indexer-cluster-health-and-troubleshooting
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches release-specific public documentation from the vendor's official help site (help.splunk.com) using the web tool. This is performed to establish documented behavior for Splunk Enterprise and Splunk Cloud Platform and does not involve downloading executable content.
- [INDIRECT_PROMPT_INJECTION]: The skill analyzes user-provided deployment data, which constitutes an indirect prompt injection surface.
- Ingestion points: Processes logs, dashboard readbacks, and artifacts supplied by the user or fetched from documentation (SKILL.md, Workflow).
- Boundary markers: Includes instructions to explicitly label data sources (e.g., [supplied], [documented]) and mandates that retrieved content be treated as evidence rather than instructions.
- Capability inventory: Access is restricted to the web tool for documentation retrieval; the skill lacks capabilities for file-write, command-execution, or credential-access.
- Sanitization: Instructs the agent to redact sensitive identifiers and forbids the collection or processing of credentials, tokens, or private configuration.
Audit Metadata