undercroft-model-builder
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill interacts with external data sources, including data lake records and workbook contents, which serves as a potential surface for indirect prompt injection.
- Ingestion points: The agent reads data payloads using lake.records, lake.query, and document_rows across SKILL.md and its references.
- Boundary markers: The workflow enforces strict human-in-the-loop checkpoints (Guardrails 2, 7, 9, 13) requiring explicit user approval for every save and build operation.
- Capability inventory: The skill can save models and questions (models.save, bi.questions.save) and execute build runs (models.build).
- Sanitization: Instructions mandate sampling payloads for type verification and using platform-provided macros for data casting rather than relying on inferred values.
- [DYNAMIC_EXECUTION]: The skill dynamically generates dbt models and macros based on user requirements and data samples.
- Execution method: The generated code is compiled and executed through specific platform tools like models.check, models.preview, and models.build.
- Mitigation: Guardrail 11 explicitly directs the agent to avoid manual rendering of Jinja templates, instead using the platform's toolchain to ensure safe compilation and execution within the dbt environment.
Audit Metadata