bash_command="./export.sh --region {{ dag_run.conf['region'] }}" lets anyone who can trigger the DAG with a config run their own commands on your workers, because Airflow does not escape the rendered command. expose_config = True shows your fernet_key and database password on the Configuration page. This skill finds those and ten other Airflow mistakes before you deploy, and tells you how to fix each one.

Your agent runs a scanner on your Airflow project: DAG files and plugins (every .py file that imports airflow), webserver_config.py, and airflow.cfg. It parses Python with the standard ast module, so comments and strings are not mistaken for code, and reads airflow.cfg section by section the way Airflow does. It knows Airflow 2.x and 3.x (airflow.sdk), DAG(...) and @dag, default_args, Param limits, Jinja templates and the safe env= pattern from the Airflow docs, and it reads the project's own defaults for retries, timeouts and catchup from airflow.cfg. It never imports or runs your DAGs. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Secrets are never printed.

What it checks

BLOCK (fix before shipping)

• A01: passwords, tokens and keys written in DAG code (password=, env= values, extra= JSON, connection URIs with a password, known token formats) or inside commands (PGPASSWORD=..., export API_TOKEN=..., --password=..., curl -u user:password, URLs with a password)

• A02: dag_run.conf templated into bash_command, @task.bash, SSH, Docker and Kubernetes pod commands or SQL text

• A03: expose_config = True (in [webserver] for 2.x and [api] for 3.x), an API backend that lets every request in, AUTH_ROLE_PUBLIC and Airflow 3 all-admins mode

• A04: fernet_key, secret_key, jwt_secret, passwords and database URLs with a password written in airflow.cfg

REVIEW (check before release)

• A11: start_date computed at parse time (datetime.now(), days_ago())

• A12: schedule_interval, timetable and days_ago, which Airflow 3 removed

• A13: scheduled Airflow 2 DAGs that leave catchup to the default (True in 2.x)

• A14: scheduled DAGs with no execution_timeout or dagrun_timeout

• A15: scheduled DAGs with no retries

• A16: Variable.get, connection lookups, hook queries, HTTP and database calls at the top level of DAG files

• A17: load_examples = True and test_connection = Enabled

• A18: params templated into commands or SQL without an enum or numeric limit (a trigger config can replace them)

What's included

• The scanner (Python 3.9+, standard library only)

• A rules guide with the reason and safer approach for each rule

• A risky and a safe example project (two DAGs, airflow.cfg and webserver_config.py each), and the real report the scanner produces on the risky one

Limits

It reads each file as written: values that reach a command through several variables or other modules, .sh files loaded by bash_command, AIRFLOW__ environment variables in Docker Compose, Helm or Kubernetes files, and connections and variables stored in the database or a secrets backend are not checked. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 16 files: SKILL.md, the scanner in scripts/ (5 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (8 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.