copilot-otel-metrics
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFE
Full Analysis
- Privacy-First Data Filtering: The skill provides OpenTelemetry Collector configurations that implement a fail-closed allow-list. This mechanism ensures that only known, safe telemetry attributes reach storage, effectively preventing the accidental collection of sensitive AI prompt or response content that might be emitted by the extension.
- Robust Configuration Management: To modify VS Code settings, the skill employs a dedicated script (
settings_upsert.py) that performs atomic file operations and maintains timestamped backups. This ensures that user configurations are protected against corruption or unexpected data loss during the setup process. - Secure Network and Path Policies: A shared policy module (
_input_policy.py) is used by the helper scripts to enforce strict validation on URLs and file paths. This includes preventing potential Server-Side Request Forgery (SSRF) by restricting network calls to the local loopback interface and ensuring file operations remain within designated directories. - Supply Chain Security Controls: The generated Docker Compose definitions use immutable image digests (SHA256) rather than mutable tags. This practice ensures that the running containers are exactly the versions reviewed by the author, protecting against upstream image substitution.
- User-Centric Execution Model: The skill adheres to a strict "generation-only" boundary. It creates deployment templates and configuration files but requires the user to manually execute all infrastructure and container commands, ensuring human oversight for all high-privilege operations.
Audit Metadata