snowflake
Pass
Audited by Gen Agent Trust Hub on Mar 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [SAFE]: No malicious patterns or security risks were identified in the skill's instructions or templates.\n- [COMMAND_EXECUTION]: The skill instructs the agent on how to use dynamic SQL via the Snowflake IDENTIFIER() function. It proactively mitigates SQL injection risks by providing mandatory sanitization rules, such as validating prefixes against an alphanumeric allow-list ([A-Z0-9_]) and rejecting command separators like semicolons in task arguments.\n- [EXTERNAL_DOWNLOADS]: The README and SKILL.md files provide installation instructions via npx skills add pointing to the author's GitHub repository (oswaldonisango/snowflake-skill). These references are standard for skill distribution and follow established installation patterns.\n- [DATA_EXFILTRATION]: The skill utilizes deployment-time placeholders (e.g., ${avacore.schema}, ${avashort.warehouse}) to manage environment-specific configurations. No hardcoded secrets, sensitive file paths, or unauthorized external network requests were found.
Audit Metadata