kafka-shadowtraffic

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The skill’s Step 1 uses attached Kafka MCPs to fetch live topic/key/value schema bodies (e.g., via get_dataset/get_topic_metadata or Schema Registry HTTP GETs), which are outsider-authored free-text schema content that is ingested into the agent’s LLM context to generate the config.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill clearly performs runtime HTTP fetches of schemas from a Schema Registry (e.g., GET http://localhost:8081/subjects/-value/versions/latest) which directly control the generator/configuration, and it also relies on pulling/running the remote Docker image shadowtraffic/shadowtraffic:latest (via docker run) which would execute remote code.