motherduck-create-flight

Pass

Audited by Gen Agent Trust Hub on Sep 6, 2026

Risk Level: SAFE
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill facilitates the creation of Python scripts that ingest data from external sources such as public APIs, databases, and S3 buckets.
  • Ingestion points: External data is ingested in references/FLIGHT_EXAMPLES.md via httpx.get (GitHub API), postgres_query (Postgres tables), and read_parquet (S3 storage).
  • Boundary markers: The provided code templates include explicit boundary management using SQL parameter binding (?) and strict identifier validation.
  • Capability inventory: Created scripts have access to MotherDuck database connections, network operations (httpx), and MotherDuck secrets injected as environment variables.
  • Sanitization: The templates implement best practices including regex-based SQL identifier validation (validate_identifier) and identifier quoting (quote_ident).
  • [EXTERNAL_DOWNLOADS]: The skill templates reference and install standard libraries from PyPI and fetch data from well-known services.
  • Evidence: requirements_txt sections in references/FLIGHT_EXAMPLES.md pin duckdb, dlt, httpx, and tenacity.
  • Evidence: Templates fetch data from GitHub's public API and a MotherDuck-owned S3 bucket (s3://us-prd-motherduck-open-datasets).
  • [COMMAND_EXECUTION]: The MotherDuck Flights runtime environment described in references/FLIGHTS_GUIDE.md allows the use of subprocess and apt-get install for environment setup (e.g., installing git or ffmpeg). This is a documented platform capability intended for workload orchestration.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 6, 2026, 08:24 PM