setup-tracing
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches OpenAPI specifications and technical documentation from Coval's official domains (api.coval.dev and docs.coval.dev) to ensure accurate integration with the platform.\n- [COMMAND_EXECUTION]: Utilizes the Coval CLI (coval) for environment verification and agent discovery. It also suggests running standard language-specific test runners (e.g., npm test, go test) and compilers (e.g., python -m compileall) to verify the integrity of the instrumentation code.\n- [INDIRECT_PROMPT_INJECTION]: The agent is instructed to ingest and process external data from the vendor's API and documentation to guide the instrumentation process.\n
- Ingestion points: Technical documentation fetched from docs.coval.dev/llms.txt and OpenAPI definitions from api.coval.dev/v1/openapi.\n
- Boundary markers: The instructions do not specify explicit delimiters or "ignore embedded instructions" warnings for the fetched technical content.\n
- Capability inventory: The skill possesses network access (via curl, urllib, and OTel exporters), file system access for code modification, and local shell execution capabilities.\n
- Sanitization: The instructions explicitly require the agent to redact sensitive metadata from provider integrations before displaying API response output to the user.
Audit Metadata