setup-prometheus-monitoring
Warn
Audited by Gen Agent Trust Hub on Feb 27, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the Prometheus binary package from a well-known repository on GitHub. Evidence: Step 1 uses
wgetto download the Linux AMD64 release fromgithub.com/prometheus/prometheus. - [COMMAND_EXECUTION]: The skill performs administrative actions using elevated privileges to install software and configure system directories. Evidence: Use of
sudo cpto move binaries to/usr/local/bin/andsudofor directory creation in/etc/prometheus. - [COMMAND_EXECUTION]: The skill configures persistence to ensure monitoring remains active across system reboots. Evidence: Creation of a systemd unit file at
/etc/systemd/system/prometheus.servicefollowed bysudo systemctl enable prometheus. - [PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection via external configuration files. Ingestion points: The skill writes to and manages
/etc/prometheus/file_sd/services.json. Boundary markers: None present. Capability inventory: All allowed tools includingBash,Write,Edit,Grep,Glob, andReadacross all procedure steps. Sanitization: No input validation or content sanitization is performed on the data written to configuration files.
Audit Metadata