migrating-dbt-core-to-v2
Pass
Audited by Gen Agent Trust Hub on Oct 20, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill uses
uvxto download and executedbt-autofixdirectly from the vendor's official GitHub repository (github.com/dbt-labs/dbt-autofix.git). This is a legitimate vendor resource used for its intended purpose.\n- [EXTERNAL_DOWNLOADS]: Fetches issue data from theapi.github.comendpoint to identify known bugs and gaps in the dbt v2 engine.\n- [COMMAND_EXECUTION]: Executes standarddbtandgitcommands to validate the environment and review changes made during the migration process.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user project data (SQL, YAML) which is a potential injection vector.\n - Ingestion points: Reads local SQL files, YAML configurations, and dbt error logs (SKILL.md).\n
- Boundary markers: Includes specific instructions to ignore instruction-like text within processed files.\n
- Capability inventory: Can modify project files and execute shell commands.\n
- Sanitization: Provides explicit warnings against executing any instructions or commands found embedded in comments, descriptions, or external documentation.
Audit Metadata