grafana-bake-annotation
Warn
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute Python scripts located at absolute filesystem paths:
/Users/mtm/pdev/taylormonacelli/diminutivedragon/scripts/annotate-grafana.pyand/Users/mtm/pdev/taylormonacelli/diminutivedragon/scripts/clear-annotations.py. This behavior relies on a specific local environment and executes code not contained within the skill itself. - [DATA_EXFILTRATION]: According to the documentation, the scripts fetch a Grafana token from the AWS SSM Parameter Store at the path
/diminutivedragon/grafana_tokenin theus-west-2region. This implies the execution of credentials-accessing code and network transmission of these credentials to Grafana APIs. - [EXTERNAL_DOWNLOADS]: The skill has dependencies on external scripts and configuration located in a non-standard local directory (
~/pdev/taylormonacelli/diminutivedragon) that are not verified or bundled with the skill. - [PROMPT_INJECTION]: The skill processes bake logs which are external, potentially untrusted data sources. It lacks boundary markers or sanitization to prevent indirect prompt injection if the logs contain malicious instructions.
- [INDIRECT_PROMPT_INJECTION_EVIDENCE]: 1. Ingestion points: Zephyr bake log files. 2. Boundary markers: None present. 3. Capability inventory: Command execution via
uv runand file/repository modification viagit commit. 4. Sanitization: None provided.
Audit Metadata