gateway-plugin-datakit

Pass

Audited by Gen Agent Trust Hub on Jun 15, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill provides legitimate guidance for configuring Kong DataKit orchestration flows, adhering to established vendor practices.
  • [COMMAND_EXECUTION]: The skill includes a Python script (scripts/validate_datakit_flow.py) used for static analysis of configuration files. This script is part of the skill's core functionality for error detection and uses yaml.SafeLoader to mitigate common YAML-based vulnerabilities such as arbitrary code execution during parsing.
  • [DATA_EXPOSURE]: The patterns and references provided explicitly advocate for secure credential management by using vault-backed secrets (vault://) instead of hardcoded values.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing untrusted data (user-provided or repository-hosted YAML files). However, the capability is limited to static validation through a Python script that uses a secure parser, posing no significant risk to the agent environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 15, 2026, 10:10 AM
Security Audit — agent-trust-hub — gateway-plugin-datakit