create-dashboard
Pass
Audited by Gen Agent Trust Hub on Apr 30, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill has an indirect prompt injection surface as it processes untrusted data from repository files to build dashboards.
- Ingestion points: Reads SKILL.md, source code files, and deployment configurations (meta.yaml, values.yaml) in Phase 1 to discover telemetry.
- Boundary markers: The instructions do not include specific delimiters or warnings to ignore malicious instructions that might be embedded in these files.
- Capability inventory: The skill performs extensive shell command execution through the 'cx' CLI and has file-write capabilities in the '/tmp/' directory.
- Sanitization: Content extracted from local files is used without explicit validation or escaping before being incorporated into plans and queries.
- [COMMAND_EXECUTION]: The skill relies on the 'cx' CLI to perform its primary functions, including telemetry discovery and dashboard deployment. This is documented and intended behavior for the Coralogix ecosystem.
Audit Metadata