The Agent Skills Directory

[SAFE]: The skill provides standard documentation and best-practices for configuring OpenTelemetry SDKs, which is consistent with its stated purpose of assisting with application observability.
[EXTERNAL_DOWNLOADS]: The Java instrumentation guide includes a command to download the opentelemetry-javaagent.jar from the official OpenTelemetry GitHub organization. This is a well-known and trusted source for observability software and does not represent a security risk.
[COMMAND_EXECUTION]: The skill documents the use of a local helper script (start-collector.sh) and standard CLI tools like jq for verifying telemetry data. These tools are used for legitimate development and testing purposes.
[INDIRECT_PROMPT_INJECTION]: The skill facilitates the generation of instrumentation code based on user-provided inputs such as service names and custom attribute keys. While this represents a potential surface for indirect injection, the risk is mitigated by the skill's emphasis on using structured data and following established semantic conventions. * Ingestion points: Application metadata and custom attributes provided by the user are interpolated into code snippets in references/custom-instrumentation.md and references/python.md. * Boundary markers: The instructions do not define specific delimiters for separating user-provided data from code templates. * Capability inventory: The generated code across all languages includes capabilities for network communication and file system access. * Sanitization: The skill recommends validation through adherence to OpenTelemetry semantic conventions but does not include explicit code-level sanitization for user inputs.

otel-instrumentation