opentelemetry-ottl

Pass

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill operates on untrusted telemetry data (logs, traces, metrics) and collector configuration files, creating a potential surface for indirect prompt injection if malicious data attempts to manipulate transformation logic.\n- [INDIRECT_PROMPT_INJECTION]: Ingestion points: Telemetry records (logs, spans, metrics) and OpenTelemetry Collector configuration files (e.g., otel-collector.yaml) processed via file patterns defined in the skill metadata.\n- [INDIRECT_PROMPT_INJECTION]: Boundary markers: The skill provides instructions on using error_mode: ignore and scoping statements with conditions or where clauses, which serve as logic boundaries to prevent accidental pipeline halts.\n- [INDIRECT_PROMPT_INJECTION]: Capability inventory: The skill utilizes OTTL functions for data manipulation, including set, delete_key, keep_keys, replace_pattern, merge_maps, and ParseJSON.\n- [INDIRECT_PROMPT_INJECTION]: Sanitization: The documentation emphasizes safety guards like IsMap(body) and IsString(body) to prevent runtime errors and provides patterns for PII redaction using SHA256 hashing and replace_all_patterns for sensitive headers.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 23, 2026, 04:22 PM