Promql Validator

Validate, lint, audit, or fix PromQL queries and alerting rules; detects anti-patterns.

What to check before installing/running this skill: - Review the included Python scripts yourself (validate_syntax.py, check_best_practices.py, test_validators.py). They appear to be static PromQL analyzers and the provided excerpts show no network calls or obfuscated code, but you should still inspect the full sources. - The SKILL.md expects to run commands that use python3 and git and to be executed from the repository root. The skill metadata does not declare these binaries; ensure your environment has python3 and git or ask the author to declare them. Prefer running the scripts with absolute paths to the skill folder instead of cd'ing to repo root to limit file access. - Because the instructions tell the agent to use git rev-parse --show-toplevel (and to cite lines from repository files), the skill may read arbitrary files in whatever repository the agent runs in. If you run this in a repository containing secrets, run the skill in an isolated/sandboxed environment or a copy of the repo without sensitive data. - Run the test suite locally (scripts/test_validators.py) before granting the agent autonomy. That will show what outputs the scripts produce and help you validate they behave as expected. - If you plan to allow autonomous invocation, consider restricting its scope (or require manual approval) because reading repository-wide files increases privacy risk. Ask the publisher to: (a) declare required binaries (python3, git) in metadata, and (b) change instructions to use absolute skill paths or limit file access to the skill's folder to avoid accidental exposure of unrelated repository contents.

Type: OpenClaw Skill Name: promql-validator Version: 0.1.0 The skill provides PromQL validation and linting using local Python scripts. It is classified as suspicious because the instructions in SKILL.md direct the AI agent to execute shell commands using unsanitized user input (the "<query>" parameter), which constitutes a shell injection vulnerability. While the underlying Python scripts (validate_syntax.py and check_best_practices.py) are well-documented, include a test suite (test_validators.py), and perform only safe regex-based analysis without dangerous imports or network access, the instruction pattern itself creates a high-risk surface for prompt injection attacks against the agent.