skills/arize-ai/phoenix/phoenix-cli/Gen Agent Trust Hub

phoenix-cli

Pass

Audited by Gen Agent Trust Hub on Sep 24, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill utilizes @arizeai/phoenix-cli via npx or global installation. This is the official command-line interface for the Phoenix platform provided by the vendor.
  • [COMMAND_EXECUTION]: The skill provides an extensive set of commands to manage LLM observability data, including listing and fetching traces, spans, sessions, and datasets. It includes safeguard mechanisms for destructive actions, requiring an environment variable PHOENIX_CLI_DANGEROUSLY_ENABLE_DELETES and user confirmation for deletions.
  • [REMOTE_CODE_EXECUTION]: Includes a px self update command that allows the CLI to download and install its own updates from the vendor's repository.
  • [DYNAMIC_EXECUTION]: The px setup --instrument command facilitates automatic code instrumentation by delegating tasks to external coding agents (such as Claude, Cursor, or VS Code). This capability is designed for the primary purpose of integrating observability into applications.
  • [INDIRECT_PROMPT_INJECTION]:
  • Ingestion points: The skill fetches untrusted data from the Phoenix backend, including LLM inputs, outputs, and user-generated annotations (SKILL.md).
  • Boundary markers: The instructions do not specify explicit delimiters for separating retrieved trace data from agent instructions.
  • Capability inventory: The skill has the ability to write configuration files (.env.phoenix), perform network requests to a GraphQL API, and invoke other coding agents to modify source code (SKILL.md).
  • Sanitization: There are no mentioned sanitization routines for the data retrieved from the backend before it is processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 24, 2026, 09:35 PM
Security Audit — agent-trust-hub — phoenix-cli