pytd
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill guides users to install the
pytdandpytd[spark]packages from PyPI using standard installation commands. These are official packages provided by the skill author, Treasure Data. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The skill provides code examples (specifically in Pattern 2) that read data from external CSV files into pandas DataFrames.
- Boundary markers: The instructions do not implement specific boundary markers or "ignore" instructions for the data contained within these external files.
- Capability inventory: The skill includes the ability to execute SQL queries on remote databases, upload data to cloud tables, and perform network requests to official API endpoints.
- Sanitization: The provided code examples demonstrate standard data processing but do not include explicit validation or sanitization of the contents within the ingested CSV files.
- [DYNAMIC_EXECUTION]: The skill describes the use of the
SparkWriterclass, which can dynamically load a Java archive (td-spark-assembly.jar) from a file path to facilitate high-performance data transfers. This is a standard and documented feature of the vendor's SDK for large-scale data integration. - [CREDENTIALS_UNSAFE]: The documentation references the
TD_API_KEYcredential. It correctly identifies hardcoding keys as a risk and provides instructions for the secure use of environment variables to manage these secrets.
Audit Metadata