15Low
The skill performs unauthorized network access and executes commands without declaring required tools, creating an opaque execution environment capable of silent data exfiltration and external dependency fetching.
HygienePackaging & Manifest5 findings
Skill Info
Nameastronomer/agents/migrating-airflow-2-to-3
Registrygithub
Versiond33a14ddd4cd
PURLpkg:github/astronomer/agents@d33a14ddd4cd?skill=migrating-airflow-2-to-3
Stars393
Installs872
Source
Install
GitHub
872 installs
Skills.shDocs
npx skills add https://github.com/astronomer/agentsAssessments (3)
AI Agent Traps ↗Referenced file missing from skill packagelowpolicy violation
SKILL.md links to "reference/config-changes.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
90% confidence
[reference/config-changes.md](reference/config-changes.md)
Referenced file missing from skill packagelowpolicy violation
SKILL.md links to "reference/migration-checklist.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
90% confidence
[reference/migration-checklist.md](reference/migration-checklist.md)
Referenced file missing from skill packagelowpolicy violation
SKILL.md links to "reference/migration-patterns.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
90% confidence
[reference/migration-patterns.md](reference/migration-patterns.md)
Referenced file missing from skill packagelowpolicy violation
SKILL.md links to "reference/removed-methods.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
90% confidence
[reference/removed-methods.md](reference/removed-methods.md)
Missing licenseinfopolicy violation
Skill does not specify a license field. Specifying a license helps users understand usage terms.
100% confidence
Outbound network request primitive in skill code — can transmit data externallylowdata exfiltrationAML.T0025AML.T0024LLM02:2025
Outbound network request primitive in skill code — can transmit data externally
95% confidenceline 10
requests.get(
f"{_HOST}/api/v2/dags",
headers={"Accept": "application/json", "Authorization": f"Bearer {_TOKEN}"},
params={"limit": 10}
)Version History (2)
Badge
Markdown
[](https://mondoo.com/ai-agent-security/skills/github/astronomer/agents/migrating-airflow-2-to-3)HTML
<a href="https://mondoo.com/ai-agent-security/skills/github/astronomer/agents/migrating-airflow-2-to-3"><img src="https://mondoo.com/ai-agent-security/api/badge/github/astronomer/agents/migrating-airflow-2-to-3.svg" alt="Mondoo Skill Check" /></a>Image URL
https://mondoo.com/ai-agent-security/api/badge/github/astronomer/agents/migrating-airflow-2-to-3.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow