victoriametrics-unused-metrics-analysis
Pass
Audited by Gen Agent Trust Hub on May 11, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill performs legitimate operations within the context of VictoriaMetrics monitoring and optimization. It refers to official documentation at docs.victoriametrics.com for feature verification.
- [COMMAND_EXECUTION]: The skill utilizes
curlandjqto interact with the VictoriaMetrics API for collecting stats and querying the database. This activity is consistent with the skill's stated purpose and uses tools explicitly allowed in the configuration. - [DATA_EXFILTRATION]: All network requests are directed to the VictoriaMetrics instance configured via environment variables ($VM_METRICS_URL). No data exfiltration or transmission to unauthorized third parties is present.
- [PROMPT_INJECTION]: The skill has an indirect prompt injection surface where the agent processes metric names retrieved from the VictoriaMetrics API.
- Ingestion points: Metric names retrieved from the
metric_names_statsAPI in SKILL.md. - Boundary markers: None provided in the instruction set.
- Capability inventory: The agent uses
Bash(curl)andBash(jq)to analyze the metric names and perform follow-up queries. - Sanitization: No explicit sanitization of metric names is performed before interpolation into subsequent queries.
Audit Metadata