datasources-provisioning
Pass
Audited by Gen Agent Trust Hub on Aug 4, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches plugin metadata and configuration schemas from official Grafana domains. These downloads are used to determine the correct structure for provisioning files.
https://grafana.com/api/plugins(Used for plugin discovery and version resolution)https://plugins-cdn.grafana.net/(Used to fetchdsconfig.jsonandv0alpha1.jsonsettings schemas)https://raw.githubusercontent.com/grafana/dsconfig/(Used to reference the provisioning schema specification)- [COMMAND_EXECUTION]: The workflow involves executing standard system utilities like
curlandjqto interact with Grafana's APIs. These commands are used for data retrieval and processing to build the final configuration files. - [DATA_EXFILTRATION]: The skill integrates with the Grafana MCP server (
grafana/mcp-grafana) to convert existing data sources into code. It explicitly ensures that secrets are never retrieved or exposed, instead using${ENV_VAR}placeholders for any sensitive fields identified. - [PROMPT_INJECTION]: The skill processes external data (plugin descriptions and configuration examples from the CDN). While this represents a potential surface for indirect prompt injection if the source data were compromised, the risk is minimal as the agent is instructed to use this data specifically for generating structured configuration files.
Audit Metadata