otel-migration

Pass

Audited by Gen Agent Trust Hub on Oct 10, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to process user-provided application code to assist with refactoring for OpenTelemetry, establishing an inherent attack surface for indirect prompt injection.\n
  • Ingestion points: User-provided source code files submitted to the agent for migration assistance (SKILL.md).\n
  • Boundary markers: The instructions do not define specific delimiters or security boundaries to isolate user code from agent instructions.\n
  • Capability inventory: The agent typically retains file-writing and command-execution capabilities to perform the migration tasks.\n
  • Sanitization: There are no specific mechanisms described for sanitizing or validating the content of the user-provided code before processing.\n- [EXTERNAL_DOWNLOADS]: The skill contains numerous instructions for installing standard libraries and bridge components from the OpenTelemetry project.\n
  • Evidence: Reference files provide commands for go get, pip install, and npm install targeting official opentelemetry ecosystem packages.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 10, 2026, 09:44 AM