malloy-modeling
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill utilizes specialized Model Context Protocol (MCP) tools provided by the Malloy Publisher for schema introspection and data querying, which are appropriate for its intended modeling purpose.
- [EXTERNAL_DOWNLOADS]: The documentation references an official project scaffolding utility (@malloy-publisher/malloy-package). This is a standard developer tool within the Malloy ecosystem and originates from the vendor's namespace.
- [COMMAND_EXECUTION]: The workflow describes using tools for compilation and package reloading during the development process. These actions are limited to the package context and do not involve arbitrary shell command execution.
- [PROMPT_INJECTION]: While the skill ingests external data (files and database schemas) which is a surface for indirect prompt injection, it incorporates mandatory human validation steps ('The pauses are the point') to ensure that generated logic is verified by a user.
Audit Metadata