grafana
Pass
Audited by Gen Agent Trust Hub on Aug 5, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data such as Grafana dashboard JSON models and server logs, which constitutes a potential indirect prompt injection surface. This is addressed through extensive defensive instructions.
- Ingestion points: The skill ingests dashboard JSON models, alert rules, and server logs for diagnosis and engineering as detailed in
references/dashboard-engineering.mdandreferences/troubleshooting.md. - Boundary markers: The skill relies on instructional boundaries, requiring agents to treat resources as separately authorized and to verify resource provenance before acting, rather than using technical delimiters.
- Capability inventory: Operational tools are restricted to standard management utilities including the
grafanaCLI andcurlfor API health and discovery. - Sanitization: Instructions mandate the redaction of sensitive values (tokens, passwords,
secureJsonData) and require manual verification of query correctness against live data sources to mitigate exploitation risks.
Audit Metadata