notebook-guidance
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill describes a workflow where the agent ingests and processes data from external sources (BigQuery via
%%bqsqlmagics) and uses thenotebook_execute_celltool to perform actions based on that data. This creates an attack surface for indirect prompt injection, where malicious content stored in a database could attempt to influence the agent's code generation logic. - Ingestion points: External data is retrieved from BigQuery tables and through exploration of user-provided datasets within the notebook environment.
- Boundary markers: The skill does not provide instructions for using specific delimiters or 'ignore embedded instructions' markers when the agent reads or displays data outputs.
- Capability inventory: The skill relies on the
notebook_execute_cell(and variantnotebook__execute_cell) tool, which allows the agent to execute arbitrary Python or SQL code in the notebook kernel. - Sanitization: There are no explicit instructions for sanitizing or escaping external data before it is interpolated into subsequent prompts or used to determine the logic for the next notebook cell.
Audit Metadata