ontology-semantic-modeler

Pass

Audited by Gen Agent Trust Hub on Mar 6, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses uv run to execute local Python scripts (scripts/parse_owl.py, scripts/generate_artifacts.py, and scripts/visualize_ontology.py) which process ontology data and generate deployment artifacts.
  • [EXTERNAL_DOWNLOADS]: The skill's Python scripts depend on third-party libraries including rdflib, pyyaml, streamlit, and streamlit-agraph, which are expected to be installed from public registries.
  • [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection as it processes external data (OWL files) to generate executable SQL and semantic model configurations.
  • Ingestion points: scripts/parse_owl.py reads user-provided ontology files in OWL, RDF, or Turtle formats.
  • Boundary markers: No explicit delimiters or boundary markers are utilized when interpolating data from parsed ontologies into generated SQL templates.
  • Capability inventory: The skill possesses the capability to execute SQL via snowflake_sql_execute, run local Python scripts via uv, and write files to the local filesystem.
  • Sanitization: scripts/generate_artifacts.py includes a sql_escape function that performs single-quote escaping on string literals to mitigate SQL injection during artifact generation.
  • [DYNAMIC_EXECUTION]: The scripts/generate_artifacts.py script dynamically constructs Snowflake SQL DDL and DML statements and YAML configurations at runtime based on the logical structure defined in the provided ontology files.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 6, 2026, 04:37 PM