datahub-sql-workflow
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill is designed to execute SQL queries via an external tool. It contains explicit security constraints requiring that only read-only
SELECTstatements be executed, while explicitly rejecting DDL (Data Definition Language) and DML (Data Manipulation Language) commands to prevent unauthorized database modifications or deletions. - [SAFE]: The workflow enforces a 'grounding-first' approach, requiring the agent to fetch metadata and SQL context from DataHub before drafting any queries. This reduces the risk of hallucinations or unauthorized data access based on guesses.
- [SAFE]: The instructions include defensive logic for verifying generated SQL, directing the agent to treat machine-generated drafts as untrusted and to manually reconcile them against the retrieved catalog evidence (schemas, join keys, and standard filters).
Audit Metadata