expanso-s3-to-postgres
Pass
Audited by Gen Agent Trust Hub on Jul 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) as it processes data from external, untrusted sources.
- Ingestion points: The
pipeline.yamlfile defines anaws_s3input that reads objects from an S3 bucket. - Boundary markers: None. The skill does not implement delimiters or instructions to ignore embedded prompts within the ingested JSON data.
- Capability inventory: The skill has the capability to write data to a PostgreSQL database (
sql_insertinpipeline.yaml) and execute shell commands viarun.shto trigger theexpansobinary. - Sanitization: The skill uses Bloblang mapping for structural transformation, but does not perform content-level sanitization or filtering to prevent malicious instructions from being passed to downstream consumers of the PostgreSQL data.
- [COMMAND_EXECUTION]: The
run.shscript executes theexpansobinary with user-supplied arguments ($@). Whileexpansois a tool associated with the vendor, passing unvalidated shell arguments to a binary can lead to command injection if the agent or user provides malicious flags. - [DATA_EXFILTRATION]: The skill performs network-based data transfers. It reads from AWS S3 and writes to a PostgreSQL instance. While the domains are controlled via environment variables (
S3_BUCKET,POSTGRES_DSN), the pattern involves moving potentially sensitive data across network boundaries.
Audit Metadata