snowflake-pipeline-guardian
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a strict read-only boundary, explicitly forbidding any SQL mutation (DDL/DML) or session modification commands through built-in SQL validation logic.
- [SAFE]: Robust data privacy measures are in place; the analyzer script includes a sophisticated redaction engine that automatically scrubs credentials, emails, URLs, and raw Snowflake identifiers from the evidence, replacing them with pseudonymous SHA-256 hashes.
- [SAFE]: The skill employs a 'Trusted Evidence Contract' which requires out-of-band SHA-256 verification of evidence bundles, ensuring the integrity of the data being analyzed and preventing the processing of tampered inputs.
- [SAFE]: Analysis is performed deterministically using local scripts without remote dependencies, network operations (beyond the explicit use of the Snowflake CLI), or persistent changes to the host system.
- [SAFE]: The detected 'Ignore previous instructions' pattern in
eval-spec.yamlis identified as a benign test case within an evaluation suite designed to test the agent's robustness against injection attacks, rather than a malicious payload.
Audit Metadata