motherduck-partner-delivery
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFENO_CODE
Full Analysis
- [NO_CODE]: The skill contains configuration templates (SKILL.md), architectural documentation (PARTNER_DELIVERY_GUIDE.md), and example reference code (Python/TypeScript). It does not ship with self-executing malicious binaries or hidden scripts.- [EXTERNAL_DOWNLOADS]: The skill includes Python scripts that use the 'duckdb' library. These are standard data engineering dependencies used for the skill's primary purpose of database management. No unauthorized or risky external downloads were detected.- [COMMAND_EXECUTION]: The provided Python and TypeScript artifacts demonstrate how to connect to MotherDuck and run SQL queries. These are provided as static examples for developers and do not perform arbitrary command execution on the host system.- [DATA_EXFILTRATION]: There are no patterns suggesting the collection or transmission of sensitive data to third-party servers. The scripts operate within the context of the user's MotherDuck environment.- [CREDENTIALS_UNSAFE]: The skill correctly advises using environment variables (e.g., 'ACME_MD_TOKEN') and service accounts for authentication, following security best practices for secret management.
Audit Metadata