triage-flaky-test
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands via Bash to interact with the local
gitenvironment and thepupCLI tool for API interactions. - [PROMPT_INJECTION]: The skill processes untrusted data from external sources, which creates an indirect prompt injection surface.
- Ingestion points: Retrieves repository identifiers from
git remote get-urland test metadata, error messages, and stack traces from Datadog event logs. - Boundary markers: External data is processed and interpolated into analysis workflows without explicit boundary markers or instructions to ignore embedded instructions.
- Capability inventory: The agent can execute shell commands through the
pupCLI and perform write-access API calls to modify test states in the Datadog platform. - Sanitization: There is no explicit logic to sanitize or escape test names or error strings before they are used in command construction or prompted analysis.
- [EXTERNAL_DOWNLOADS]: The instructions guide the user to install the
pupCLI from the developer's official repository usingbrew install datadog-labs/pack/pup.
Audit Metadata