skills/keboola/ai-kit/semantic-layer/Gen Agent Trust Hub

semantic-layer

Pass

Audited by Gen Agent Trust Hub on Aug 13, 2026

Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the subprocess.run function to execute the kbagent command-line utility. This tool is used to call the query_data function for probing database column values and retrieving metadata.
  • [DATA_EXFILTRATION]: The skill performs authenticated network operations to Keboola's infrastructure (*.keboola.com) using urllib.request. It retrieves sensitive credentials (Storage API tokens) from environment variables such as KBC_TOKEN or from the local agent configuration file located at ~/Library/Application Support/keboola-agent-cli/config.json.
  • [PROMPT_INJECTION]: The skill features an attack surface for indirect prompt injection by ingesting data from external APIs and database queries into the agent's context.
  • Ingestion points: Data is ingested via api_get calls to the Keboola Metastore and through CSV results returned by the kbagent query tool.
  • Boundary markers: No specific delimiters or boundary markers are defined to isolate external data from instructions.
  • Capability inventory: The skill possesses the ability to execute shell commands (kbagent), make network requests (urllib.request), and write files to the /tmp/ directory.
  • Sanitization: Ingested content is parsed using standard JSON and CSV libraries without additional validation or filtering of the data content.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 13, 2026, 11:46 AM
Security Audit — agent-trust-hub — semantic-layer