apache-storm-expert

Warn

Audited by Gen Agent Trust Hub on Apr 20, 2026

Risk Level: MEDIUMREMOTE_CODE_EXECUTIONPROMPT_INJECTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADS
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The Python bolt example in references/real-world-patterns.md uses pickle.load() for deserializing machine learning models. This pattern is vulnerable to unsafe deserialization, which can lead to arbitrary code execution if the serialized file is compromised or originates from an untrusted source.\n- [PROMPT_INJECTION]: Architectures for log processing and Twitter streaming described in references/real-world-patterns.md ingest untrusted external data. The absence of documented sanitization techniques or strict boundary markers creates an indirect prompt injection surface where instructions embedded in the processed data could influence subsequent agent or system logic.\n- [DATA_EXFILTRATION]: Extensive documentation of data egress pathways to external systems such as HDFS, HBase, Redis, and Elasticsearch is provided in references/ecosystem-integration.md. While these are core features for stream processing, they establish numerous channels for data movement to external storage sinks.\n- [EXTERNAL_DOWNLOADS]: The skill's configuration examples in references/foundations.md and references/kafka-integration.md reference official Apache Storm libraries and connectors from standard Maven repositories. These are documented as necessary dependencies for building Storm topologies.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Apr 20, 2026, 11:27 AM
Security Audit — agent-trust-hub — apache-storm-expert