metabase-static-embedding-to-guest-embedding-upgrade

Pass

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches documentation from the official Metabase website (metabase.com). As the author of the skill is Metabase, this is a trusted resource used to provide version-specific migration guidance.- [CREDENTIALS_UNSAFE]: The skill contains specific instructions to handle the METABASE_SECRET_KEY safely, requiring the agent to use variable references instead of literal values and recommending the use of environment variables for secret management.- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted project code which constitutes a potential injection surface. Ingestion points: Project-wide Grep and Read operations in Step 1. Boundary markers: The skill uses a strict sequential execution contract and a required output structure to maintain context. Capability inventory: File modification (Edit/Write) and Bash execution. Sanitization: None specified for the read file content, but the structured workflow mitigates the risk of the agent following instructions embedded within the codebase.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 16, 2026, 04:53 AM