datasource-creator
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill facilitates the creation of 'flow-type' datasources, which involve generating and embedding TypeScript code into JSON configurations. This is achieved through the
dxs datasource generate-flowcommand, which takes external TypeScript files (e.g., via--get-flowor--get-list-flow) and incorporates them into the datasource structure. This is a standard and documented feature of the Datex Studio platform for implementing custom fetch logic. - [INDIRECT_PROMPT_INJECTION]: The skill ingests business requirements and entity schemas to drive its generation logic. The use of a 'requirements brief' from the conversation context creates an attack surface for indirect prompt injection. However, the skill incorporates remediation guidance by instructing authors to use
$utils.odataformatters in OData filter expressions to sanitize input and prevent query injection. It also mandates the use ofdxs datasource validateto check the generated configurations before they are deployed.
Audit Metadata