k6-cloud-investigate-test
Pass
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
gcxCLI to interact with Grafana Cloud services. It also employs localpythonandsedcommands for data processing and script modification, which are used within the scope of the skill's investigation and maintenance tasks. - [DATA_EXFILTRATION]: The workflow involves fetching test logs, metrics, and scripts from Grafana Cloud APIs. The data is processed locally within the agent's environment or saved to temporary files for analysis, with no unauthorized external data transfer identified.
- [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface as it ingests and summarizes test logs and script content which could contain adversarial instructions.
- Ingestion points: API responses from
gcx apicalls fetching logs (Step 7), metrics (Step 5, 6), and script snapshots (Step 2). - Boundary markers: The skill relies on a structured 9-step investigation workflow and reporting templates to manage the analysis of external data.
- Capability inventory: File system access for logging and backups, and script update capabilities via the
gcxtool. - Sanitization: No explicit sanitization or filtering of log content is detailed in the instructions.
- [SAFE]: The skill includes security best practices for script modification, such as requiring a backup before editing, performing local validation with
k6 inspect, and running single-iteration smoke tests before updating the live script.
Audit Metadata