bigquery-data-transfer-service

Pass

Audited by Gen Agent Trust Hub on Oct 3, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructions and associated Python script utilize gcloud and bq CLI commands to retrieve project configuration, fetch authentication tokens, and manage BigQuery Data Transfer resources.
  • [EXTERNAL_DOWNLOADS]: The scripts/bigquery_dts.py script performs network requests to bigquerydatatransfer.googleapis.com to retrieve official Data Source metadata and configuration parameters.
  • [COMMAND_EXECUTION]: The Python script uses subprocess.run to execute gcloud commands. These calls use argument lists rather than shell strings, which is a secure practice that prevents command injection.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes metadata returned from the BigQuery DTS API to identify required configuration parameters.
  • Ingestion points: API responses from googleapis.com processed in scripts/bigquery_dts.py.
  • Boundary markers: The instructions include a 'Mandatory User Questionnaire' requiring the agent to present all discovered parameters to the user for verification.
  • Capability inventory: The skill can execute bq commands and instructs the agent to generate deployment.yaml files.
  • Sanitization: The skill relies on mandatory user review and confirmation of all parameters before proceeding with configuration generation.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 3, 2026, 01:07 PM