instrument-metrics
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONPRIVILEGE_ESCALATIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill analyzes local project files, including source code and dependency manifests (such as
package.jsonandrequirements.txt), to identify platforms and existing instrumentation setups. - Ingestion points: Local source code and project configuration files are read to determine where to add metric capture.
- Boundary markers: There are no specific delimiters defined to isolate ingested code content from the agent's internal instructions.
- Capability inventory: The skill performs file-write operations to instrument code and environment configuration, and involves network operations to verify metrics delivery.
- Sanitization: No explicit validation or sanitization of the processed code content is described.
- [PRIVILEGE_ESCALATION]: The Kubernetes installation documentation specifies the creation of cluster-scoped roles.
- Evidence: The Helm chart creates a
ClusterRoleandClusterRoleBindingto enable the metrics agent to discover pods across all namespaces, which is a standard requirement for cluster-wide metric scraping. - [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of official vendor-maintained libraries and containerized tools.
- Evidence: Downloads the
posthog-nodepackage from NPM and theposthogpackage from PyPI. - Evidence: Pulls the official PostHog metrics agent Helm chart from the GitHub Container Registry at
oci://ghcr.io/posthog/charts/posthog-metrics-agent.
Audit Metadata