rpk-transform

Pass

Audited by Gen Agent Trust Hub on Nov 2, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The rpk transform deploy command accepts a URL via the --file flag to fetch WebAssembly (.wasm) binaries from remote sources. The documentation explicitly recommends using HTTPS and trusted sources for these downloads.
  • [REMOTE_CODE_EXECUTION]: The skill facilitates the deployment of code (Wasm) that executes on the Redpanda broker. However, the documentation notes that these transforms run within a sandboxed Wasm VM with restricted access (no external network or disk access), which significantly mitigates risk.
  • [EXTERNAL_DOWNLOADS]: The rpk transform build and rpk transform init --install-deps commands automate the retrieval of language buildpacks (e.g., TinyGo, JS Wasm VM) and project dependencies using standard package managers like npm, cargo, and go.
  • [COMMAND_EXECUTION]: The skill provides numerous examples of using the rpk CLI to modify cluster configurations, manage Kafka topics, and control transform lifecycles. These are administrative actions consistent with the skill's stated purpose of managing data infrastructure.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 2, 2026, 02:28 AM