databricks-demo-generator

Pass

Audited by Gen Agent Trust Hub on Jul 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes several shell scripts (such as deploy.sh, start.sh, and build-app.sh) and instructions to use the Databricks CLI. These are used to provision infrastructure, manage Lakebase Postgres databases, and deploy Databricks Apps. The commands are scoped to the project's requirements and follow the expected development workflow for the Databricks platform.
  • [EXTERNAL_DOWNLOADS]: The build process involves standard package management operations, including npm install and npm ci for Node.js dependencies, and Python package management for synthetic data generation. All downloads target official registries (NPM) or established Databricks SDKs.
  • [DATA_EXPOSURE]: The skill uses a template-based approach where all sensitive configuration values (such as catalog names, schema names, and warehouse IDs) are replaced with placeholders like <your_catalog> or ${var.client_catalog} before being shared or packaged. The application template uses standard OAuth-based authentication (OBO) for interacting with Databricks services, ensuring no long-lived credentials are hardcoded.
  • [SAFE]: The skill's architecture relies on Unity Catalog for governance and uses standard Databricks AppKit plugins for secure connectivity. The logic within the AI agent instructions (refundops.ts) focuses on legitimate business tasks like investigating data anomalies and processing batches with human-in-the-loop approval gates.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 14, 2026, 02:53 PM
Security Audit — agent-trust-hub — databricks-demo-generator