migrate-airflow-kestra
Fail
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the official Kestra flow schema from https://api.kestra.io/v1/plugins/schemas/flow. This is a functional requirement for validating the generated migration output against the vendor's specification.
- [COMMAND_EXECUTION]: Executes shell commands using curl to download metadata and python3 to parse the resulting JSON file locally.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to read and analyze user-provided Airflow DAG files (.py). This creates an ingestion point for untrusted data where malicious instructions could be embedded in code comments or string literals.
- Ingestion points: User-supplied Airflow DAG file path provided via arguments.
- Boundary markers: No explicit delimiters or instructions to ignore embedded commands are used when the agent reads the DAG file.
- Capability inventory: The skill utilizes network access (curl) and local file system writes to create the migration output directory and scripts.
- Sanitization: The instructions do not specify validation or sanitization of the input DAG content before processing.
Recommendations
- HIGH: Downloads and executes remote code from: https://api.kestra.io/v1/plugins/schemas/flow - DO NOT USE without thorough review
Audit Metadata