pantheon-ai/promql-generator
Comprehensive toolkit for generating best practice PromQL (Prometheus Query Language) queries following current standards and conventions. Use this skill when creating new PromQL queries, implementing monitoring and alerting rules, or building observability dashboards.
80
100%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
The skill's SKILL.md workflow and "Documentation Lookup" explicitly direct the agent to fetch external Prometheus documentation (via "context7 MCP" resolution and a "Fallback WebSearch" for "Prometheus PromQL ...") and to read/cite those third-party web docs before generating queries, so untrusted public web content would be ingested and could influence subsequent tool use and actions.
Where we found it
context7 MCP
domain · 1 site
The SKILL.md Documentation Lookup section explicitly instructs the agent to use context7 MCP to resolve 'prometheus' and fetch documentation at runtime, making it a third-party content source the plugin directs the agent to ingest.
SKILL.md
139
1. **context7 MCP (preferred)**: resolve `prometheus`, then fetch docs with the relevant topic.
WebSearch (public web)
domain · 1 site
The SKILL.md Documentation Lookup section explicitly instructs the agent to use a Fallback WebSearch for Prometheus PromQL documentation as a fallback, directing the agent to fetch and ingest untrusted public web content.
SKILL.md
140
2. **Fallback WebSearch**: "Prometheus PromQL [function/operator] documentation [version] examples"
- Audited
- Security analysis