dt-app-dashboards
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes dashboard JSON content fetched from a remote server, which serves as an entry point for potentially untrusted data.\n
- Ingestion points: The skill uses
dtctl get dashboardto retrieve JSON data from the Dynatrace environment as documented in SKILL.md and references/analyzing.md.\n - Boundary markers: The instructions do not explicitly require the use of delimiters or "ignore embedded instructions" prompts when the agent processes data extracted from dashboard tiles and variables.\n
- Capability inventory: The skill utilizes
dtctl queryfor DQL validation anddtctl applyfor deployment, which are capabilities that could be influenced if the agent processes malicious instructions embedded in dashboard data.\n - Sanitization: The skill notes that
dtctl applyperforms automatic validation before deployment, providing a layer of protection against malformed or malicious configuration changes.\n- [COMMAND_EXECUTION]: The skill relies on thedtctlcommand-line tool for interacting with the Dynatrace platform. This includes commands for querying data, fetching dashboard JSON, and applying updates. The skill correctly advises using single quotes for DQL strings to prevent shell-level command injection.
Audit Metadata