kafka-shadowtraffic-java
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a
docker runcommand via the Bash tool to perform linting on the generated ShadowTraffic configuration file. This execution utilizes the officialshadowtraffic/shadowtrafficimage and is performed within the local project context. - [EXTERNAL_DOWNLOADS]: The skill pulls Docker images for Kafka and Schema Registry from Confluent's official registries and adds Maven/Gradle dependencies from standard registries and the Confluent repository (https://packages.confluent.io/maven/). These represent well-known technology services.
- [DATA_EXFILTRATION]: The skill handles license credentials by instructing the user to set environment variables and generating code that accesses them at runtime via
System.getenv(). This follows security best practices to prevent hardcoding of secrets. - [SAFE]: The skill's primary functions involve reading local project metadata to infer package names and writing generated Java source code and configuration files, which is consistent with its stated purpose as a development scaffolding tool.
Audit Metadata