confident-tracing

Pass

Audited by Gen Agent Trust Hub on Oct 19, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the confident-trace package via Python's pip and Node.js npm registries. It also provides links to documentation hosted on the vendor's official GitHub repository (github.com/confident-ai/confident-trace).
  • [COMMAND_EXECUTION]: Provides CLI commands for installing dependencies and initializing the instrumentation environment, such as using the node --import confident-trace/register flag for automatic instrumentation in Node.js applications.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external data, such as LLM inputs and outputs, for the purpose of tracing and observability. It includes features to manage this surface, such as the capture_content configuration flag to prevent the logging of sensitive information.
  • Ingestion points: LLM inputs (user_input) and outputs (answer) captured via update_trace and update_span in references/tracing.md.
  • Boundary markers: Not applicable to the telemetry capture process itself.
  • Capability inventory: The SDK performs network operations to export traces to the configured CONFIDENT_OTEL_ENDPOINT.
  • Sanitization: The skill documents the use of capture_content=False (Python) or captureContent: false (TypeScript) to suppress the capture of potentially sensitive payload data.
  • [DATA_EXFILTRATION]: The skill describes the export of telemetry data (spans, metadata, and tags) to the Confident AI platform. This behavior is controlled via the CONFIDENT_API_KEY and is the primary intended function of the observability SDK.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 19, 2026, 06:50 PM