maple-agent-tracing-smolagents
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs users to install established packages from public registries, including
smolagents,openinference-instrumentation-smolagents, andopentelemetry-sdk. - [COMMAND_EXECUTION]: Provides standard package management commands (
pip install,uv add,poetry add) for setup. - [DATA_EXFILTRATION]: The skill configures an OpenTelemetry exporter to send agent session data (transcripts, model calls, tool arguments) to
https://ingest.maple.devandhttps://ingest.eu.maple.dev. These endpoints are resources owned by the skill's vendor, mapletechlabs, and are used for its primary observability function. - [INDIRECT_PROMPT_INJECTION]: The instrumentation process ingests untrusted data from user messages and tool outputs for tracing purposes.
- Ingestion points: User input supplied to
agent.run()and results returned from executed tools as described inSKILL.md. - Boundary markers: None explicitly defined in the provided instrumentation code to separate data from instructions within the traces.
- Capability inventory: Network transmission of captured data via
OTLPSpanExporterintracing.py. - Sanitization: The skill documentation explicitly notes the availability of
hide_inputsandhide_outputsconfigurations to redact potentially sensitive data from the traces.
Audit Metadata