building-dashboards

Pass

Audited by Gen Agent Trust Hub on Oct 8, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses a comprehensive suite of local Bash scripts to manage dashboard operations. These scripts invoke system utilities such as curl for API communication and jq, sed, awk, and date for JSON processing and data normalization.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and translate dashboard specifications from external sources, specifically Grafana (JSON) and Splunk (SPL). These external formats represent an attack surface where malicious instructions could be embedded in data processed by the agent. The skill includes design philosophy and validation steps to mitigate these risks, but the inherent ingestion surface remains.
  • [SAFE]: Credential management follows secure practices by reading the Axiom API token and organization ID from a local configuration file (~/.axiom.toml) rather than requiring hardcoded secrets or environment variables.
  • [SAFE]: All network communications initiated by the skill target the vendor's official domains and regional edge endpoints (e.g., api.axiom.co, *.edge.axiom.co).
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 8, 2026, 02:20 AM