eval-trace
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides utility scripts such as
setup_workspace.pyfor environment initialization,normalize_traces.pyfor data processing, andreplay_spans.pyfor data replaying. These tools are designed for local development and observability tasks. - [EXTERNAL_DOWNLOADS]: The skill utilizes the
confident-traceinstrumentation SDK (Python and Node.js). These are verified vendor resources belonging to the skill's author, Confident AI. - [DATA_EXFILTRATION]: Capture and replay scripts facilitate the transfer of application trace data to the Confident AI platform (
otel.confident-ai.com). This functionality is the intended purpose of the managed workflow and is explicitly documented, including instructions for user-controlled API keys and data redaction. - [INDIRECT_PROMPT_INJECTION]: The skill processes trace data from external AI applications, which constitutes an attack surface for indirect prompt injection. This risk is effectively mitigated by instructional guardrails in the skill prompt that advise the agent to focus on qualitative review and human discovery, alongside built-in support for content redaction.
Audit Metadata