aio-telemetry-instrument
Pass
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to fetch documentation from official Adobe GitHub repositories (
github.com/adobe/aio-lib-telemetry) and the well-known OpenTelemetry project site (opentelemetry.io). These references are used to provide the user with accurate API information. - [COMMAND_EXECUTION]: The skill facilitates code modifications to the user's local project, specifically adding
instrument()wrappers anddefineMetrics()calls. This behavior is consistent with its primary purpose as an instrumentation guide and does not involve arbitrary command execution. - [PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it ingests untrusted data from the local filesystem and has the capability to modify code.
- Ingestion points: Reads project configuration files (
app.config.yaml,ext.config.yaml) and action source files inPhase 0andPhase 1ofSKILL.mdto understand the project structure. - Boundary markers: The instructions do not define specific delimiters or instructions to disregard potential malicious directives embedded within the processed code files.
- Capability inventory: The skill performs file reads across the project directory and generates code implementations in
Phase 4. - Sanitization: There is no explicit mention of sanitizing or filtering the content of the analyzed files before using it to influence code implementation decisions.
Audit Metadata