apache-arrow
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides standard and safe implementation patterns for the Apache Arrow ecosystem. All code snippets utilize official library APIs for data manipulation and inter-process communication.
- [INDIRECT_PROMPT_INJECTION]: The skill defines patterns for ingesting data from external sources, including Parquet files, CSVs, and S3 buckets (
s3://my-bucket/events/). While ingesting untrusted data is a theoretical vector for indirect prompt injection, the skill treats this data as structured columnar content and does not demonstrate unsafe interpolation into LLM prompts. This is a standard risk factor for data-processing skills and is handled using appropriate library filters and schemas. - [EXTERNAL_DOWNLOADS]: Installation instructions refer to well-known and trusted libraries (
pyarrow,pandas,polars,duckdb,apache-arrow) via official package registries (PyPI, NPM). References to external repositories point to the official Apache Arrow GitHub organization. - [DATA_EXFILTRATION]: The skill includes examples of reading from remote S3 storage and sending data to an API via
fetchPOST. These operations are core to the skill's purpose of data interchange and are documented using placeholder URLs and standard environment-based credential management (AWS credentials), presenting no inherent security risk.
Audit Metadata