greptimedb-quickstart
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides a command to download and execute an installation script directly from the vendor's repository using the
curl | shpattern. - [EXTERNAL_DOWNLOADS]: The skill fetches several external resources from the vendor's infrastructure:
- The official installation script from
raw.githubusercontent.com/greptimeteam/greptimedb/. - Sister skills (SKILL.md files) from
docs.greptime.com/skills/. - A Python package
greptimedb-mcp-serverrecommended for installation via pip. - A documentation repository via
npx skills addtargetinggithub.com/GreptimeTeam/docs/. - [COMMAND_EXECUTION]: The skill includes shell commands for database deployment and operations:
- Containerized deployment using
docker run. - Shell script execution for initial installation.
- Local binary execution of the
greptimedatabase service. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of untrusted external data (logs, traces, and metrics), creating an attack surface for indirect prompt injection.
- Ingestion points: Ingestion protocols including OTLP, Prometheus, Loki, and Elasticsearch ingest APIs (SKILL.md).
- Boundary markers: None explicitly defined in this entry-point skill for the processed data.
- Capability inventory: Shell command execution (Docker, curl, shell), local file system access (via volume mounts and data-home configuration), and network operations (SKILL.md).
- Sanitization: Relies on internal database parsing and the specialized
greptimedb-pipelinesister skill for data transformation.
Audit Metadata