confident-tracing
Pass
Audited by Gen Agent Trust Hub on Oct 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the
confident-tracepackage via Python'spipand Node.jsnpmregistries. It also provides links to documentation hosted on the vendor's official GitHub repository (github.com/confident-ai/confident-trace). - [COMMAND_EXECUTION]: Provides CLI commands for installing dependencies and initializing the instrumentation environment, such as using the
node --import confident-trace/registerflag for automatic instrumentation in Node.js applications. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external data, such as LLM inputs and outputs, for the purpose of tracing and observability. It includes features to manage this surface, such as the
capture_contentconfiguration flag to prevent the logging of sensitive information. - Ingestion points: LLM inputs (
user_input) and outputs (answer) captured viaupdate_traceandupdate_spaninreferences/tracing.md. - Boundary markers: Not applicable to the telemetry capture process itself.
- Capability inventory: The SDK performs network operations to export traces to the configured
CONFIDENT_OTEL_ENDPOINT. - Sanitization: The skill documents the use of
capture_content=False(Python) orcaptureContent: false(TypeScript) to suppress the capture of potentially sensitive payload data. - [DATA_EXFILTRATION]: The skill describes the export of telemetry data (spans, metadata, and tags) to the Confident AI platform. This behavior is controlled via the
CONFIDENT_API_KEYand is the primary intended function of the observability SDK.
Audit Metadata