qa-data-seeder
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill demonstrates safe credential management practices by explicitly instructing the agent to retrieve tokens and connection strings from environment variables or user input rather than hardcoding sensitive information.
- [SAFE]: Includes critical safety constraints that prevent the skill from operating on production environments and requires an explicit user approval gate (Step 3) before any data is generated or seeded.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data by analyzing project source code and API documentation to design datasets. While this creates a potential attack surface for indirect prompt injection, the risk is mitigated by a mandatory human-in-the-loop verification step where the user must approve the proposed data categories and counts before execution.
- [COMMAND_EXECUTION]: The skill is designed to generate and execute application-specific seed scripts. This is the primary intended purpose of the tool and is performed using existing project mechanisms, REST APIs, or MCP tools, following a user-approved plan.
Audit Metadata