maple-agent-tracing-microsoft-agent-framework
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install standard libraries from official registries (PyPI and NuGet), including
agent-framework-core,opentelemetry-exporter-otlp-proto-http, andsemantic-kernel. - [DATA_EXFILTRATION]: The skill configures an OTLP/HTTP exporter to send GenAI spans and conversation metadata to
ingest.maple.dev. This behavior is the primary intended function of the skill (telemetry and observability) and targets the vendor's own infrastructure. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user messages and tool outputs to generate observability spans. While it captures this content (when
enable_sensitive_datais set), it does so for logging purposes rather than execution, following standard observability patterns. - [COMMAND_EXECUTION]: Includes a manual version check command (
python -c "import agent_framework; print(agent_framework.__version__)") to verify the environment before installation.
Audit Metadata