phoenix-cli
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes
@arizeai/phoenix-clivianpxor global installation. This is the official command-line interface for the Phoenix platform provided by the vendor. - [COMMAND_EXECUTION]: The skill provides an extensive set of commands to manage LLM observability data, including listing and fetching traces, spans, sessions, and datasets. It includes safeguard mechanisms for destructive actions, requiring an environment variable
PHOENIX_CLI_DANGEROUSLY_ENABLE_DELETESand user confirmation for deletions. - [REMOTE_CODE_EXECUTION]: Includes a
px self updatecommand that allows the CLI to download and install its own updates from the vendor's repository. - [DYNAMIC_EXECUTION]: The
px setup --instrumentcommand facilitates automatic code instrumentation by delegating tasks to external coding agents (such as Claude, Cursor, or VS Code). This capability is designed for the primary purpose of integrating observability into applications. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The skill fetches untrusted data from the Phoenix backend, including LLM inputs, outputs, and user-generated annotations (SKILL.md).
- Boundary markers: The instructions do not specify explicit delimiters for separating retrieved trace data from agent instructions.
- Capability inventory: The skill has the ability to write configuration files (
.env.phoenix), perform network requests to a GraphQL API, and invoke other coding agents to modify source code (SKILL.md). - Sanitization: There are no mentioned sanitization routines for the data retrieved from the backend before it is processed by the agent.
Audit Metadata