The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted data from the local environment.
Ingestion points: The agent is directed to use file tools to read **/dags/**/*.py and requirements.txt, and to execute af dags explore and af tasks logs to inspect code and logs.
Capability inventory: The agent has the ability to write new files, modify project dependencies in requirements.txt, and execute a variety of af CLI commands.
Boundary markers: There are no instructions to the agent to treat these external inputs as untrusted or to ignore embedded instructions.
Sanitization: No sanitization or validation of the ingested content is performed before it is used in the agent's reasoning loop.
[DATA_EXFILTRATION]: The skill instructs the agent to run commands that may expose sensitive environment configuration.
Evidence: af config connections and af config variables are explicitly recommended in the discovery phase. In Airflow, these stores frequently contain sensitive credentials like database passwords, API keys, and service tokens.
Context: While necessary for understanding the available environment, this behavior creates a risk of accidental data leakage if the agent's output is shared or logged.
[CREDENTIALS_UNSAFE]: A hardcoded database connection string was detected in the documentation.
Evidence: The file reference/best-practices.md contains the string postgresql://user:password@host:5432/db.
Context: This string is used as an example of an 'anti-pattern' in a section titled 'Never Hard-Code Credentials'. It utilizes generic placeholders and is intended for educational purposes, posing no actual security threat.

authoring-dags