metabase-rde
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the official Metabase CLI (
@metabase/cli) via npm. This is a trusted vendor resource provided by the skill's author. - [DYNAMIC_EXECUTION]: The skill generates a local helper script
./.scratch/qand a temporary bash command to manage environment variables. These are used to facilitate database queries and credential management within the local environment. This behavior is transparently documented and serves the skill's core functionality. - [INDIRECT_PROMPT_INJECTION]: As a data engineering tool, the skill naturally ingests and processes data from external databases and files. While this presents a standard attack surface for indirect prompt injection, the skill includes explicit instructions for data profiling and verification to mitigate risks associated with untrusted data.
- [COMMAND_EXECUTION]: The skill makes extensive use of the
mbCLI to interact with Metabase instances. All commands are structured according to the tool's intended use for data engineering tasks.
Audit Metadata