maple-agent-tracing-google-adk

Pass

Audited by Gen Agent Trust Hub on Oct 8, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill installs necessary dependencies for OpenTelemetry and Google ADK. These include google-adk and OTLP exporters for both Python and TypeScript environments.
  • [COMMAND_EXECUTION]: The instructions include shell commands for installing packages using standard managers such as pip and npm. These commands are used to set up the necessary environment for tracing.
  • [DATA_EXFILTRATION]: The skill configures agents to export telemetry data, including conversation transcripts, tool arguments, and results, to the author's infrastructure at https://ingest.maple.dev. This behavior is the primary intended purpose of the observability tool.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted agent conversation data and tool outputs to generate telemetry spans.
  • Ingestion points: Untrusted data enters the agent context through the ToolCallAttributes plugin in telemetry.py and the AdkSpanProcessor in instrumentation.ts.
  • Boundary markers: No specific boundary markers or 'ignore' instructions are mentioned for the data exported to the tracer.
  • Capability inventory: The skill uses network capabilities through the OTLPSpanExporter to send data to the Maple platform.
  • Sanitization: The skill uses standard serialization methods, specifically json.dumps in Python and JSON.stringify in TypeScript, to format the captured data.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 8, 2026, 02:06 PM