maple-agent-tracing-smolagents

Pass

Audited by Gen Agent Trust Hub on Oct 8, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs users to install established packages from public registries, including smolagents, openinference-instrumentation-smolagents, and opentelemetry-sdk.
  • [COMMAND_EXECUTION]: Provides standard package management commands (pip install, uv add, poetry add) for setup.
  • [DATA_EXFILTRATION]: The skill configures an OpenTelemetry exporter to send agent session data (transcripts, model calls, tool arguments) to https://ingest.maple.dev and https://ingest.eu.maple.dev. These endpoints are resources owned by the skill's vendor, mapletechlabs, and are used for its primary observability function.
  • [INDIRECT_PROMPT_INJECTION]: The instrumentation process ingests untrusted data from user messages and tool outputs for tracing purposes.
  • Ingestion points: User input supplied to agent.run() and results returned from executed tools as described in SKILL.md.
  • Boundary markers: None explicitly defined in the provided instrumentation code to separate data from instructions within the traces.
  • Capability inventory: Network transmission of captured data via OTLPSpanExporter in tracing.py.
  • Sanitization: The skill documentation explicitly notes the availability of hide_inputs and hide_outputs configurations to redact potentially sensitive data from the traces.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 8, 2026, 02:06 PM