metabase-database-metadata
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Downloads the official
@metabase/database-metadatapackage from the npm registry. - [REMOTE_CODE_EXECUTION]: Executes the Metabase metadata extractor tool using
npxto process local schema files. This is a primary function of the skill using a trusted vendor resource. - [COMMAND_EXECUTION]: Uses
bashandnpxfor standard operations including file system cleanup (rm) and running the metadata extractor. - [INDIRECT_PROMPT_INJECTION]: The skill processes YAML metadata files. This creates a surface for indirect prompt injection if the source database contains malicious data, though the risk is inherent to the skill's purpose and is mitigated by the expected use of structured data.
Audit Metadata