statsig-create-cloud-metric
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill guides the agent in drafting and executing
curlcommands to interact with the Statsig API endpoint athttps://statsigapi.net/console/v1/metrics. This is the primary intended function of the skill.- [INDIRECT_PROMPT_INJECTION]: The skill processes external inputs such as metric names, event definitions, and SQL filter strings to construct API payloads. While this presents an attack surface, the skill includes specific security best practices to mitigate risks. - Ingestion points: User-provided parameters for metric creation described in
SKILL.md. - Boundary markers: The skill recommends the use of shell heredocs (
<<'JSON') inreferences/create-metric-api.mdto encapsulate the JSON payload, which prevents user-provided characters (like single quotes in SQL) from breaking out of the shell command. - Capability inventory: The skill facilitates network operations via
curlto a known vendor API. - Sanitization: Instructions explicitly warn against using inline single-quoted JSON when SQL filters are present, directing the agent to use safer shell formatting.
Audit Metadata