The Agent Skills Directory

[REMOTE_CODE_EXECUTION] (HIGH): The skill uses uvx --from astro-airflow-mcp@latest af to execute commands. This pattern downloads and runs code from a remote source at runtime. The source astro-airflow-mcp is not from a trusted organization or repository listed in the security protocols, making it a target for supply chain attacks.
[PROMPT_INJECTION] (HIGH): The skill is highly vulnerable to Indirect Prompt Injection (Category 8).
Ingestion points: Task logs are ingested via the af tasks logs command.
Boundary markers: None specified; there are no instructions to isolate or treat log data as untrusted.
Capability inventory: The skill explicitly directs the agent to "Fix and Retest" (modify code) based on these logs.
Sanitization: None. A malicious task could output logs designed to trick the agent into injecting backdoors or malicious logic during the suggested fix phase.
[CREDENTIALS_UNSAFE] (HIGH): The skill provides the command af config connections, which is used to list and potentially view Airflow connection details. These often contain sensitive credentials, including passwords and API tokens, leading to credential exposure.
[DATA_EXFILTRATION] (MEDIUM): In addition to credentials, af config variables allows access to potentially sensitive environment configurations that could be exfiltrated if the agent is manipulated into outputting the results.
[COMMAND_EXECUTION] (MEDIUM): The use of shell-based commands with variables like <dag_id> and --conf presents a risk of command injection if inputs are not strictly validated by the underlying agent or the af tool itself.

testing-dags