skills/grafana/gcx/migrate-provider/Gen Agent Trust Hub

migrate-provider

Pass

Audited by Gen Agent Trust Hub on Apr 7, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: No malicious patterns or security risks were identified. The skill's operations are consistent with its stated purpose of assisting in code migration and development within the Grafana ecosystem.\n- [COMMAND_EXECUTION]: The workflow incorporates standard shell commands such as gcx, make, jq, and diff for building, linting, and verifying ported code. These commands are localized to the development environment and are necessary for the skill's functionality.\n- [DATA_EXFILTRATION]: The skill's instructions involve communicating with established Grafana and K6 API endpoints. It includes specific safeguards, such as prohibiting the logging of tokens and secrets, and relies on standard authenticated communication patterns used by the official grafana-cloud-cli tool.\n- [SAFE]: The skill manages potential indirect prompt injection risks associated with processing external source code by implementing a structured development lifecycle. Ingestion points (gcx source code) are handled through defined discovery and design phases. Boundary markers consist of explicit phase gates and mandatory user approvals. The capability inventory is limited to generating provider code and running local build/test tools. Sanitization and validation are enforced through mandatory smoke tests and structured comparison reports in the final verification phase.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 7, 2026, 12:35 PM
Security Audit — agent-trust-hub — migrate-provider