skills/spotdraft/oncall-investigator-skills/questionnaire-hidden-variable-data-loss/Gen Agent Trust Hub
questionnaire-hidden-variable-data-loss
Warn
Audited by Gen Agent Trust Hub on Apr 9, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [DATA_EXFILTRATION]: The skill discloses a curated list of enterprise customer names (including Crunchbase, Oyster HR, and Chargebee) mapped to their internal Workspace IDs and infrastructure clusters. This exposure of customer-identifiable information constitutes a data leak.
- [COMMAND_EXECUTION]: Internal database schemas and project structures for both production and QA environments are exposed through the inclusion of raw SQL queries. This includes specific table names such as
public_contracts_v3_contractdataandpublic_contracts_v3_contractversion. - [COMMAND_EXECUTION]: The skill relies on template-based SQL execution where user-provided identifiers (
{contract_id},{workflow_id}) are interpolated directly into queries. Without strict sanitization by the platform, this represents a SQL injection vulnerability surface. - [COMMAND_EXECUTION]: Detailed instructions for performing destructive operations (soft-deletes) and modifying entity dependencies within internal administrative panels are provided. While intended for support, documenting these manual modification paths increases the risk of unauthorized or erroneous data manipulation.
Audit Metadata