root-cause-analysis
Pass
Audited by Gen Agent Trust Hub on Apr 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes
npx @kopai/clito perform telemetry searches and data retrieval operations. This involves executing a command-line interface tool to interact with the backend observability platform. - [EXTERNAL_DOWNLOADS]: Executes the
@kopai/clipackage vianpx, which involves fetching the tool from a package registry. This tool is a resource belonging to the skill's vendor. - [PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection because it processes logs and traces that can contain data provided by external, untrusted users (e.g., error messages, request paths, or metadata).
- Ingestion points:
npx @kopai/cli logs searchandnpx @kopai/cli traces getoutput data that the agent is instructed to analyze. - Boundary markers: The instructions do not specify the use of delimiters or ignore-instructions for the telemetry data content.
- Capability inventory: The agent has the ability to execute shell commands and write findings.
- Sanitization: There is no explicit sanitization or filtering of the log/trace bodies before they are presented to the agent for analysis.
Audit Metadata