semantic-layer
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
subprocess.runfunction to execute thekbagentcommand-line utility. This tool is used to call thequery_datafunction for probing database column values and retrieving metadata. - [DATA_EXFILTRATION]: The skill performs authenticated network operations to Keboola's infrastructure (
*.keboola.com) usingurllib.request. It retrieves sensitive credentials (Storage API tokens) from environment variables such asKBC_TOKENor from the local agent configuration file located at~/Library/Application Support/keboola-agent-cli/config.json. - [PROMPT_INJECTION]: The skill features an attack surface for indirect prompt injection by ingesting data from external APIs and database queries into the agent's context.
- Ingestion points: Data is ingested via
api_getcalls to the Keboola Metastore and through CSV results returned by thekbagentquery tool. - Boundary markers: No specific delimiters or boundary markers are defined to isolate external data from instructions.
- Capability inventory: The skill possesses the ability to execute shell commands (
kbagent), make network requests (urllib.request), and write files to the/tmp/directory. - Sanitization: Ingested content is parsed using standard JSON and CSV libraries without additional validation or filtering of the data content.
Audit Metadata