build-connector

Pass

Audited by Gen Agent Trust Hub on Jun 28, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill performs web fetches to Fivetran's official domain (fivetran.com) to check for existing connectors and determine if a source is suitable for 'Lite' (AI-managed) connectors. These references are to well-known service documentation and do not pose a risk.
  • [EXTERNAL_DOWNLOADS]: Installs the official fivetran_connector_sdk and the duckdb database library via uv pip install. These are standard dependencies for the connector's intended functionality.
  • [COMMAND_EXECUTION]: The skill executes shell commands to scaffold new projects using the fivetran init CLI tool. It uses a piped empty line and the --force flag to automate the setup process, which is documented as a way to bypass interactive prompts in a headless environment.
  • [COMMAND_EXECUTION]: Uses uv to manage virtual environments and install Python requirements, and executes verification scripts (run_connector.py) to test the created connector locally.
  • [DATA_EXPOSURE_PREVENTION]: The skill explicitly instructs the agent to avoid viewing or handling plaintext credentials. It forces a workflow where the user runs a local script (enter_configuration.py) in their own terminal to encrypt secrets, preventing sensitive data from being shared with the AI service.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 28, 2026, 05:50 PM
Security Audit — agent-trust-hub — build-connector