build-data-pipeline
Pass
Audited by Gen Agent Trust Hub on Apr 13, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The script
references/dlt-dbt-motherduck-project/pipeline/run_all.pyorchestrates the data pipeline by invoking thedbtCLI and local Python validation scripts. These calls are implemented securely using argument lists insubprocess.run, which prevents shell-based command injection. - [INDIRECT_PROMPT_INJECTION]: As a data pipeline tool, the skill is designed to ingest data from external sources such as Parquet and CSV files (e.g., via
read_parquetinartifacts/pipeline_stage_example.py). This establishes a standard attack surface for indirect prompt injection if malicious data content were to influence subsequent LLM processing. - Ingestion points: Data enters the pipeline via local file reads and cloud storage patterns referenced in
references/load_raw.pyandartifacts/pipeline_stage_example.py. - Boundary markers: The skill implements strong architectural boundaries by separating
raw,staging, andanalyticsdatabases or schemas, though it does not provide explicit prompt-level delimiters for data content. - Capability inventory: The skill possesses the capability to execute DuckDB SQL transformations and local subprocesses for pipeline orchestration.
- Sanitization: The artifact
artifacts/pipeline_stage_example.pyincludes a helper functionsql_stringto escape single quotes, providing basic sanitization for path strings used in SQL queries.
Audit Metadata