devops-opentelemetry

Pass

Audited by Gen Agent Trust Hub on Sep 1, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill configures telemetry collection pipelines that ingest external data (logs and traces), which introduces a potential surface for indirect prompt injection.
  • Ingestion points: The filelog and otlp receivers defined in SKILL.md and references/collector-pipeline.md ingest data from local file systems and network endpoints.
  • Boundary markers: No specific delimiters or boundary markers are defined for the telemetry content.
  • Capability inventory: The skill uses the collector to read files and export data to multiple remote backends via network protocols.
  • Sanitization: The skill provides clear instructions and code to use the attributes processor to hash PII and delete sensitive fields like db.statement or db.connection_string to mitigate data exposure.
  • [EXTERNAL_DOWNLOADS]: The skill downloads official instrumentation components from the project's public repository.
  • Evidence: Fetches the opentelemetry-javaagent.jar from the official OpenTelemetry GitHub repository at github.com/open-telemetry.
  • [COMMAND_EXECUTION]: The skill includes shell commands for environment configuration and agent execution.
  • Evidence: Uses npm install, pip install, and java -javaagent within the implementation guides in SKILL.md and references/sdk-instrumentation.md.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 1, 2026, 03:55 PM
Security Audit — agent-trust-hub — devops-opentelemetry