debezium-and-kafka-connect-cdc
Warn
Audited by Gen Agent Trust Hub on Jul 7, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
checks/replay_idempotency.pyexecutes shell commands provided via the--commandcommand-line argument usingsubprocess.run(shell=True). This allows for arbitrary command execution on the host system if the agent is directed to use this script with untrusted inputs. - Evidence:
subprocess.run(command, shell=True, cwd=cwd, capture_output=True, text=True)inchecks/replay_idempotency.pyat line 106. - [PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection because several scripts ingest data from external files (Parquet, CSV, JSONL, YAML) and output summaries directly to the agent's context without sanitization.
- Ingestion points:
checks/duplicate_rate.py(line 52),checks/schema_drift.py(lines 48, 64, 76), andchecks/replay_idempotency.py(line 123). - Boundary markers: Absent. The scripts output raw data or JSON summaries without delimiters or instructions to ignore embedded commands.
- Capability inventory: The skill has the ability to execute shell commands via
subprocess.runand perform file system read operations. - Sanitization: No validation or sanitization is performed on the content of the data files before it is processed and reported to the agent.
Audit Metadata