fiftyone-generate-data-lens-connector
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The README.md file recommends an installation method using
curl -sL skil.sh | sh. This pattern downloads and executes a script from a remote source. Whileskil.shis a known resource associated with the vendor Voxel51, piping remote content to a shell is a security risk. - [COMMAND_EXECUTION]: The skill generates Python code based on user input and then performs automated validation in Phase 4. This includes executing shell commands via
python -cto parse the generated code's AST and running construction tests forfo.Sampleobjects. This involves executing code that the agent has just generated. - [COMMAND_EXECUTION]: The installation guidance in SKILL.md instructs the agent to perform file system operations using
cp -rto move the generated plugin into the FiftyOne plugins directory. - [PROMPT_INJECTION]: The skill has an indirect prompt injection surface in Phase 1, where it ingests untrusted database schemas (DDL, JSON, etc.) to generate code. While the skill includes a specific directive (Rule 3) to enforce parameterized queries in the output, the ingestion of untrusted structured data to influence code generation is a known attack vector.
- Ingestion points: Database schemas provided by the user in Phase 1 (SKILL.md).
- Boundary markers: None explicitly defined for the schema input block.
- Capability inventory: The skill can write files (
__init__.py,fiftyone.yml,requirements.txt), execute shell commands for validation (python -c), and perform file system copies (cp -r). - Sanitization: The skill mitigates downstream SQL injection by mandating parameterized queries in the generated code, but does not explicitly sanitize the input schema strings before processing.
Audit Metadata