bounded-observe
Pass
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs users to install the
@bounded-sh/observepackage from the NPM registry. This package is part of the vendor's official toolkit for enabling application monitoring. - [COMMAND_EXECUTION]: The documentation provides standard technical instructions for preloading the observability shim when starting a Node.js process, using the
--requireor--importflags (e.g.,node --require @bounded-sh/observe/register app.js). - [DATA_EXFILTRATION]: The skill implements a monitoring service that reports metadata about outbound network calls (destination, status, duration) to the vendor's platform at
app-<appId>.bounded.sh. The documentation specifically mandates the redaction of sensitive content, including request/response bodies, LLM prompts/completions, and PII-named fields, ensuring that only non-sensitive metadata is transmitted.
Audit Metadata