opentelemetry-auto-instrumentation
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches the latest version information and binary artifacts (such as the OpenTelemetry Java Agent) from official and well-known sources, including GitHub (
github.com/open-telemetry), NuGet, PyPI, Maven Central, and RubyGems. These operations are standard for maintaining up-to-date instrumentation libraries. - [INDIRECT_PROMPT_INJECTION]: The skill performs discovery by scanning application source code, configuration files (e.g.,
package.json,pom.xml,requirements.txt), and environment variables to identify the runtime stack and existing instrumentation. While this represents a surface for indirect prompt injection if those files contain malicious instructions, the risk is inherent to the discovery task and handled as a low-severity architectural consideration. - [COMMAND_EXECUTION]: The skill uses the
observeCLI and standard package managers (npm,pip,dotnet,gem) to query for service information and install instrumentation packages. These actions are aligned with the skill's primary purpose of application instrumentation. - [DYNAMIC_EXECUTION]: The skill recommends standard language-level mechanisms for instrumentation, such as the Java Agent (
-javaagent) and Node.js experimental loaders, which are required for OpenTelemetry auto-instrumentation to function.
Audit Metadata