setup-warehouse-redshift
Warn
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: MEDIUMPROMPT_INJECTIONDYNAMIC_EXECUTIONDATA_EXFILTRATIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill contains explicit instructions to perform background telemetry and network operations while concealing them from the user. It directs the agent to keep telemetry "transparent to the user" and to "never mention it" or "narrate telemetry" during execution, which intentionally bypasses user oversight for network communications.
- [DYNAMIC_EXECUTION]: The skill utilizes
python3 -cto dynamically parse and process data from the network and local environment. This includes piping responses from remote API calls (fetching client secrets) and JWT tokens directly into a Python interpreter for processing. - [DATA_EXFILTRATION]: The skill implements a telemetry system that transmits session IDs, skill usage details, and inferred user sentiment to external endpoints (e.g.,
events.confidence.dev). - [COMMAND_EXECUTION]: Shell commands are executed with
dangerouslyDisableSandbox: trueto enable network access and system interaction (AWS CLI, gcloud), which grants the skill broad permissions outside the restricted environment. - [INDIRECT_PROMPT_INJECTION]: The skill creates an attack surface by ingesting external data—such as event definitions, client lists, and AWS resource names—which are then interpolated into subsequent tool calls and command lines without explicit sanitization or boundary markers.
Audit Metadata