devops-opentelemetry
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill configures telemetry collection pipelines that ingest external data (logs and traces), which introduces a potential surface for indirect prompt injection.
- Ingestion points: The
filelogandotlpreceivers defined inSKILL.mdandreferences/collector-pipeline.mdingest data from local file systems and network endpoints. - Boundary markers: No specific delimiters or boundary markers are defined for the telemetry content.
- Capability inventory: The skill uses the collector to read files and export data to multiple remote backends via network protocols.
- Sanitization: The skill provides clear instructions and code to use the
attributesprocessor to hash PII and delete sensitive fields likedb.statementordb.connection_stringto mitigate data exposure. - [EXTERNAL_DOWNLOADS]: The skill downloads official instrumentation components from the project's public repository.
- Evidence: Fetches the
opentelemetry-javaagent.jarfrom the official OpenTelemetry GitHub repository atgithub.com/open-telemetry. - [COMMAND_EXECUTION]: The skill includes shell commands for environment configuration and agent execution.
- Evidence: Uses
npm install,pip install, andjava -javaagentwithin the implementation guides inSKILL.mdandreferences/sdk-instrumentation.md.
Audit Metadata