dd-audit-compliance-report
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
pupcommand-line utility andjqto query and process audit logs. This is standard behavior for the tool's intended use case as a Datadog reporting assistant and originates from a trusted vendor. - [INDIRECT_PROMPT_INJECTION]: The skill processes audit log data that could potentially contain untrusted strings. While this is a theoretical attack surface, the risk is minimized by structural extraction of specific JSON keys.
- Ingestion points: Audit log data enters via the output of
pup audit-logs searchas seen inSKILL.md. - Boundary markers: The report template in
SKILL.mddoes not use explicit delimiters to isolate external log data from the agent's instructions. - Capability inventory: The skill uses subprocesses to execute
pupandjqfor data retrieval and manipulation. - Sanitization: Content is filtered through
jqto select specific attributes, providing structural control over the ingested data.
Audit Metadata