data-catalog-entry
Warn
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/catalog_extractor.pyis vulnerable to SQL injection. It constructs a SQL query for row counting using f-string interpolation (f"SELECT COUNT(*) FROM {qualified}") with user-supplied table and schema names. If an attacker can influence the table name provided to the script, they can execute arbitrary SQL commands on the target database. - [CREDENTIALS_UNSAFE]: The metadata extractor script's documentation and help text explicitly suggest passing database connection strings that include sensitive credentials (usernames and passwords) as plain-text command-line arguments (e.g.,
--conn "postgresql://user:pass@host/db"). This practice exposes credentials in shell history files and system process listings. - [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and process metadata from external database systems, creating an attack surface for indirect injection.
- Ingestion points: Technical metadata, column names, and row counts are retrieved from external databases via the
scripts/catalog_extractor.pyscript. - Boundary markers: Absent. The instructions and scripts do not implement delimiters or guidance to treat data retrieved from the database as potentially untrusted.
- Capability inventory: The skill has the capability to connect to arbitrary databases, execute SQL queries, and generate/write markdown files to the local file system.
- Sanitization: Absent. The script lacks validation for schema or table names, directly leading to the SQL injection vulnerability described above.
Audit Metadata