instrument-metrics

Pass

Audited by Gen Agent Trust Hub on Oct 23, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONPRIVILEGE_ESCALATIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill analyzes local project files, including source code and dependency manifests (such as package.json and requirements.txt), to identify platforms and existing instrumentation setups.
  • Ingestion points: Local source code and project configuration files are read to determine where to add metric capture.
  • Boundary markers: There are no specific delimiters defined to isolate ingested code content from the agent's internal instructions.
  • Capability inventory: The skill performs file-write operations to instrument code and environment configuration, and involves network operations to verify metrics delivery.
  • Sanitization: No explicit validation or sanitization of the processed code content is described.
  • [PRIVILEGE_ESCALATION]: The Kubernetes installation documentation specifies the creation of cluster-scoped roles.
  • Evidence: The Helm chart creates a ClusterRole and ClusterRoleBinding to enable the metrics agent to discover pods across all namespaces, which is a standard requirement for cluster-wide metric scraping.
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of official vendor-maintained libraries and containerized tools.
  • Evidence: Downloads the posthog-node package from NPM and the posthog package from PyPI.
  • Evidence: Pulls the official PostHog metrics agent Helm chart from the GitHub Container Registry at oci://ghcr.io/posthog/charts/posthog-metrics-agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 23, 2026, 11:49 AM