patterns for writing data back to the lakehouse using Spark (references/in-notebook-setup.md).
  • Sanitization: Absent. The skill passes data and paths directly into SQL queries without validation or escaping mechanisms.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 21, 2026, 10:00 AM
Security Audit — agent-trust-hub — using-duckdb