cx-metrics-query
Pass
Audited by Gen Agent Trust Hub on May 4, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
cxCLI tool to search for metrics and execute PromQL queries. These commands are necessary for the skill's intended functionality and are used with standard arguments like--nameand--time. \n- [PROMPT_INJECTION]: The skill processes untrusted data from metrics metadata and query results, representing an indirect prompt injection surface. \n - Ingestion points: Results from
cx metrics search,cx metrics get-labels, andcx metrics query. \n - Boundary markers: No specific delimiters are used to wrap data from the CLI output. \n
- Capability inventory: The agent has access to shell command execution through the
cxCLI. \n - Sanitization: There are no explicit instructions to sanitize or validate strings returned from the metrics backend before processing them.
Audit Metadata