maple-agent-tracing-google-adk
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs necessary dependencies for OpenTelemetry and Google ADK. These include
google-adkand OTLP exporters for both Python and TypeScript environments. - [COMMAND_EXECUTION]: The instructions include shell commands for installing packages using standard managers such as
pipandnpm. These commands are used to set up the necessary environment for tracing. - [DATA_EXFILTRATION]: The skill configures agents to export telemetry data, including conversation transcripts, tool arguments, and results, to the author's infrastructure at
https://ingest.maple.dev. This behavior is the primary intended purpose of the observability tool. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted agent conversation data and tool outputs to generate telemetry spans.
- Ingestion points: Untrusted data enters the agent context through the
ToolCallAttributesplugin intelemetry.pyand theAdkSpanProcessorininstrumentation.ts. - Boundary markers: No specific boundary markers or 'ignore' instructions are mentioned for the data exported to the tracer.
- Capability inventory: The skill uses network capabilities through the
OTLPSpanExporterto send data to the Maple platform. - Sanitization: The skill uses standard serialization methods, specifically
json.dumpsin Python andJSON.stringifyin TypeScript, to format the captured data.
Audit Metadata