worker-ready-tracing

Pass

Audited by Gen Agent Trust Hub on May 15, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/trace_worker_ready.py executes local CLI tools such as tc-logview, paperctl, and browser-harness to retrieve infrastructure telemetry.\n
  • Evidence: Commands are invoked via subprocess.run using argument lists, which prevents shell injection. This includes browser automation commands passed to browser-harness for data extraction from web dashboards.\n- [DATA_EXFILTRATION]: The skill aggregates logs and metrics from several cloud and observability platforms.\n
  • Evidence: It accesses GCP Cloud Logging, SolarWinds Observability, Azure Activity Logs (via Splunk), and Prometheus (via Yardstick).\n
  • Context: This data collection is consistent with the skill's stated diagnostic purpose and relies on the user's existing local configuration or active authenticated browser sessions. No unauthorized exfiltration to external domains was detected.\n- [SAFE]: No malicious patterns such as prompt injection, persistence mechanisms, or credential harvesting were identified. The code follows standard practices for infrastructure monitoring and performance tracing.
Audit Metadata
Risk Level
SAFE
Analyzed
May 15, 2026, 09:26 PM
Security Audit — agent-trust-hub — worker-ready-tracing