opik-instrument

Pass

Audited by Gen Agent Trust Hub on Sep 22, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill installs official observability packages such as opik and opik-ts using standard package managers like pip or npm. These packages and the referenced documentation are provided by the verified vendor comet-ml.
  • [COMMAND_EXECUTION]: The skill utilizes the Bash tool to perform configuration checks (e.g., opik healthcheck) and run code verification paths. It includes strict instructions to only execute safe, non-production commands and to stop immediately if verification cannot be performed autonomously and safely.
  • [INDIRECT_PROMPT_INJECTION]: The skill reads and instruments untrusted source code within the user's project to add observability.
  • Ingestion points: Project source and configuration files (e.g., pyproject.toml, package.json, and source code files) are accessed via Read, Grep, and Glob tools.
  • Boundary markers: The instructions do not define specific boundary markers to isolate untrusted file content from the agent's internal reasoning.
  • Capability inventory: The skill has the ability to Edit and Write to the filesystem and execute commands via Bash.
  • Sanitization: No explicit content filtering or sanitization is mentioned for the ingested file content.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 22, 2026, 01:37 PM