ddtoolsets

Pass

Audited by Gen Agent Trust Hub on May 15, 2026

Risk Level: SAFE
Full Analysis
  • [PROMPT_INJECTION]: The skill contains instructions to suppress implementation details, such as file paths and variable names, from the user output. While these instructions involve concealment (e.g., "Never reveal... File paths", "Silently determine"), they are used to ensure a clean user interface and prevent the exposure of internal system configuration to the chat logs, rather than to hide malicious activity.
  • [DATA_EXFILTRATION]: The skill accesses official Datadog domains (e.g., mcp.datadoghq.com, mcp.datadoghq.eu) and a local .mcp.json file. These operations are within the scope of the skill's purpose as a Datadog configuration manager. No unauthorized data transmission to non-vendor domains was detected.
  • [COMMAND_EXECUTION]: The agent is instructed to modify the ${DD_MCP_TOOLSETS:-} and ${DD_MCP_DOMAIN:-} placeholders in the .mcp.json file. These edits follow strict validation rules, such as falling back to defaults if the input matches server defaults, which reduces the risk of misconfiguration or malicious injection into the config file.
Audit Metadata
Risk Level
SAFE
Analyzed
May 15, 2026, 08:54 PM
Security Audit — agent-trust-hub — ddtoolsets