victoriametrics-unused-metrics-analysis
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted metric names retrieved from the VictoriaMetrics API and interpolates them into PromQL queries without sanitization. 1. Ingestion points: Metric names are fetched from the /api/v1/status/metric_names_stats endpoint in SKILL.md (Phase 2, Step 1). 2. Boundary markers: None are present in the regex strings used in the count() queries. 3. Capability inventory: The skill uses Bash(curl:) and Bash(jq:) to query the database and process results. 4. Sanitization: There is no evidence of escaping or validation of metric names before they are embedded in query strings.
- [COMMAND_EXECUTION]: The skill utilizes standard system tools via the Bash tool to perform its analysis. The workflow relies on curl for API communication and jq for parsing JSON responses.
- [EXTERNAL_DOWNLOADS]: The skill performs network operations to reach the user-defined VictoriaMetrics instance for status checking and data collection.
Audit Metadata