oodle-metrics

Pass

Audited by Gen Agent Trust Hub on Oct 12, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to use the oodle CLI to list metrics, enumerate labels, and query label values to build PromQL expressions.
  • [EXTERNAL_DOWNLOADS]: Prerequisites include installing the vendor's CLI tool using brew install oodle-ai/oodle/oodle. This is the official installation method for the oodle-ai metrics platform.
  • [INDIRECT_PROMPT_INJECTION]: The skill's workflow involves reading metric names and label values from an external API, which presents a potential surface for indirect instructions if the source data is attacker-controlled.
  • Ingestion points: Metric metadata is ingested through oodle metrics list, labels, and label-values commands in SKILL.md.
  • Boundary markers: The instructions do not define specific delimiters or warnings to separate metric metadata from the agent's internal reasoning.
  • Capability inventory: The skill allows shell command execution (oodle CLI) and the construction of PromQL queries based on the ingested metadata.
  • Sanitization: While the skill suggests using jq for robust JSON parsing, it does not provide specific guidance on sanitizing the ingested label values before they are interpolated into the prompt for query generation.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 12, 2026, 01:35 AM