gcx-demo
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the Bash tool to execute
gcxCLI commands such asgcx config,gcx providers,gcx resources, andgcx query. These are used to retrieve information from a Grafana Cloud stack for demonstration purposes. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources (Grafana Cloud logs, traces, and resource names) which could potentially contain malicious content intended to influence the agent's behavior.
- Ingestion points: Data enters the context via the output of
gcx logs query,gcx traces query, andgcx resources getcommands. - Boundary markers: The skill does not explicitly define delimiters or instructions to ignore embedded content in the retrieved data.
- Capability inventory: The skill uses the
Bashtool to execute system commands andAskUserQuestionto interact with the user. - Sanitization: There is no explicit sanitization of the retrieved data mentioned in the skill instructions.
Audit Metadata