dbt-data-modeling

Pass

Audited by Gen Agent Trust Hub on Sep 28, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill consists of documentation and configuration templates for dbt (data build tool), focusing on project structure and data integrity.
  • [EXTERNAL_DOWNLOADS]: The CI configuration example in .github/workflows/dbt-ci.yml references official GitHub Actions (actions/checkout@v4, actions/setup-python@v5) and the official dbt-snowflake package from the Python Package Index. These are well-known and trusted resources in the data engineering ecosystem.
  • [COMMAND_EXECUTION]: The skill documents standard dbt CLI operations (dbt deps, dbt build, dbt test, dbt snapshot). These commands are essential for the primary purpose of managing a data warehouse project and are used within documented examples.
  • [INDIRECT_PROMPT_INJECTION]: As a data transformation tool, dbt projects naturally ingest data from external sources (e.g., Stripe API data in the examples). While this represents a standard vulnerability surface for data pipelines (Cat 8), the skill follows best practices by using staging layers and specific source definitions to control data flow.
  • Ingestion points: Database source tables defined in __sources.yml (e.g., raw_stripe).
  • Boundary markers: dbt's source() and ref() functions act as logical boundaries between raw data and modeled logic.
  • Capability inventory: The skill uses SQL and Jinja templates to execute transformations on a target data warehouse.
  • Sanitization: Standard SQL parameterization and database driver escaping are managed by the underlying dbt-core engine.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 28, 2026, 05:04 PM