dt-sec-insights
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection attack surface (Category 8).
- Ingestion points: User-supplied entity IDs, names, and filter values are interpolated into DQL queries across multiple files, including
compliance.md,detections.md, andvulnerabilities-dynatrace.md. - Boundary markers: While templates use quotes and standard DQL functions, they lack explicit instructions for the agent to sanitize or escape special characters in user input, which could potentially lead to DQL injection if the agent is not careful.
- Capability inventory: The skill generates complex DQL queries designed for execution via the
dt-dql-essentialstool, providing a powerful interface for data retrieval and analysis. - Sanitization: No explicit sanitization or input validation logic is defined in the instructions to handle adversarial user input intended to break out of the DQL string literals.
Audit Metadata