prometheus-cardinality-troubleshooter
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides bash scripts that utilize
curlandjqto query the Prometheus HTTP status and label APIs for diagnostic data. - [EXTERNAL_DOWNLOADS]: Performs authenticated network requests to Grafana Cloud's Mimir API (grafana.net) and local Prometheus services to retrieve system metadata.
- [PROMPT_INJECTION]: Identifies a potential indirect prompt injection surface where label names retrieved from an external API are processed in shell loops.
- Ingestion points: Output from the Prometheus
api/v1/labelsendpoint. - Boundary markers: Absent in the diagnostic shell scripts.
- Capability inventory: Local shell execution for API requests.
- Sanitization: Absent; the scripts iterate over strings provided by the API within shell sub-commands.
Audit Metadata