skills/grafana/gcx/add-provider/Gen Agent Trust Hub

add-provider

Pass

Audited by Gen Agent Trust Hub on Apr 7, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to perform various command-line operations, including make all for building the provider and gcx commands for configuration management and smoke testing. These are standard procedures for a command-line utility development workflow.
  • [EXTERNAL_DOWNLOADS]: The skill utilizes curl to interact with Grafana API endpoints for discovery and validation. It also involves researching external API documentation and source code repositories, which is expected for the task of creating service integrations.
  • [PROMPT_INJECTION]: The skill identifies a surface for indirect prompt injection by processing external documentation and API responses. 1. Ingestion points: User-provided API documentation URLs, source code repositories, and product descriptions enter the context during the discovery phase. 2. Boundary markers: None are specified in the instructions for separating external data from agent instructions. 3. Capability inventory: The skill can write to the local file system (docs, internal, and cmd directories) and execute shell commands (make, gcx, curl). 4. Sanitization: No explicit sanitization or validation of external content is mentioned.
  • [SAFE]: The skill is authored by a recognizable entity (grafana) and its operations are strictly aligned with its stated purpose of provider orchestration. The use of human approval gates significantly mitigates the risk of autonomous malicious actions.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 7, 2026, 12:35 PM