gcx-observability
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns or security risks were identified. The skill's behavior is entirely consistent with its purpose as a cloud observability setup tool authored by the official vendor.
- [COMMAND_EXECUTION]: The skill executes administrative commands via the
gcxandkubectlCLI tools. These operations are necessary for configuring Grafana Cloud and managing Kubernetes resources. The skill discovers available commands dynamically using help flags to ensure correct syntax. - [DYNAMIC_EXECUTION]: The skill generates k6 load test scripts in JavaScript and schedule configurations in YAML to automate performance testing. These generated files are executed locally by the k6 binary as part of the observability rollout.
- [INDIRECT_PROMPT_INJECTION]: The skill reads local project files, such as Dockerfiles, to identify potential compatibility issues with observability agents (e.g., musl-based runtimes or stripped binaries). This ingestion is used to provide diagnostic warnings to the user and does not influence the agent's core safety logic.
Audit Metadata