upgrading-dbt-core
Pass
Audited by Gen Agent Trust Hub on Aug 5, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches the
dbt-autofixutility from the official dbt Labs GitHub repository (github.com/dbt-labs/dbt-autofix.git) and installs thedbt-corepackage alongside relevant database adapters from the Python package registry to create a controlled environment for project validation. - [COMMAND_EXECUTION]: The helper script
scripts/tools.pyuses the Pythonsubprocessmodule to perform deterministic tasks, such as checking repository state viagitand validating project code usingdbt parsein a temporary virtual environment. - [PROMPT_INJECTION]: As the skill involves reading and editing user-controlled project files (SQL and YAML), it acknowledges the risk of indirect prompt injection. It mitigates this by providing strict instructions to the agent to treat all project content as untrusted data and to disregard any instructions found within code comments or metadata.
Audit Metadata