latitude-telemetry
Pass
Audited by Gen Agent Trust Hub on May 18, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides legitimate instructions for integrating LLM observability via the Latitude platform. No malicious behavior or security bypasses were found.
- [EXTERNAL_DOWNLOADS]: The skill references the installation of first-party libraries (
@latitude-data/telemetry,latitude-telemetry) and standard OpenTelemetry packages across various languages from official registries (NPM, PyPI, Composer, etc.). All sources are well-known and consistent with the vendor's identity. - [COMMAND_EXECUTION]: Recommends the use of
grepandcurlfor legitimate development tasks: discovering LLM call sites and verifying the ingest endpoint connectivity. These commands are intended to be run in the user's local environment for setup verification. - [DATA_EXFILTRATION]: Documents the transmission of LLM execution traces to
https://ingest.latitude.so. This behavior is the primary purpose of the skill and is transparently disclosed to the user. - [CREDENTIALS_UNSAFE]: Includes a mandatory "Rule 4" that prevents the AI agent from writing sensitive credentials to
.envfiles, ensuring the user maintains control over secrets and preventing the generation of fake or hardcoded keys.
Audit Metadata