uptime-monitoring
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill utilizes the
scan_apptool, which ingests data from external URLs (including health routes, body content, and third-party scripts) to suggest monitoring configurations. This external data ingestion provides a surface for indirect prompt injection, as malicious content on a scanned website could potentially influence the agent's reasoning or the suggestions it provides to the user. - [EXTERNAL_DOWNLOADS]: The skill references and encourages the use of an external MCP endpoint at
https://staygreen.io/mcpand a local stdio server available via npm (npx -y staygreen). These resources are provided by the skill's author and are integral to the skill's functionality for interacting with the service. - [COMMAND_EXECUTION]: The documentation provides specific shell commands for the agent or user to execute, including
claude mcp addfor configuring the MCP server andcurlcommands for testing heartbeat URLs and triggering failure drills. The skill correctly identifies that heartbeat URLs should be treated as secrets and managed through environment variables.
Audit Metadata