swap-databases
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from query history and system metadata that could be influenced by previous activities or attackers in the Snowflake environment. \n
- Ingestion points: Data is read from SNOWFLAKE.ACCOUNT_USAGE.QUERY_HISTORY, INFORMATION_SCHEMA, and GET_DDL output as described in SKILL.md. \n
- Boundary markers: The skill explicitly identifies 'MANDATORY STOPPING POINT' sections requiring user confirmation before grant mirroring, query replay, or executing the swap. \n
- Capability inventory: The skill uses the snowflake_sql_execute tool to perform administrative SQL operations, including DDL and DML. \n
- Sanitization: There is no automated sanitization or validation of the SQL strings retrieved from query history before they are replayed. \n- [DYNAMIC_EXECUTION]: The skill involves runtime generation and execution of SQL code. In Workflow A Step 4, it retrieves and modifies object DDL via string replacement before execution. In Step 9, it creates a stored procedure that uses EXECUTE IMMEDIATE to run captured SQL strings. \n- [COMMAND_EXECUTION]: The allowed-tools frontmatter in SKILL.md includes the Bash tool, granting the agent shell access capabilities, although the specific workflows provided are focused on Snowflake SQL execution.
Audit Metadata