omni-to-databricks-metric-view
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted metadata (labels, descriptions, and context) from the Omni API and interpolates it into SQL statements executed on Databricks.
- Ingestion points: The
omni models yaml-getcommand inSKILL.md(Step 2) fetches content authored within the Omni instance, which is considered untrusted data. - Boundary markers: The skill contains explicit instructions in Step 2 and Step 6 to treat fetched content as data, not directions, and to surface any suspicious text to the user.
- Capability inventory: The skill has the capability to execute SQL and modify permissions (
GRANT SELECT) via thedatabricks api postcommand. - Sanitization: Step 6 includes mandatory validation steps to strip control characters and
$$sequences, and ensures metadata values do not determine system-level targets like catalogs or schemas. - [COMMAND_EXECUTION]: The skill uses the
omnianddatabrickscommand-line interfaces to interact with external services and manage cloud configurations.
Audit Metadata