skills/grafana/gcx/add-provider/Gen Agent Trust Hub

add-provider

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted external data during its research phase.
  • Ingestion points: OpenAPI specs, vendor source code, and live responses from bin/gcx api probes (Stage 1b).
  • Boundary markers: The instructions do not specify any delimiters or ignore-instructions for the external content processed during discovery.
  • Capability inventory: The skill enables the agent to write Go files, documentation, and execute shell commands via mise and bin/gcx (Stage 3 and 4).
  • Sanitization: No automated sanitization is described for data returned from external API endpoints.
  • [COMMAND_EXECUTION]: The skill orchestrates several local shell commands to manage the development lifecycle.
  • Evidence: Use of mise run gate, mise run all, and various bin/gcx commands for API probing and verification.
  • Mitigation: The skill enforces safety checks, such as requiring user verification for destructive commands and using providers.ConfigLoader to manage secrets safely.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 09:04 AM
Security Audit — agent-trust-hub — add-provider