setup-grafana-observability
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFE
Full Analysis
- Secure Credential Handling: The skill explicitly prohibits the agent from requesting or receiving sensitive credentials such as tokens, passwords, or Grafana URLs. Instead, it instructs the user to use a local terminal flow for credential management, which is a strong security practice for preventing accidental data exposure to the LLM.
- Human-in-the-Loop Authority Activation: Critical operations, such as trust-root activation and credential connection, are designated as manual steps for the human operator. This design ensures that high-risk configuration changes cannot be performed autonomously by the agent.
- Principle of Least Privilege: The 'Safety contract' restricts the agent to specific, non-mutating tools (
grafana_profile_statusandgrafana_list_packs). The instructions explicitly forbid the agent from creating, editing, or deleting dashboards, alerts, or datasources. - Local Script Execution (User-Directed): The skill references local scripts (e.g.,
observabilityctl.mjs,grafana-authorityctl.mjs) to be executed by the user in their own terminal. This maintains a clear boundary between the agent's environment and the user's local execution environment for sensitive tasks. - Strict Configuration Guardrails: The documentation provided in the skill (e.g.,
saved-panel-enrollment.md) emphasizes strict schema validation and hash-pinned proposals, reducing the risk of accidental misconfiguration or unauthorized data access during monitoring setup.
Audit Metadata