configure-trace-metrics
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill describes the creation of LLM judge metrics that analyze external data, such as conversation transcripts and OpenTelemetry (OTel) traces. This creates a surface where malicious or unexpected content in the ingested traces could influence the outcome of the LLM evaluation.
- Ingestion points: Transcripts and trace data (e.g., tool arguments, error messages) processed during evaluation runs in SKILL.md.
- Boundary markers: The prompt templates include natural language instructions for the judge but lack explicit delimiters to isolate the instructions from the variable transcript and trace data.
- Capability inventory: The skill uses the coval CLI and API to create metrics and launch evaluation runs across all execution phases.
- Sanitization: No specific sanitization or filtering logic is provided for the data interpolated into judge prompts.
- [EXTERNAL_DOWNLOADS]: The skill fetches the OpenAPI specification from https://api.coval.dev/v1/openapi using curl. This domain belongs to the skill vendor and the request is used to ensure compatibility with the platform's API.
Audit Metadata