di-agent-flow-pushdown-optimizer
Pass
Audited by Gen Agent Trust Hub on Jul 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill dynamically generates and executes DataStage SDK code. In the fallback path of Step 5, it directly constructs
sdk_codeand invokes thecreate_datastage_flowtool to create new workflows. This is a core feature of the skill used for project optimization. - [DATA_EXPOSURE]: The workflow involves reading sensitive metadata, including project information, DataStage flow logic (
sdk_code), and database connection UUIDs through thelist_connectionsandretrieve_datastage_flow_codetools. This data access is scoped to the IBM/watsonx ecosystem and required for pushdown eligibility analysis. - [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface as it ingests existing DataStage flow code as untrusted data.
- Ingestion points: Flow logic is ingested from
retrieve_datastage_flow_codeinSKILL.mdStep 1. - Boundary markers: No explicit instruction delimiters or boundary markers are defined for the ingested code.
- Capability inventory: The skill can create new flows and execute SQL through the
create_datastage_flowtool and thedi-agent-query-optimizationskill. - Sanitization: The skill mitigates risks by using a structured mapping reference (
references/stage-to-sql-mapping.md) to translate DataStage logic into SQL rather than performing open-ended interpretation.
Audit Metadata