The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses sensitive environment variables (e.g., AGENTO11Y_AUTH_TOKEN, OTEL_EXPORTER_OTLP_HEADERS) and .env files to verify and configure the instrumentation setup. Although the instructions explicitly forbid the agent from asking the user to paste secrets into the chat, the combination of reading sensitive credentials and the presence of network-capable tools (gcx, WebFetch) creates a potential exfiltration surface.
[COMMAND_EXECUTION]: The skill uses the Bash tool to execute the gcx CLI for cloud resource discovery and to run the developer's local application for verifying that telemetry data is being correctly sent to the observability stack.
[EXTERNAL_DOWNLOADS]: Fetches SDK reference documentation and instrumentation rules from the official Grafana GitHub repository (grafana/agento11y) to provide up-to-date guidance.
[INDIRECT_PROMPT_INJECTION]: The skill reads untrusted data by analyzing the developer's local source code to detect instrumentation gaps.
Ingestion points: Step 1 and Step 3 involve reading various application source files using Read, Grep, and Glob tools.
Boundary markers: The skill mandates that every code write must be gated by explicit developer confirmation after reporting the proposed changes.
Capability inventory: The skill possesses Bash execution, file-writing (Write, Edit), and network access (WebFetch).
Sanitization: No specific sanitization or escaping mechanisms are described for the content ingested from the developer's files.
[DYNAMIC_EXECUTION]: Generates and applies instrumentation logic (such as OpenTelemetry provider snippets and client wrappers) to the codebase based on the identified gaps and fetched SDK references.

agento11y-instrument