databricks-unity-catalog
Pass
Audited by Gen Agent Trust Hub on Jun 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill exposes the
mcp__databricks__execute_sqltool, which allows for the execution of arbitrary SQL queries. While intended for administrative use within the Databricks environment, this represents a significant capability that could be misused if the agent is compromised. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection attack surface (Category 8).
- Ingestion points: Untrusted data enters the agent context via system tables documented in
5-system-tables.md, specifically logs such assystem.access.auditandsystem.access.table_lineagewhich record activities of external actors. - Boundary markers: The provided instructions and reference files lack explicit boundary markers or system instructions to ignore potential commands embedded within the queried data.
- Capability inventory: The skill provides extensive capabilities for data manipulation and code execution, including SQL execution via
mcp__databricks__execute_sql(mentioned inSKILL.md) and comprehensive file operations (upload, delete) in6-volumes.md. - Sanitization: There is no evidence of input validation or sanitization routines to process the data retrieved from system tables before it influences subsequent agent actions.
Audit Metadata