databricks-migration

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • Interaction with Cloud APIs: The skill utilizes the Databricks CLI and Microsoft Fabric REST API to orchestrate the migration process. These interactions are directed at official service endpoints (api.fabric.microsoft.com, *.azuredatabricks.net) and are necessary for the skill's primary function of workspace migration.
  • Secure Credential Management: The migration logic replaces Databricks secret retrieval patterns with Azure Key Vault integration using notebookutils.credentials.getSecret. This aligns with security best practices by ensuring sensitive information is stored in a dedicated, secure vault rather than within notebook code.
  • Processing of Migrated Code (Indirect Prompt Injection): The skill ingests and transforms existing notebook code from Databricks. While this involves processing external data, the transformations are automated and intended to facilitate a user-initiated migration of their own assets. Security is maintained by operating within the user's existing authorization boundaries.
  • Command-Line Orchestration: The documentation provides patterns for workspace inventory and export using standard tools like az rest and the Databricks CLI. These are standard operational patterns for cloud resource management and are documented for intended administrative use.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 03:40 PM
Security Audit — agent-trust-hub — databricks-migration