datasource-creator

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill facilitates the creation of 'flow-type' datasources, which involve generating and embedding TypeScript code into JSON configurations. This is achieved through the dxs datasource generate-flow command, which takes external TypeScript files (e.g., via --get-flow or --get-list-flow) and incorporates them into the datasource structure. This is a standard and documented feature of the Datex Studio platform for implementing custom fetch logic.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests business requirements and entity schemas to drive its generation logic. The use of a 'requirements brief' from the conversation context creates an attack surface for indirect prompt injection. However, the skill incorporates remediation guidance by instructing authors to use $utils.odata formatters in OData filter expressions to sanitize input and prevent query injection. It also mandates the use of dxs datasource validate to check the generated configurations before they are deployed.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 02:53 PM
Security Audit — agent-trust-hub — datasource-creator