motherduck-create-flight
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the creation of Python scripts that ingest data from external sources such as public APIs, databases, and S3 buckets.
- Ingestion points: External data is ingested in
references/FLIGHT_EXAMPLES.mdviahttpx.get(GitHub API),postgres_query(Postgres tables), andread_parquet(S3 storage). - Boundary markers: The provided code templates include explicit boundary management using SQL parameter binding (
?) and strict identifier validation. - Capability inventory: Created scripts have access to MotherDuck database connections, network operations (
httpx), and MotherDuck secrets injected as environment variables. - Sanitization: The templates implement best practices including regex-based SQL identifier validation (
validate_identifier) and identifier quoting (quote_ident). - [EXTERNAL_DOWNLOADS]: The skill templates reference and install standard libraries from PyPI and fetch data from well-known services.
- Evidence:
requirements_txtsections inreferences/FLIGHT_EXAMPLES.mdpinduckdb,dlt,httpx, andtenacity. - Evidence: Templates fetch data from GitHub's public API and a MotherDuck-owned S3 bucket (
s3://us-prd-motherduck-open-datasets). - [COMMAND_EXECUTION]: The MotherDuck Flights runtime environment described in
references/FLIGHTS_GUIDE.mdallows the use ofsubprocessandapt-get installfor environment setup (e.g., installinggitorffmpeg). This is a documented platform capability intended for workload orchestration.
Audit Metadata