add-analytics-instrumentation
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes content from external sources, including pull requests, branches, and specific file paths. This untrusted data could contain embedded instructions designed to manipulate the agent's output or logic during the instrumentation planning process. * Ingestion points: Processes pull request diffs, branch contents, and file source code in SKILL.md Steps 1, 1a, and 1b. * Boundary markers: No explicit delimiters or instructions to ignore embedded commands are specified for the processed data. * Capability inventory: Performs file system reads, git operations, and calls downstream skills (diff-intake, discover-event-surfaces, instrument-events). * Sanitization: The instructions do not define sanitization or validation logic for the content retrieved from codebases.
- [COMMAND_EXECUTION]: The skill executes shell commands using user-provided strings for searching commit history and codebases. This pattern can be vulnerable to command injection if the input is not strictly validated or escaped. * Evidence: Step 1b uses git log --all --grep="" where are derived directly from the user's natural-language feature description.
Audit Metadata