skills/grafana/gcx/gcx-demo/Gen Agent Trust Hub

gcx-demo

Pass

Audited by Gen Agent Trust Hub on Oct 27, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the Bash tool to execute gcx CLI commands such as gcx config, gcx providers, gcx resources, and gcx query. These are used to retrieve information from a Grafana Cloud stack for demonstration purposes.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources (Grafana Cloud logs, traces, and resource names) which could potentially contain malicious content intended to influence the agent's behavior.
  • Ingestion points: Data enters the context via the output of gcx logs query, gcx traces query, and gcx resources get commands.
  • Boundary markers: The skill does not explicitly define delimiters or instructions to ignore embedded content in the retrieved data.
  • Capability inventory: The skill uses the Bash tool to execute system commands and AskUserQuestion to interact with the user.
  • Sanitization: There is no explicit sanitization of the retrieved data mentioned in the skill instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 27, 2026, 07:03 PM