latitude-telemetry
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONPERSISTENCE
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches Latitude telemetry SDKs (e.g.,
@latitude-data/telemetry,latitude-telemetry) and harness-specific plugins from official package registries (NPM and PyPI). - [REMOTE_CODE_EXECUTION]: Uses
npxto download and execute telemetry installation scripts for coding agent harnesses such as Claude Code, OpenClaw, and Pi. - [COMMAND_EXECUTION]: Instructs the agent to execute CLI commands for package installation, plugin configuration, and verification of trace delivery using the Latitude CLI.
- [DATA_EXFILTRATION]: Configures applications to export LLM execution traces, including prompt content, responses, and memory snapshots, to Latitude's ingestion endpoint at
https://ingest.latitude.so/v1/traces. - [PERSISTENCE]: Modifies configuration files in the user's home directory (e.g.,
~/.claude/settings.json,~/.hermes/config.yaml,~/.openclaw/openclaw.json) to install persistent telemetry hooks that execute on session end or turn boundaries.
Audit Metadata