analyzing-data
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the 'uv' package manager (from astral.sh) to function. If 'uv' is missing, the scripts provide the standard installation command (
curl -LsSf https://astral.sh/uv/install.sh | sh). This refers to a well-known development service and is used for environment bootstrapping. - [REMOTE_CODE_EXECUTION]: Automated scans detected piped execution patterns (
curl | sh). These occurrences are confined to user instructions and error messages intended to guide the manual installation of the 'uv' CLI tool, which is a well-known and trusted utility. - [DYNAMIC_EXECUTION]: The skill's primary functionality is based on a persistent Jupyter-like kernel (
ipykernel). It generates and executes Python code ('preludes') to establish database connections and provides anexeccommand to run analysis code in the kernel. This is an intended architectural feature for data analysis. - [COMMAND_EXECUTION]: The
scripts/kernel.pyandscripts/cli.pyfiles usesubprocess.runto manage virtual environments, install Python dependencies, and register the Jupyter kernel using the 'uv' tool. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external warehouses (query results and schema metadata) and processes it using Polars or Pandas. While this data could theoretically contain malicious instructions, the risk is inherent to data analysis tools and is mitigated by the structured processing of results into DataFrames. 1. Ingestion points: SQL query results and INFORMATION_SCHEMA metadata processed in
scripts/connectors.pyandscripts/templates.py. 2. Boundary markers: None explicitly implemented in the skill code; relies on agent-level handling. 3. Capability inventory: Subprocess execution (uv), network access (configured warehouses), file system writes (cache files at~/.astro/ai/cache/), and Python code execution in the kernel. 4. Sanitization: Results are converted to DataFrames; no explicit prompt sanitization is performed on warehouse content before it is returned to the agent.
Audit Metadata