snowflake-snowpark-dbt
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DYNAMIC_EXECUTION]: The skill provides a code example for a Vectorized User Defined Function (UDF) that uses
pickle.load()to deserialize a model file. Thepicklemodule is known to be insecure as it can be exploited to execute arbitrary code during deserialization if the input file is malicious. Evidence:model = pickle.load(open(sys.path[0] + "/model.pkl", "rb"))inSKILL.md. - [EXTERNAL_DOWNLOADS]: The skill documents the installation and usage of several external Python packages including
dbt-snowflake,pandas,scikit-learn, andxgboost. These are standard tools from well-known organizations and represent legitimate functionality for the skill's purpose. Evidence:pip install dbt-snowflakeandsession.add_packages("pandas", "scikit-learn==1.3.0", "xgboost")inSKILL.md.
Audit Metadata