investigate-application-performance
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFE
Full Analysis
- Safety Contract Implementation: The skill mandates a 'Safety contract' that explicitly prohibits the agent from constructing raw database queries (such as PromQL, LogQL, or SQL) or accepting arbitrary URLs as input. This significantly reduces the risk of the agent being used as a vector for injection attacks or Server-Side Request Forgery (SSRF).
- Least Privilege Tooling: The agent is restricted to a specific set of tools (
grafana_profile_status,grafana_list_packs, etc.) and a specific 'pack' (grafana.apm). This ensures the agent can only perform authorized performance investigations within a read-only scope. - Opaque Reference Handling: The instructions require the agent to use 'opaque references' and 'aliases' returned by tools rather than processing raw, potentially untrusted data. This practice prevents the agent from being manipulated by malicious content embedded in the data sources it monitors.
- Execution Constraints: The skill explicitly states that the agent cannot authorize code patches or production changes, maintaining a human-in-the-loop requirement for any remediation actions and preventing autonomous privilege escalation or system modification.
Audit Metadata