creating-lookml-model

Pass

Audited by Gen Agent Trust Hub on Jul 27, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to use the looker-cli tool to perform administrative and development tasks, such as creating directories, uploading LookML files, and importing model configurations. These commands are localized to the Looker project environment and are consistent with the skill's stated purpose.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided inputs from previous discovery steps (such as project IDs, dataset names, and table names) and interpolates them into shell commands and JSON payloads.
  • Ingestion points: Recalls dashboard goals and BigQuery schema specifications (Project, Dataset, Tables) from conversation history (Step 1).
  • Boundary markers: None present; the instructions do not explicitly tell the agent to sanitize these identifiers before use.
  • Capability inventory: The skill can execute shell commands via looker-cli, write files to the /tmp directory, and execute database queries.
  • Sanitization: No explicit sanitization or validation logic is defined for the external identifiers used in command templates.
  • [DYNAMIC_EXECUTION]: The skill dynamically generates LookML code and JSON configuration payloads (e.g., model_config.json, verify_query.json) at runtime, saving them to /tmp before uploading or executing them. This behavior is a standard part of the Looker modeling workflow and uses known templates.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 27, 2026, 12:06 PM
Security Audit — agent-trust-hub — creating-lookml-model