aio-telemetry-instrument

Pass

Audited by Gen Agent Trust Hub on Aug 3, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the agent to fetch documentation from official Adobe GitHub repositories (github.com/adobe/aio-lib-telemetry) and the well-known OpenTelemetry project site (opentelemetry.io). These references are used to provide the user with accurate API information.
  • [COMMAND_EXECUTION]: The skill facilitates code modifications to the user's local project, specifically adding instrument() wrappers and defineMetrics() calls. This behavior is consistent with its primary purpose as an instrumentation guide and does not involve arbitrary command execution.
  • [PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it ingests untrusted data from the local filesystem and has the capability to modify code.
  • Ingestion points: Reads project configuration files (app.config.yaml, ext.config.yaml) and action source files in Phase 0 and Phase 1 of SKILL.md to understand the project structure.
  • Boundary markers: The instructions do not define specific delimiters or instructions to disregard potential malicious directives embedded within the processed code files.
  • Capability inventory: The skill performs file reads across the project directory and generates code implementations in Phase 4.
  • Sanitization: There is no explicit mention of sanitizing or filtering the content of the analyzed files before using it to influence code implementation decisions.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 3, 2026, 04:08 PM
Security Audit — agent-trust-hub — aio-telemetry-instrument