promql-generator
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests user monitoring requirements to generate PromQL queries, creating a potential surface for indirect prompt injection. This is mitigated by a mandatory interactive planning stage and automated validation.
- Ingestion points: User-supplied monitoring goals, metric names, and parameters captured in Stages 1, 2, and 3 of the SKILL.md workflow.
- Boundary markers: Stage 4 of the workflow requires explicit user confirmation of a plain-English query plan before any code is generated.
- Capability inventory: The skill can generate PromQL code and invoke the devops-skills:promql-validator tool.
- Sanitization: Generated queries are automatically passed to the promql-validator skill to check for syntax errors, semantic logic issues, and anti-patterns before being presented to the user.
Audit Metadata