opentelemetry-manual-instrumentation
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a robust ownership model that explicitly separates actions into agent-owned (read-only tasks like inspection and testing) and user-owned (mutating actions like package installation, deployment, and configuration changes). User-owned actions require explicit, per-command consent.
- [SAFE]: The skill incorporates a mandatory adversarial review process (Step 5) where an independent subagent must verify the proposed changes against security standards, specifically checking for PII leakage, sensitive data exposure, and high-cardinality attributes.
- [SAFE]: Extensive security documentation is included in the references (e.g.,
sensitive-data.mdandanti-patterns.md), providing clear rules to prevent the accidental recording of credentials, tokens, financial data, or government IDs in telemetry signals. - [SAFE]: The skill uses a dynamic context injection pattern in
SKILL.mdto load its own latest content. The command used (observe skill view) is a legitimate self-management tool belonging to the author's platform ecosystem. - [SAFE]: Data ingestion points are limited to the user's repository for analysis, and the skill provides strong sanitization guidelines for the resulting telemetry output, effectively mitigating risks associated with processing untrusted data.
Audit Metadata