glean-incident-runbook
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill follows security best practices for diagnostic runbooks and incident response.
- [DATA_EXPOSURE]: Authentication is handled correctly via the
$GLEAN_API_TOKENenvironment variable, preventing hardcoded credentials in the instructions. - [INDIRECT_PROMPT_INJECTION]: The skill interacts with external API data, creating a potential ingestion surface for indirect instructions. This is handled safely by filtering specific fields.
- Ingestion points: JSON responses from Glean API endpoints (SKILL.md).
- Boundary markers: Absent.
- Capability inventory: Shell execution via Bash, network requests via curl (SKILL.md).
- Sanitization: Present; uses
jqto extract specific status and statistics fields from the JSON payload rather than interpreting the raw response as text. - [EXTERNAL_DOWNLOADS]: The skill communicates with Glean's official API domains for diagnostics, which is consistent with its stated purpose.
Audit Metadata