dbt-data-modeling
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill consists of documentation and configuration templates for dbt (data build tool), focusing on project structure and data integrity.
- [EXTERNAL_DOWNLOADS]: The CI configuration example in
.github/workflows/dbt-ci.ymlreferences official GitHub Actions (actions/checkout@v4,actions/setup-python@v5) and the officialdbt-snowflakepackage from the Python Package Index. These are well-known and trusted resources in the data engineering ecosystem. - [COMMAND_EXECUTION]: The skill documents standard dbt CLI operations (
dbt deps,dbt build,dbt test,dbt snapshot). These commands are essential for the primary purpose of managing a data warehouse project and are used within documented examples. - [INDIRECT_PROMPT_INJECTION]: As a data transformation tool, dbt projects naturally ingest data from external sources (e.g., Stripe API data in the examples). While this represents a standard vulnerability surface for data pipelines (Cat 8), the skill follows best practices by using staging layers and specific source definitions to control data flow.
- Ingestion points: Database source tables defined in
__sources.yml(e.g.,raw_stripe). - Boundary markers: dbt's
source()andref()functions act as logical boundaries between raw data and modeled logic. - Capability inventory: The skill uses SQL and Jinja templates to execute transformations on a target data warehouse.
- Sanitization: Standard SQL parameterization and database driver escaping are managed by the underlying dbt-core engine.
Audit Metadata