snowflake-cost-leak-hunter
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill implements a robust 'read-only' contract, explicitly forbidding DDL/DML operations and privilege escalation. It uses a custom SQL parser in collect_snowflake_evidence.py to ensure only safe 'SELECT', 'SHOW', and 'DESCRIBE' commands are executed.
- [COMMAND_EXECUTION]: The skill uses the Bash tool to execute the Snowflake CLI ('snow') through a controlled Python wrapper. This execution is limited to pre-defined, validated SQL templates and uses connection profiles already configured on the host machine.
- [DATA_EXFILTRATION]: While the skill processes Snowflake usage data, it includes sophisticated sanitization logic in analyze_cost_evidence.py and collect_snowflake_evidence.py. It automatically hashes sensitive identifiers (usernames, warehouse names, tags) using SHA-256 and redacts potential credentials (passwords, tokens, authorization headers, presigned URLs) from its output using complex regular expressions.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests Snowflake usage data (such as query tags). However, it mitigates risk by hashing these values and treating them as structured data for deterministic analysis rather than interpreting them as instructions. Ingestion points: Snowflake ACCOUNT_USAGE views (scripts/collect_snowflake_evidence.py). Boundary markers: Usage of typed ledgers and integrity digests. Capability inventory: File write and Bash execution for analysis scripts. Sanitization: Hashing of all user-controlled identifiers and credential redaction.
Audit Metadata