schema-exploration
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONDATA_EXFILTRATIONMETADATA_POISONING
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content from the database schema and statistics, creating a surface for indirect prompt injection. 1. Ingestion points: Results from catalog queries and table row samples (e.g., in overview.md, data-values.md). 2. Boundary markers: Instructions mandate establishing a restricted scope and obtaining explicit user approval before reading statistics or data. 3. Capability inventory: Generates and executes SQL queries and EXPLAIN plans. 4. Sanitization: Recommends using parameter binding for values and pg_catalog.format with the %I specifier for identifiers.
- [DYNAMIC_EXECUTION]: The skill employs dynamic SQL generation to perform row sampling. Evidence: The query generator in references/data-values.md uses pg_catalog.format to assemble SELECT statements from schema, table, and column names at runtime.
- [DATA_EXFILTRATION]: The skill includes methods to access database statistics and metadata that may contain sensitive information. Evidence: Queries target pg_catalog.pg_stats for common values and histogram bounds, and foreign table definitions which may disclose server details. The skill correctly documentation these areas as sensitive.
- [METADATA_POISONING]: A discrepancy exists between the author name 'tigerdata' in the skill metadata and the 'timescale' vendor context provided.
Audit Metadata