datadata-dql

Pass

Audited by Gen Agent Trust Hub on Aug 28, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill serves as a reference manual for the Datadata Query Language (DQL). It provides instructions and API signatures for a sandboxed Starlark-based environment. All functionalities described, including SQL querying via query() and network requests via fetch(), are legitimate features of the documented platform.
  • [DATA_EXFILTRATION]: The skill documents the fetch() function which allows the agent to perform HTTP requests (GET, POST, etc.). While this provides a mechanism for data transfer, it is a core intended feature of the language for external API integration. The documentation encourages safe practices, such as validating response structures before processing.
  • [COMMAND_EXECUTION]: The skill instructs the agent on how to write scripts that are returned to the user or platform for execution. These scripts are restricted to the Starlark/DQL grammar defined in the provided grammar.txt. The instructions explicitly warn against using or guessing syntax outside of the defined grammar.
  • [PROMPT_INJECTION]: The skill includes instructions that regulate agent behavior (e.g., 'Core Rules'), but these are aimed at ensuring code quality and data integrity (e.g., requesting user clarification instead of guessing data structures) rather than attempting to bypass safety filters or override system prompts.
  • [CREDENTIALS_UNSAFE]: The documentation contains examples of using authorization headers (e.g., Bearer sk-xxx), but these use standard placeholders which do not constitute a credential leak.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 28, 2026, 10:37 AM