tinybird-cli-guidelines
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides instructions for installing the Tinybird CLI in CI/CD environments by piping a remote script to a shell (e.g.,
curl https://tinybird.co | sh). This is documented as the vendor's official installation method. - [COMMAND_EXECUTION]: The instructions involve the agent executing various shell commands via the
tbCLI, including running SQL queries (tb sql) and generating mock data using local number generation. - [EXTERNAL_DOWNLOADS]: The skill documents features for fetching data from remote URLs using
tb datasource append --urland references standard third-party GitHub Actions in configuration examples. - [INDIRECT_PROMPT_INJECTION]: The skill defines workflows for ingesting and processing untrusted data, creating a potential attack surface for indirect prompt injection.
- Ingestion points: Remote URLs in
datasource appendcommands, local fixture files stored in thefixtures/directory, and SQL query results. - Boundary markers: None identified in the instructions to separate external data from system instructions.
- Capability inventory: The skill utilizes the
tbCLI to build, deploy, query, and manage workspace resources, including writing fixtures to the local file system and making network requests for data ingestion. - Sanitization: No explicit sanitization, validation, or escaping of the ingested data content is described in the guidelines.
Audit Metadata