maple-agent-tracing-pydantic-ai
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs users to install standard, well-known OpenTelemetry and Pydantic AI packages from the official Python Package Index (PyPI). This is a routine operation for enabling observability features in a development environment.
- [DATA_EXFILTRATION]: The skill's primary purpose is to export agent execution data, including chat transcripts, tool arguments, and results, to the vendor's telemetry endpoint (
https://ingest.maple.dev). While this involves sending data to an external service, it is the stated goal of the skill. The instructions include specific guidance on usinglogfire.ScrubbingOptionsto identify and redact sensitive information like passwords, tokens, and API keys from tool calls before they are exported. - [INDIRECT_PROMPT_INJECTION]: The tracing mechanism processes untrusted data (such as user prompts and agent responses) to generate telemetry spans. This creates a surface for indirect prompt injection where malicious data could influence the tracing output. The skill addresses this by providing options to toggle content inclusion (
include_content=False) and suggesting the use of OpenTelemetry Collector processors for pattern-based redaction of prompts.
Audit Metadata