write-hql
Pass
Audited by Gen Agent Trust Hub on Nov 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [SAFE]: The skill documentation establishes a clear, multi-step workflow for data exploration and query authoring. It uses official platform tools for all operations, which ensures that security and access controls are managed by the underlying platform server.\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process metadata and results from the Harness platform. While this exposes a theoretical attack surface for indirect prompt injection from platform-stored data, the skill includes significant mitigations: it enforces strict HQL syntax, requires a validation call before any query execution, and provides rigid templates for common analysis patterns. The risk is considered low and inherent to the skill's primary function of data analysis.\n- [DYNAMIC_EXECUTION]: The skill instructs the agent to generate HQL query strings at runtime. This dynamic construction is limited to the HQL grammar and is executed through a specialized platform tool, which limits the risk compared to general-purpose code execution.
Audit Metadata