vendor-otel

Pass

Audited by Gen Agent Trust Hub on Nov 4, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches instrumentation source code from the official OpenTelemetry JavaScript Contrib repository (open-telemetry/opentelemetry-js-contrib) using the GitHub API.
  • [COMMAND_EXECUTION]: Utilizes system commands such as gh, grep, and pnpm to query the environment, fetch remote assets, and execute local build and test suites to verify integration.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external source code from a third-party repository, which represents a potential attack surface for indirect prompt injection.
  • Ingestion points: Source code fetched via gh api from the open-telemetry/opentelemetry-js-contrib repository (file: SKILL.md).
  • Boundary markers: The skill does not explicitly define delimiters for the fetched code content, but it requires the agent to present findings and diffs to the user.
  • Capability inventory: The skill has capabilities for file system modifications, network access via the gh tool, and execution of build/test scripts via pnpm (file: SKILL.md).
  • Sanitization: Employs mandatory manual review checkpoints where the user must approve the plan, verify diffs, and confirm PR creation before the agent proceeds (file: SKILL.md).
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 4, 2026, 04:40 PM