agent-observability-replay-trace
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: Downloads the 'pup' CLI tool from the 'datadog-labs/pack' repository and configures the 'datadog-llmo' MCP server from Datadog's official domain. These resources are provided by the authoring organization for trace access.
- [COMMAND_EXECUTION]: Executes a generated Python runner script to replay application entrypoints using JSON inputs derived from traces. The runner enforces execution isolation by requiring the application name to end in '-local', preventing accidental pollution of production observability data.
- [DATA_EXFILTRATION]: Specifically unsets ambient environment variables like 'ANTHROPIC_API_KEY' during the replay process. This ensures that the application uses its own configured credentials and prevents the agent's or user's session keys from being recorded in the trace metadata.
- [CREDENTIALS_UNSAFE]: Follows security best practices by utilizing '.env' files for credential storage and explicitly warning against passing sensitive secrets as command-line arguments to avoid exposure in logs or history.
Audit Metadata