183-java-observability-tracing-opentelemetry
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill establishes clear security boundaries for distributed tracing, explicitly instructing users to avoid including sensitive data like secrets, tokens, and PII in span attributes.
- [SAFE]: The recommended configuration for OTLP exporters and sampling strategies aligns with standard, secure industry practices without introducing untrusted external dependencies.
- [INDIRECT_PROMPT_INJECTION]: 1. Ingestion points: Data enters the tracing context through Java method parameters such as orderId, userEmail, and provider in the provided code examples. 2. Boundary markers: The skill includes specific directives like 'NO SENSITIVE DATA' and 'PRIVACY FIRST' to define safety constraints. 3. Capability inventory: The skill utilizes the standard OpenTelemetry API for instrumentation; no unsafe file-system writes or arbitrary command execution capabilities are granted. 4. Sanitization: The workflow includes a hardening step to remove sensitive or high-cardinality data before spans are finalized and exported.
Audit Metadata