oodle-metrics
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use the
oodleCLI to list metrics, enumerate labels, and query label values to build PromQL expressions. - [EXTERNAL_DOWNLOADS]: Prerequisites include installing the vendor's CLI tool using
brew install oodle-ai/oodle/oodle. This is the official installation method for the oodle-ai metrics platform. - [INDIRECT_PROMPT_INJECTION]: The skill's workflow involves reading metric names and label values from an external API, which presents a potential surface for indirect instructions if the source data is attacker-controlled.
- Ingestion points: Metric metadata is ingested through
oodle metrics list,labels, andlabel-valuescommands inSKILL.md. - Boundary markers: The instructions do not define specific delimiters or warnings to separate metric metadata from the agent's internal reasoning.
- Capability inventory: The skill allows shell command execution (
oodleCLI) and the construction of PromQL queries based on the ingested metadata. - Sanitization: While the skill suggests using
jqfor robust JSON parsing, it does not provide specific guidance on sanitizing the ingested label values before they are interpolated into the prompt for query generation.
Audit Metadata