build-data-pipeline

Pass

Audited by Gen Agent Trust Hub on Apr 13, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The script references/dlt-dbt-motherduck-project/pipeline/run_all.py orchestrates the data pipeline by invoking the dbt CLI and local Python validation scripts. These calls are implemented securely using argument lists in subprocess.run, which prevents shell-based command injection.
  • [INDIRECT_PROMPT_INJECTION]: As a data pipeline tool, the skill is designed to ingest data from external sources such as Parquet and CSV files (e.g., via read_parquet in artifacts/pipeline_stage_example.py). This establishes a standard attack surface for indirect prompt injection if malicious data content were to influence subsequent LLM processing.
  • Ingestion points: Data enters the pipeline via local file reads and cloud storage patterns referenced in references/load_raw.py and artifacts/pipeline_stage_example.py.
  • Boundary markers: The skill implements strong architectural boundaries by separating raw, staging, and analytics databases or schemas, though it does not provide explicit prompt-level delimiters for data content.
  • Capability inventory: The skill possesses the capability to execute DuckDB SQL transformations and local subprocesses for pipeline orchestration.
  • Sanitization: The artifact artifacts/pipeline_stage_example.py includes a helper function sql_string to escape single quotes, providing basic sanitization for path strings used in SQL queries.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 13, 2026, 12:43 PM