grafana-report-to-dashboard
Pass
Audited by Gen Agent Trust Hub on Mar 19, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill ingests untrusted Python report scripts as input to generate Jsonnet code, creating an attack surface for indirect prompt injection. \n
- Ingestion points: Python source code provided by the user for migration (referenced in SKILL.md and references/examples.md). \n
- Boundary markers: Absent; there are no instructions to ignore or delimit natural language instructions that might be embedded within the provided Python scripts. \n
- Capability inventory: The skill generates dashboard definitions and references local build scripts (mixin/build.sh) for compilation. \n
- Sanitization: Absent; the skill does not specify procedures for validating or escaping content extracted from input scripts. \n- [EXTERNAL_DOWNLOADS]: The generated Jsonnet code references the grafonnet library from Grafana's official GitHub repository. This targets a well-known service and represents a standard dependency for Grafana dashboard development. \n- [COMMAND_EXECUTION]: Instructions within the skill mention running local build scripts, mixin/build.sh or mixin/build.ps1, to compile the generated Jsonnet into JSON dashboards.
Audit Metadata