create-metric
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill analyzes application source code to suggest candidate metrics, which is an ingestion point for potentially untrusted data.
- Ingestion points: Application source code (referenced in Phase 2).
- Boundary markers: The instructions include a dedicated confirmation phase (Phase 9) and multiple stop conditions (defined in references/stop-conditions.md) to handle ambiguity.
- Capability inventory: Access to tools for creating, listing, and deleting metrics (harness_create, harness_delete, harness_list).
- Sanitization: The skill requires resolving all identifiers (traffic types, events) against real platform data and explicitly confirms the final payload with the user before execution.
- [COMMAND_EXECUTION]: The skill interacts with the Harness platform using official MCP and CLI tools. It includes safety checks, such as verifying metric usage before deletion and validating naming patterns, to prevent operational errors.
Audit Metadata