airflow-to-zenml-migration
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted Airflow DAG code provided by users to perform translations. While it does not execute this code directly, malicious instructions could be embedded in comments or strings within the input files to influence the migration output. The skill mitigates this by generating a MIGRATION_REPORT.md that highlights all changes and requires human review for 'Approximate' or 'Absent' mappings.
- [COMMAND_EXECUTION]: The generated code for the BashOperator equivalent utilizes subprocess.run(). This is a necessary functional mapping for shell-based tasks. The skill provides explicit migration notes within the generated code to warn users that the execution environment (containers) may differ from their original Airflow workers.
- [EXTERNAL_DOWNLOADS]: The skill recommends the installation of the ZenML documentation MCP server (docs.zenml.io). This is a legitimate resource provided by the vendor (zenml-io) to assist users with real-time documentation lookups.
Audit Metadata