setup-prometheus-monitoring

Warn

Audited by Gen Agent Trust Hub on Feb 27, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads the Prometheus binary package from a well-known repository on GitHub. Evidence: Step 1 uses wget to download the Linux AMD64 release from github.com/prometheus/prometheus.
  • [COMMAND_EXECUTION]: The skill performs administrative actions using elevated privileges to install software and configure system directories. Evidence: Use of sudo cp to move binaries to /usr/local/bin/ and sudo for directory creation in /etc/prometheus.
  • [COMMAND_EXECUTION]: The skill configures persistence to ensure monitoring remains active across system reboots. Evidence: Creation of a systemd unit file at /etc/systemd/system/prometheus.service followed by sudo systemctl enable prometheus.
  • [PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection via external configuration files. Ingestion points: The skill writes to and manages /etc/prometheus/file_sd/services.json. Boundary markers: None present. Capability inventory: All allowed tools including Bash, Write, Edit, Grep, Glob, and Read across all procedure steps. Sanitization: No input validation or content sanitization is performed on the data written to configuration files.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Feb 27, 2026, 10:52 PM