Databricks databricks-apps — agentic threat model

Not certain from the listing — the specific foundation models used for code generation and scaffolding are not disclosed, leaving potential vulnerabilities to model-specific prompt injection or adversarial manipulation unquantified.

Integrates directly with the Databricks Lakehouse. This poses significant risks of unauthorized data exfiltration, exposure of sensitive schemas, or data poisoning if the agent is manipulated into reading from or writing to unauthorized data assets.

The agent orchestrates app scaffolding, configuration, and deployment. Vulnerabilities here include the generation of insecure or vulnerable application code (CWE-94) and the potential for tool misuse when interacting with Databricks deployment APIs.

Deploys applications directly into the user's Databricks workspace. A compromise at this layer could lead to container escape, privilege escalation within the workspace, or lateral movement across the broader cloud environment hosting the Databricks deployment.

Not certain from the listing — there is no mention of built-in guardrails, output validation, or logging mechanisms to monitor the safety of the generated code or the legitimacy of the deployment actions.

Relies on the security posture of the host Databricks workspace. Risks include credential theft or abuse of the deployment identity/service principal, which could bypass traditional organizational access controls and compliance boundaries.

Not certain from the listing — while it operates as a 'Skill' within the Databricks ecosystem, there is no explicit detail on multi-agent orchestration or interactions with external agent marketplaces.