skills/treasure-data/td-skills/pytd/Gen Agent Trust Hub

pytd

Pass

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill guides users to install the pytd and pytd[spark] packages from PyPI using standard installation commands. These are official packages provided by the skill author, Treasure Data.
  • [INDIRECT_PROMPT_INJECTION]:
  • Ingestion points: The skill provides code examples (specifically in Pattern 2) that read data from external CSV files into pandas DataFrames.
  • Boundary markers: The instructions do not implement specific boundary markers or "ignore" instructions for the data contained within these external files.
  • Capability inventory: The skill includes the ability to execute SQL queries on remote databases, upload data to cloud tables, and perform network requests to official API endpoints.
  • Sanitization: The provided code examples demonstrate standard data processing but do not include explicit validation or sanitization of the contents within the ingested CSV files.
  • [DYNAMIC_EXECUTION]: The skill describes the use of the SparkWriter class, which can dynamically load a Java archive (td-spark-assembly.jar) from a file path to facilitate high-performance data transfers. This is a standard and documented feature of the vendor's SDK for large-scale data integration.
  • [CREDENTIALS_UNSAFE]: The documentation references the TD_API_KEY credential. It correctly identifies hardcoding keys as a risk and provides instructions for the secure use of environment variables to manage these secrets.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 23, 2026, 07:21 AM
Security Audit — agent-trust-hub — pytd