grafana
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using the
npx @useclawlink/clitool to manage Grafana connections and perform actions. - [EXTERNAL_DOWNLOADS]: The skill references the
@useclawlink/clipackage from the NPM registry, which is a resource managed by the skill vendor. - [INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection as it ingests data from external Grafana dashboards and logs.
- Ingestion points: Grafana dashboard query results and Loki log streams as described in
SKILL.md. - Boundary markers: The skill instructions do not specify explicit delimiters for external data.
- Capability inventory: The agent can execute shell commands via
npxto read and write data to Grafana instances. - Sanitization: No specific sanitization or filtering logic is defined within the skill's instructional text.
Audit Metadata