vendor-otel
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches instrumentation source code from the official OpenTelemetry JavaScript Contrib repository (
open-telemetry/opentelemetry-js-contrib) using the GitHub API. - [COMMAND_EXECUTION]: Utilizes system commands such as
gh,grep, andpnpmto query the environment, fetch remote assets, and execute local build and test suites to verify integration. - [INDIRECT_PROMPT_INJECTION]: The skill processes external source code from a third-party repository, which represents a potential attack surface for indirect prompt injection.
- Ingestion points: Source code fetched via
gh apifrom theopen-telemetry/opentelemetry-js-contribrepository (file:SKILL.md). - Boundary markers: The skill does not explicitly define delimiters for the fetched code content, but it requires the agent to present findings and diffs to the user.
- Capability inventory: The skill has capabilities for file system modifications, network access via the
ghtool, and execution of build/test scripts viapnpm(file:SKILL.md). - Sanitization: Employs mandatory manual review checkpoints where the user must approve the plan, verify diffs, and confirm PR creation before the agent proceeds (file:
SKILL.md).
Audit Metadata