domo-data-generator
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install a tool from a GitHub repository not associated with a known trusted vendor.
- Evidence:
pipx install git+https://github.com/brrink/domo_data_generator.gitinSKILL.md. - [REMOTE_CODE_EXECUTION]: The installation method involves fetching and executing code from an external source during the setup process.
- Evidence:
pipx install git+https://github.com/brrink/domo_data_generator.gitinSKILL.md. - [PERSISTENCE]: The documentation includes a cron job example for recurring execution, which establishes a persistence mechanism on the host system.
- Evidence:
0 6 * * * cd /path/to/project && datagen roll-dates && datagen upload --allinSKILL.md. - [INDIRECT_PROMPT_INJECTION]: The skill relies on processing YAML catalog definitions that could contain malicious instructions influencing the tool's output or its interaction with network endpoints.
- Ingestion points: Dataset definitions and schemas stored in the
catalog/directory as YAML files (SKILL.md). - Boundary markers: None defined; the agent processes instructions and logic embedded in YAML fields (e.g., generators, templates).
- Capability inventory: Includes local file system writes (
generate), date manipulation (roll-dates), and network uploads to Domo API endpoints (upload,create-dataset). - Sanitization: No specific sanitization or schema validation rules are described for the YAML-driven catalog processing.
Audit Metadata