Grafana Dashboard JSON Migrator
Pass
Audited by Gen Agent Trust Hub on Mar 29, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill metadata (YAML frontmatter) contains the field 'verification: security_reviewed'. This is a self-authoritative safety claim that is disregarded during analysis.
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it ingests and transforms external dashboard configurations.
- Ingestion points: Dashboard JSON models, alert rule references, and folder structures (SKILL.md).
- Boundary markers: There are no specified delimiters or instructions to ignore potential commands embedded within the JSON data.
- Capability inventory: The skill utilizes the Grafana HTTP API to perform read and write operations across environments (SKILL.md).
- Sanitization: No sanitization or validation logic is described for the incoming JSON content.
- [EXTERNAL_DOWNLOADS]: The skill instructions specify installation via 'npx' from the vendor's repository ('agentskillexchange/skills'). These are identified as official vendor resources.
Audit Metadata