phoenix-tracing
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides documentation and reference guides for the Phoenix observability platform. It includes production-readiness checklists and explicitly guides users on how to implement PII (Personally Identifiable Information) masking to protect sensitive data during tracing.
- [INDIRECT_PROMPT_INJECTION]: The skill describes techniques for ingesting and observing external data, such as importing agent trajectories from JSON files (
references/instrumentation-atif-python.md), capturing document content from vector databases (references/span-retriever.md), and recording tool outputs (references/span-tool.md). This establishes a natural attack surface for indirect prompt injection within the application being instrumented. - Ingestion points: Data enters the context via ATIF JSON imports, retriever span attributes, and tool output values.
- Boundary markers: The documentation discusses data masking for PII but does not provide specific guidance on prompt boundary markers or delimiters for the traced data.
- Capability inventory: The instrumentation libraries described perform network operations to export trace data to a Phoenix server (e.g., via OTLP HTTP/gRPC).
- Sanitization: The skill provides detailed instructions on how to suppress and mask inputs, outputs, and messages to prevent sensitive data exposure in production environments.
Audit Metadata