k8s-hpa-cost-tuning
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill uses environment variables (DD_API_KEY, DD_APP_KEY) for Datadog authentication, which is a standard and secure practice for managing API credentials.
- [SAFE]: Network operations in scripts/audit-metrics.mjs and scripts/incident-metrics.mjs are directed to Datadog's official API endpoints (api.datadoghq.com). As Datadog is a well-known service, these communications are considered safe within the scope of the skill's purpose.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data from Datadog APIs to generate tuning recommendations, creating a surface for indirect prompt injection.
- Ingestion points: API response data fetched in scripts/audit-metrics.mjs and scripts/incident-metrics.mjs.
- Boundary markers: None; the agent processes the script's console output directly.
- Capability inventory: The skill uses kubectl for cluster management and fs.writeFile for local report generation.
- Sanitization: None; the scripts perform numerical analysis on the metric data before outputting results.
Audit Metadata