latitude-telemetry

Pass

Audited by Gen Agent Trust Hub on May 18, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill provides legitimate instructions for integrating LLM observability via the Latitude platform. No malicious behavior or security bypasses were found.
  • [EXTERNAL_DOWNLOADS]: The skill references the installation of first-party libraries (@latitude-data/telemetry, latitude-telemetry) and standard OpenTelemetry packages across various languages from official registries (NPM, PyPI, Composer, etc.). All sources are well-known and consistent with the vendor's identity.
  • [COMMAND_EXECUTION]: Recommends the use of grep and curl for legitimate development tasks: discovering LLM call sites and verifying the ingest endpoint connectivity. These commands are intended to be run in the user's local environment for setup verification.
  • [DATA_EXFILTRATION]: Documents the transmission of LLM execution traces to https://ingest.latitude.so. This behavior is the primary purpose of the skill and is transparently disclosed to the user.
  • [CREDENTIALS_UNSAFE]: Includes a mandatory "Rule 4" that prevents the AI agent from writing sensitive credentials to .env files, ensuring the user maintains control over secrets and preventing the generation of fake or hardcoded keys.
Audit Metadata
Risk Level
SAFE
Analyzed
May 18, 2026, 08:13 PM
Security Audit — agent-trust-hub — latitude-telemetry