airflow-plugins

Environment secret flows to a network sink (exfiltration)

taint source (line 8): os.environ.get("MYPLUGIN_HOST",     "http://localhost:8080") → sink: requests.post(
        f"{AIRFLOW_HOST}/auth/token",
        json={"username": AIRFLOW_USER, "password": AIRFLOW_PASS},
        timeout=10,
    )

Outbound network request primitive in skill code — can transmit data externally

requests.get(f"https://files.example.com/{filename}", stream=True)

Outbound network request primitive in skill code — can transmit data externally (seen 2 times in this file at lines 1, 2)

fetch('api/dags')

Skill executes commands, writes files, or accesses the network but declares no allowed-tools, so its tool surface cannot be reviewed or constrained.