airflow-hitl
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data via Jinja templates in the
bodyparameter of HITL operators, creating a potential surface for indirect injection if data pulled from previous tasks contains malicious instructions.\n - Ingestion points: Untrusted data enters the agent context via XCom pulls (e.g.,
ti.xcom_pull) used in thebodyandsubjectparameters of HITL operators inSKILL.md.\n - Boundary markers: The instructions do not specify the use of delimiters or provide explicit warnings to the agent to ignore instructions embedded in the interpolated data.\n
- Capability inventory: The skill demonstrates network operations via the
requestslibrary and system command execution via theafCLI tool.\n - Sanitization: No evidence of content sanitization, escaping, or validation is provided for the interpolated data.\n- [COMMAND_EXECUTION]: The skill provides instructions to execute the
afCLI tool to perform environment-specific discovery tasks, including fetching registry signatures, querying configuration details, and checking installed provider versions. These are used to adapt code to the specific Airflow environment.\n- [EXTERNAL_DOWNLOADS]: The skill references standard and expected packages from the official Apache Airflow ecosystem, specificallyapache-airflow-providers-standard.
Audit Metadata