dashboard
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute several local shell commands to manage the dashboard lifecycle. These include using
uv run dashboardto start the server,killwithjqto stop the daemonized process based on a local PID file, andcatto read discovery information from~/.cache/prime-rl/dashboard/daemon.json. - [EXTERNAL_DOWNLOADS]: The skill uses the
uvpackage manager (uv sync --extra dashboard) to install the dashboard components. This is a standard dependency management operation within the project's environment and targets the project's own defined extras. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and summarize external data from local run logs, metrics (
metrics.jsonl), and traces (traces/live/*.jsonl). While this introduces a surface for indirect prompt injection if the run data contains adversarial content, the risk is minimized as the data source is the user's own local execution environment and the skill employs structured JSON citations for report generation.
Audit Metadata