senior-data-engineer

• Outcome: Review
• Latest audit: May 29, 2026 at 9:33 PM UTC
• Version:
  0.1.0

Overview

This data-engineering skill is not clearly malicious, but it needs review because some production-style monitoring and security templates are under-scoped or misleading.

Install only if you will review generated pipeline, Kafka, Snowflake, S3, Docker, and Terraform-style artifacts before use. Do not paste real passwords, tokens, full production connection strings, or sensitive datasets into prompts or templates; use secret managers, environment variables, redacted examples, and least-privilege test credentials. Treat the streaming quality validator as a simulator/reference until real integrations are verified.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: This tool presents itself as a real-time streaming quality validator for Kafka, Kinesis, and schema registry systems, but the core implementation uses simulator classes that generate synthetic metrics instead of querying real infrastructure. In an engineering or operations context, this can mislead users into making production decisions based on fabricated health data, creating substantial integrity and availability risk even though it is not direct code execution.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The documentation advertises production-style monitoring features such as consumer lag, freshness, schema drift, and DLQ health checks, but the implementation intentionally simulates these metrics. In the context of a 'senior-data-engineer' skill, that mismatch is especially dangerous because users are likely to trust the outputs for operational monitoring, incident response, or readiness checks.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The templates include concrete examples of accessing secrets from orchestration variables, embedding placeholder cloud credentials in SQL stage creation, and transmitting data to external systems such as S3, Snowflake, Kafka, and Kinesis without nearby warnings about secure secret handling. In a reusable skill/template file, this can normalize unsafe copy-paste patterns and lead users to hardcode credentials or move sensitive data off-platform without proper review.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The security-mode ACL generator creates templates that grant READ and WRITE on all topics and READ on all consumer groups using wildcard resource names. In a tool explicitly intended to generate production Kafka security configuration, this can normalize overbroad access and lead operators to deploy least-privilege violations directly into real environments, increasing blast radius for credential misuse or compromised clients.

VirusTotal

67/67 vendors flagged this skill as clean.