migrating-dbt-core-to-fusion
Warn
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONMETADATA_POISONINGINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [METADATA_POISONING]: The skill metadata identifies the author as 'dbt-labs', which contradicts the provided author information ('kilo-org'). This discrepancy could mislead users about the skill's origin.
- [EXTERNAL_DOWNLOADS]: Fetches the
dbt-autofixtool from the dbt-labs official GitHub repository usinguvx. - [REMOTE_CODE_EXECUTION]: Executes the
dbt-autofixtool directly from a remote git repository at runtime viauvx. - [DYNAMIC_EXECUTION]: The skill can execute commands read from a project-level file (
repro_command.txt). While the platform configuration limits bash execution to specific tool prefixes (dbt, git, uvx), this remains a potential vector for executing unexpected arguments if the file is tampered with. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted project files and documentation that could contain malicious instructions.
- Ingestion points: Project SQL files, YAML configurations, command error output, and external dbt documentation as described in SKILL.md.
- Boundary markers: SKILL.md contains explicit instructions to treat all external and project content as untrusted and to ignore any instruction-like text within that data.
- Capability inventory: The skill utilizes shell execution (restricted to dbt, git, and uvx commands), network fetching via WebFetch, and file system operations (Read, Write, Edit) as defined in SKILL.md.
- Sanitization: Instructions in SKILL.md direct the agent to extract only structured fields from data and specifically forbid following links or executing commands from external sources like GitHub issues without human review.
Audit Metadata