oodle-metrics-query
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the Oodle CLI using Homebrew from the vendor's official repository (
oodle-ai/oodle/oodle). This is a legitimate dependency for the skill's functionality. - [COMMAND_EXECUTION]: The skill uses the
oodleCLI to perform metrics discovery and querying. It executes commands such asoodle metrics query,oodle metrics names, andoodle metrics labelsto interact with the metrics API. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from an external metrics API, creating a surface for indirect prompt injection.
- Ingestion points: Untrusted data enters the agent's context through the output of PromQL queries executed via
oodle metrics queryandoodle metrics query-range(SKILL.md). - Boundary markers: The skill does not define specific boundary markers or delimiters to isolate metrics data from potential instructions.
- Capability inventory: The skill has the capability to execute shell commands using the
oodleCLI across various operations (SKILL.md). - Sanitization: There is no evidence of sanitization or validation performed on the API responses before they are interpreted by the agent.
Audit Metadata