arthas-eagleeye-traceid
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for executing Arthas CLI commands (
sc,watch,trace) to perform Java application diagnostics. The suggested commands include safe-use flags like-n 5to limit execution count and prevent performance impact on production environments. - [DYNAMIC_EXECUTION]: The skill utilizes OGNL (Object-Graph Navigation Language) expressions, such as
@com.taobao.eagleeye.EagleEye@getTraceId(), to call static methods at runtime. This is the intended functionality of the Arthas tool for inspecting JVM state and does not involve untrusted code loading. - [INDIRECT_PROMPT_INJECTION]: The skill involves a surface for indirect injection as it instructs the agent to interpolate user-provided class and method names into diagnostic commands. However, the use case is standard for developer tooling.
- Ingestion points: User-provided class names and method names in SKILL.md.
- Boundary markers: None present in the command templates.
- Capability inventory: Uses Arthas capabilities which allow for runtime inspection and OGNL expression evaluation within the target JVM.
- Sanitization: No specific sanitization logic is provided in the instructions; the tool relies on the user providing valid Java identifiers.
Audit Metadata