grafana-report-to-dashboard

Pass

Audited by Gen Agent Trust Hub on Mar 19, 2026

Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [PROMPT_INJECTION]: The skill ingests untrusted Python report scripts as input to generate Jsonnet code, creating an attack surface for indirect prompt injection. \n
  • Ingestion points: Python source code provided by the user for migration (referenced in SKILL.md and references/examples.md). \n
  • Boundary markers: Absent; there are no instructions to ignore or delimit natural language instructions that might be embedded within the provided Python scripts. \n
  • Capability inventory: The skill generates dashboard definitions and references local build scripts (mixin/build.sh) for compilation. \n
  • Sanitization: Absent; the skill does not specify procedures for validating or escaping content extracted from input scripts. \n- [EXTERNAL_DOWNLOADS]: The generated Jsonnet code references the grafonnet library from Grafana's official GitHub repository. This targets a well-known service and represents a standard dependency for Grafana dashboard development. \n- [COMMAND_EXECUTION]: Instructions within the skill mention running local build scripts, mixin/build.sh or mixin/build.ps1, to compile the generated Jsonnet into JSON dashboards.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 19, 2026, 05:12 PM
Security Audit — agent-trust-hub — grafana-report-to-dashboard