grafana
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [SAFE]: No malicious patterns, obfuscation, or unauthorized access attempts were identified during the analysis of the skill instructions and configuration files.\n- [EXTERNAL_DOWNLOADS]: The skill utilizes the official
grafana/grafanaDocker image and supports installing official plugins via theGF_PLUGINS_PREINSTALLenvironment variable. These downloads target the primary service provider and are documented neutrally as intended functionality.\n - Evidence:
image: grafana/grafana:13.2.4in SKILL.md\n - Evidence:
GF_PLUGINS_PREINSTALL: grafana-clickhouse-datasourcein SKILL.md\n- [CREDENTIALS_UNSAFE]: The skill promotes secure development practices by using environment variable interpolation for sensitive information and explicitly instructing the user to manage secrets via.envfiles rather than hardcoding them in the skill or repository.\n - Evidence: Use of placeholders like
${GRAFANA_ADMIN_PASSWORD},${PG_PASSWORD}, and${SLACK_WEBHOOK_URL}.\n- [COMMAND_EXECUTION]: The skill includes standard administrative shell commands for service orchestration and local API interaction, which are consistent with the documented purpose of managing a Grafana instance.\n - Evidence:
docker compose up -d\n - Evidence:
curlcommands used for dashboard export/import operations via the local API.
Audit Metadata