managed-airflow-dag-authoring
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [Command Execution]: The skill utilizes
gcloudandcomposer-devCLI tools to perform environment discovery, deploy DAG files to Google Cloud Storage (GCS), and run validation commands within the Managed Airflow environment. These actions are aligned with the skill's primary purpose of automating and validating the DAG deployment lifecycle. - [Usage Attribution Patterns]: The instructions include a requirement to append specific strings to the
User-Agentheader and set theCLOUDSDK_METRICS_REQUEST_ATTRIBUTIONenvironment variable forgcloudcommands. This pattern is designed for tracking the usage of the skill for analytics and does not involve the collection or transmission of user-specific sensitive data. - [Security Best Practices]: The skill promotes secure coding by instructing users to use Airflow Variables and Connections rather than hardcoding credentials directly in the code. It also highlights the importance of avoiding top-level code execution in DAG files to maintain parsing performance and security.
- [Indirect Prompt Injection Surface]: The skill processes external data by reading user-authored DAG files and querying Cloud Logging for Airflow scheduler output. As it ingests and interprets content from these sources to provide feedback or verification, it presents a standard attack surface for indirect prompt injection. The skill follows a process of identifying errors and confirming deployment success based on these external inputs.
- Ingestion points: Local DAG files (
path/to/dag.py) and Cloud Logging entries (airflow-scheduler). - Boundary markers: Not explicitly defined for external content ingestion.
- Capability inventory: File system access (reading/copying DAGs) and Google Cloud environment operations via
gcloud(describe, storage cp, and running commands). - Sanitization: Standard CLI output processing is assumed; no specific sanitization of DAG content is described before validation execution.
Audit Metadata