byted-bytehouse-hybrid-search
Pass
Audited by Gen Agent Trust Hub on May 7, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: Potential SQL injection surface in
scripts/hybrid_search_client.pydue to the dynamic construction of SQL queries.\n - Ingestion points: Arguments like
table_nameandtop_kin methods such ascreate_hybrid_table,insert_document,fulltext_search, andvector_searchare directly interpolated into SQL strings using Python f-strings.\n - Boundary markers: Absent. The code does not use backticks or other escaping mechanisms for table identifiers or numeric limits.\n
- Capability inventory: The skill uses
clickhouse_connectto perform operations on the database, including creating tables and executing search queries.\n - Sanitization: No validation or sanitization is performed on identifiers before they are incorporated into the SQL commands. While typical for specialized database tools, this pattern allows for query manipulation if the agent sources these specific parameters from unvalidated user input.
Audit Metadata