data-pipelines

Pass

Audited by Gen Agent Trust Hub on Apr 28, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [SAFE]: The skill instructions and examples follow industry-standard practices for data engineering and tool configuration. It uses reputable open-source libraries and frameworks.- [COMMAND_EXECUTION]: The skill demonstrates the use of several CLI tools for project management and data processing, including uv for environment control, duckdb for SQL execution, and sqlmesh for transformation workflows. These are legitimate operations within the context of data pipeline development.- [EXTERNAL_DOWNLOADS]: The skill includes instructions for installing standard data science packages through the uv package manager and supports ingesting data from common remote storage locations like S3 buckets. These external references are consistent with the skill's primary purpose.- [PROMPT_INJECTION]: The skill describes an ingestion surface for processing external data from sources such as REST APIs and S3 buckets (documented in SKILL.md), which constitutes a potential surface for indirect prompt injection. Capability inventory: The skill utilizes uv run for script execution and duckdb for file operations. Ingestion points: Examples show data being loaded via read_csv, read_parquet, and dlt rest_api_source. Boundary markers and sanitization: No specific markers or sanitization logic are defined in the provided templates.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 28, 2026, 11:02 PM
Security Audit — agent-trust-hub — data-pipelines