agent-data-engineer
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to build data pipelines that ingest content from external, potentially untrusted sources such as Kafka topics, cloud storage buckets, and third-party APIs (e.g., Stripe) as demonstrated in the Kafka consumer and Airflow DAG examples.
- Ingestion points: Identified in
consumers/order_events_consumer.py(Kafka) anddags/daily_etl.py(GCS/Stripe). - Boundary markers: The instructions lack explicit delimitation or "ignore embedded instructions" warnings for the data being processed through these pipelines.
- Capability inventory: The skill utilizes extensive capabilities including database writes, cloud infrastructure management, and network communication for stream processing.
- Sanitization: No specific sanitization or validation logic is provided to prevent malicious payloads within the data from influencing the agent's logic during transformation or movement.
- [PROMPT_INJECTION]: The skill ends with a
$ARGUMENTSplaceholder. In many AI agent platforms, this represents a template variable where user-supplied input is directly interpolated. This creates a surface for direct prompt injection if the user input is not properly delimited, allowing an attacker to potentially override the skill's core instructions.
Audit Metadata