datasources-provisioning

Pass

Audited by Gen Agent Trust Hub on Aug 4, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches plugin metadata and configuration schemas from official Grafana domains. These downloads are used to determine the correct structure for provisioning files.
  • https://grafana.com/api/plugins (Used for plugin discovery and version resolution)
  • https://plugins-cdn.grafana.net/ (Used to fetch dsconfig.json and v0alpha1.json settings schemas)
  • https://raw.githubusercontent.com/grafana/dsconfig/ (Used to reference the provisioning schema specification)
  • [COMMAND_EXECUTION]: The workflow involves executing standard system utilities like curl and jq to interact with Grafana's APIs. These commands are used for data retrieval and processing to build the final configuration files.
  • [DATA_EXFILTRATION]: The skill integrates with the Grafana MCP server (grafana/mcp-grafana) to convert existing data sources into code. It explicitly ensures that secrets are never retrieved or exposed, instead using ${ENV_VAR} placeholders for any sensitive fields identified.
  • [PROMPT_INJECTION]: The skill processes external data (plugin descriptions and configuration examples from the CDN). While this represents a potential surface for indirect prompt injection if the source data were compromised, the risk is minimal as the agent is instructed to use this data specifically for generating structured configuration files.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 4, 2026, 08:26 PM
Security Audit — agent-trust-hub — datasources-provisioning