maple-agent-tracing-cloudflare-agents
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install several standard packages from the npm registry, including
ai,@ai-sdk/otel, and various@opentelemetryscoped packages. These are well-known libraries for AI integration and telemetry collection. - [DATA_EXFILTRATION]: The skill configures an OpenTelemetry
OTLPTraceExporterto send agent activity data—including message transcripts, model metadata, and tool call details—to the vendor's ingestion endpoint athttps://ingest.maple.dev/v1/traces. As this is the primary functionality of the tracing tool, it represents expected behavior. - [CREDENTIALS_UNSAFE]: The implementation utilizes a
MAPLE_INGEST_KEYas a Bearer token for authentication with the telemetry service. The instructions correctly advise users to store this sensitive value in a secure manner usingwrangler secretor an environment variable file (.dev.vars) that is explicitly excluded from version control.
Audit Metadata