lookml-field-curation

SUSPICIOUS. The skill’s capabilities mostly match its stated LookML curation purpose and its data flows stay within local LookML, Looker sandbox queries, and warehouse metadata. The main issue is install/execution trust: it depends on a non-official third-party lkr CLI from PyPI that may receive authenticated Looker context, which makes this higher risk than a purely local/official-tool skill even though there is no clear malicious behavior or exfiltration path.

This code analyzes field cardinality and generates LookML recommendations by issuing database queries. It contains no evident malware, credential theft, or unrelated network activity, but unvalidated table and column identifiers are interpolated into SQL submitted through query APIs, creating SQL injection risk when inputs are untrusted; generated LookML identifiers are also not validated. Severity is moderate and depends on the trustworthiness of the supplied metadata and query API permissions.