airflow-plugins
The skill exposes critical vulnerabilities by promoting insecure authentication patterns, direct database access, credential leakage via environment variables, and unauthorized network access without defined security constraints.
Skill Info
Install
npx skills add https://github.com/astronomer/agentsAssessments (3)
AI Agent Traps ↗The instructions explicitly state that FastAPI plugin endpoints are not automatically protected by Airflow auth, shifting the burden of security to the user without providing secure-by-default templates. [severity raised to high: this vector is independently flagged by both deterministic and LLM analysis (ADR-0065 corroboration).]
FastAPI plugin endpoints are not automatically protected by Airflow auth. If your endpoints need to be private, implement authentication explicitly using FastAPI's security utilities.
The skill provides code patterns for direct database access to Airflow's internal metadb, which can lead to scheduler corruption or state inconsistency if misused. [severity raised to high: this vector is independently flagged by both deterministic and LLM analysis (ADR-0065 corroboration).]
The Airflow metadb is not a public interface. Direct writes or poorly-formed queries can corrupt scheduler state.
The `fastapi_root_middlewares` pattern allows plugins to intercept all Airflow API requests, creating a potential vector for global request logging, modification, or credential interception. [severity raised to high: this vector is independently flagged by both deterministic and LLM analysis (ADR-0065 corroboration).]
Middleware applies to all Airflow API requests, including the built-in REST API and any FastAPI plugins.
The skill instructs users to store Airflow credentials in environment variables (`MYPLUGIN_USERNAME`, `MYPLUGIN_PASSWORD`), which are often logged or exposed in process dumps. [severity raised to high: this vector is independently flagged by both deterministic and LLM analysis (ADR-0065 corroboration).]
AIRFLOW_USER = os.environ.get("MYPLUGIN_USERNAME", "admin")Environment secret flows to a network sink (exfiltration)
taint source (line 11): os.environ.get("MYPLUGIN_TOKEN") → sink: requests.post(
f"{AIRFLOW_HOST}/auth/token",
json={"username": AIRFLOW_USER, "password": AIRFLOW_PASS},
timeout=10,
)Skill does not specify a license field. Specifying a license helps users understand usage terms.
Version History (2)
Badge
[](https://mondoo.com/ai-agent-security/skills/github/astronomer/agents/airflow-plugins)<a href="https://mondoo.com/ai-agent-security/skills/github/astronomer/agents/airflow-plugins"><img src="https://mondoo.com/ai-agent-security/api/badge/github/astronomer/agents/airflow-plugins.svg" alt="Mondoo Skill Check" /></a>https://mondoo.com/ai-agent-security/api/badge/github/astronomer/agents/airflow-plugins.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet, discover and control Shadow AI usage.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow