add-provider
Pass
Audited by Gen Agent Trust Hub on Apr 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to perform various command-line operations, including
make allfor building the provider andgcxcommands for configuration management and smoke testing. These are standard procedures for a command-line utility development workflow. - [EXTERNAL_DOWNLOADS]: The skill utilizes
curlto interact with Grafana API endpoints for discovery and validation. It also involves researching external API documentation and source code repositories, which is expected for the task of creating service integrations. - [PROMPT_INJECTION]: The skill identifies a surface for indirect prompt injection by processing external documentation and API responses. 1. Ingestion points: User-provided API documentation URLs, source code repositories, and product descriptions enter the context during the discovery phase. 2. Boundary markers: None are specified in the instructions for separating external data from agent instructions. 3. Capability inventory: The skill can write to the local file system (docs, internal, and cmd directories) and execute shell commands (
make,gcx,curl). 4. Sanitization: No explicit sanitization or validation of external content is mentioned. - [SAFE]: The skill is authored by a recognizable entity (grafana) and its operations are strictly aligned with its stated purpose of provider orchestration. The use of human approval gates significantly mitigates the risk of autonomous malicious actions.
Audit Metadata