analytics-engineer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:29 AM UTC
• Version: 1.0.0

Overview

This analytics skill is coherent and not malicious, but its examples include unsafe credential, database, and outbound automation patterns that need review before use.

Review and harden the examples before using them in a real environment. Use managed secrets, pinned dependencies, HTTPS and host allowlists for Tableau, read-only least-privilege warehouse roles, validated table and column allowlists, and explicit approval before refreshes, production dbt runs, or email alerts.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: references/examples.md:615

Finding

Tableau credentials can be transmitted to a caller-controlled endpoint

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/examples.md:690

Finding

Tableau password is hard-coded in an executable example

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/examples.md:866

Finding

Snowflake password is hard-coded in the monitoring example

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: references/examples.md:798

Finding

Unvalidated identifiers permit SQL injection in Snowflake monitoring queries

Content

View full analysis

max_age_hours: self.send_alert( f"Data freshness alert for {table_name}", f"Data is {hours_old} hours old, exceeding threshold of {max_age_hours} hours" ) return False return True def check_row_count_anomaly(self, table_name, threshold_percent=20): """Check for unusual row count changes""" query = f""" WITH daily_counts AS ( SELECT DATE(created_at) as date, COUNT(*) as row_count FROM {table_name} WHERE created_at >= CURRENT_DATE - 7 GROUP BY DATE(created_at) ORDER BY date DESC ), count_comparison AS ( SELECT date, row_count, LAG(row_count) OVER (ORDER BY date) as prev_row_count, (row_count - LAG(row_count) OVER (ORDER BY date)) / LAG(row_count) OVER (ORDER BY date) * 100 as percent_change FROM daily_counts ) SELECT * FROM count_comparison WHERE date = CURRENT_DATE - 1 """ ``` ### Technical Analysis The `table_name` and `timestamp_column` arguments are inserted directly into SQL using f-strings. These are SQL identifiers, but they are neither restricted to known values nor safely validated and quoted. Ordinary value placeholders cannot always be used for identifiers. Consequently, safe identifier construction requires an expli ...[truncated 1364 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: references/examples.md:730

Finding

CI installs unpinned third-party Python dependencies

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · references/examples.md (reported line 764)May include surrounding context.

md

dbt docs generate --target ci
        dbt docs serve --port 8080 &
        sleep 10
        curl http://localhost:8080
    
    - name: Data quality checks
      run: |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The markdown presents code that authenticates to an external service and performs refresh operations using credentials, but the surrounding documentation does not warn that the example performs outbound authenticated requests. This omission is dangerous because users may treat the file as harmless reference material while it demonstrates high-trust patterns that can move data or trigger actions outside the local analytics environment.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The example adds active control over an external BI platform via authenticated HTTP API calls, which materially expands the skill from analytics modeling into remote service operation. Even as sample code, it normalizes credential handling and outbound actions that could be copied into agent behavior without clear scoping or user consent, increasing the risk of unauthorized external actions.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

This line performs an outbound authenticated HTTP POST carrying credentials to an external service. In context, that is expected for Tableau automation, but it still represents external transmission of sensitive data and is risky when included in a general analytics skill because it can be copied into environments without proper disclosure, secret handling, or approval controls.

Content

Scanner excerpt · references/examples.md (reported line 634)May include surrounding context.

md

}
        }
        
        response = requests.post(auth_url, json=payload)
        response.raise_for_status()
        
        auth_data = response.json()

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The code invokes local subprocesses to execute dbt commands, introducing command-execution capability beyond passive analytics guidance. In an agent-skill context, examples that run tools locally can be operationalized into unintended host actions, especially if later adapted to accept variable command arguments or targets.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The example combines direct database access with SMTP alerting but does not disclose those capabilities in the markdown narrative. In a skill repository, undocumented access and communication behaviors reduce operator awareness and make it easier for copied code to be deployed with sensitive connectivity and exfiltration-adjacent functionality.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The monitoring example includes SMTP email sending, which adds an external communications channel unrelated to the stated core analytics-engineering scope. In agent settings, outbound messaging can leak operational metadata, trigger spam/alert abuse, or be repurposed for unauthorized notification workflows if not explicitly disclosed and controlled.

Content

No source excerpt is available for this finding.