upgrading-dbt-core

Pass

Audited by Gen Agent Trust Hub on Aug 5, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches the dbt-autofix utility from the official dbt Labs GitHub repository (github.com/dbt-labs/dbt-autofix.git) and installs the dbt-core package alongside relevant database adapters from the Python package registry to create a controlled environment for project validation.
  • [COMMAND_EXECUTION]: The helper script scripts/tools.py uses the Python subprocess module to perform deterministic tasks, such as checking repository state via git and validating project code using dbt parse in a temporary virtual environment.
  • [PROMPT_INJECTION]: As the skill involves reading and editing user-controlled project files (SQL and YAML), it acknowledges the risk of indirect prompt injection. It mitigates this by providing strict instructions to the agent to treat all project content as untrusted data and to disregard any instructions found within code comments or metadata.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 5, 2026, 02:23 PM
Security Audit — agent-trust-hub — upgrading-dbt-core