bigquery-ai-ml
Pass
Audited by Gen Agent Trust Hub on Nov 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- Usage Attribution and Telemetry: The skill includes instructions for tagging commands and HTTP requests with specific attribution strings to enable usage tracking by the vendor. As outlined in
references/attribution.md, these tags identify the skill version for telemetry purposes and are designed to avoid the collection of user data. The documentation also provides a method for users to opt out of this tracking.\n- Indirect Prompt Injection Surface: The skill describes functions that process external or user-provided data within LLM prompts, which could be susceptible to indirect prompt injection if the source data contains malicious instructions.\n - Ingestion points: Untrusted data enters the model context through tables or queries passed to functions like
AI.AGG,AI.GENERATE, andAI.CLASSIFY(described inreferences/ai_agg.md,references/ai_generate.md, andreferences/ai_classify.md).\n - Boundary markers: Documentation examples often use string concatenation (e.g.,
'Summarize: ' || content) without robust delimiters to separate the system's instructions from the analyzed data.\n - Capability inventory: The skill is designed for use in environments where the agent has the authority to execute BigQuery SQL, which includes reading data and invoking AI models.\n
- Sanitization: The provided references do not detail sanitization or input validation procedures for the data being analyzed.
Audit Metadata