opentelemetry-ottl
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill operates on untrusted telemetry data (logs, traces, metrics) and collector configuration files, creating a potential surface for indirect prompt injection if malicious data attempts to manipulate transformation logic.\n- [INDIRECT_PROMPT_INJECTION]: Ingestion points: Telemetry records (logs, spans, metrics) and OpenTelemetry Collector configuration files (e.g.,
otel-collector.yaml) processed via file patterns defined in the skill metadata.\n- [INDIRECT_PROMPT_INJECTION]: Boundary markers: The skill provides instructions on usingerror_mode: ignoreand scoping statements withconditionsorwhereclauses, which serve as logic boundaries to prevent accidental pipeline halts.\n- [INDIRECT_PROMPT_INJECTION]: Capability inventory: The skill utilizes OTTL functions for data manipulation, includingset,delete_key,keep_keys,replace_pattern,merge_maps, andParseJSON.\n- [INDIRECT_PROMPT_INJECTION]: Sanitization: The documentation emphasizes safety guards likeIsMap(body)andIsString(body)to prevent runtime errors and provides patterns for PII redaction usingSHA256hashing andreplace_all_patternsfor sensitive headers.
Audit Metadata