flake-dashboard-author
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes standard system utilities including xmllint for XML parsing, psql for database interaction, and curl for API communication. These commands are used to automate the ingestion of test results and the deployment of dashboard configurations.
- [CREDENTIALS_UNSAFE]: The documentation follows secure practices by advising the use of environment variables for sensitive API credentials (e.g., $GRAFANA_USER, $GRAFANA_PASS) rather than hardcoding them in scripts or configuration files.
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of external test report data (JUnit XML and Playwright JSON). While this creates a potential surface for indirect prompt injection if malicious test metadata is processed, the skill's purpose is infrastructure automation rather than autonomous agent reasoning.
- Ingestion points: test_runs.json, report.xml, and pw-results.json via scripts/parse_junit.py and scripts/ingest_playwright_json.js.
- Boundary markers: None identified in the instructional markdown.
- Capability inventory: The skill uses subprocess execution (node, python3, psql) and network operations (curl) to manage the observability stack.
- Sanitization: Not explicitly described; the skill assumes the use of standard CI/CD report formats.
Audit Metadata