flink-udf
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
confluentCLI anddockerto perform infrastructure management, artifact creation, and function registration. These operations are restricted to the intended developer workflow. - [EXTERNAL_DOWNLOADS]: The skill fetches environment configurations and CLI plugins from Confluent's official GitHub repositories and domains. These are trusted vendor resources associated with the skill's author.
- [INDIRECT_PROMPT_INJECTION]: The skill has a vulnerability surface for indirect prompt injection because it ingests user-defined business logic to generate and deploy Java code.
- Ingestion points: User-provided logic for scalar UDFs, UDTFs, or PTFs in
SKILL.md. - Boundary markers: The instructions include a mandatory safety workflow (Step 5) requiring the agent to display the full deployment plan, including exact commands and JAR paths, and wait for explicit user confirmation before proceeding.
- Capability inventory: Subprocess calls for Maven/Gradle builds,
dockermanagement, andconfluentCLI operations across all reference guides. - Sanitization: The primary protection against malicious generated code is the required human-in-the-loop verification step.
Audit Metadata