opentelemetry-validation

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes telemetry data (spans, metrics, and logs) from the Observe platform using observe query commands. This data is analyzed to perform compliance audits and troubleshooting, creating a surface where malicious telemetry could influence the agent's reasoning.
  • Ingestion points: JSON output from observe query across several datasets (e.g., Tracing/Span, Metrics/OpenTelemetry, Tracing/Service).
  • Boundary markers: The instructions do not define specific delimiters or "ignore embedded instructions" warnings for the processed telemetry data.
  • Capability inventory: The skill utilizes shell command execution via the observe CLI, curl, and jq.
  • Sanitization: No explicit sanitization or validation of the telemetry content is described before the data is interpolated into results or used for logic branches.
  • [EXTERNAL_DOWNLOADS]: The skill fetches OpenTelemetry semantic convention schemas from the official OpenTelemetry GitHub repository (api.github.com and raw.githubusercontent.com). These downloads target a well-known service and are a core part of the skill's functionality to ensure compliance with the latest standards.
  • [COMMAND_EXECUTION]: The skill makes extensive use of the observe CLI to query and manage datasets. It also employs shell utilities like curl, jq, sort, and tail to retrieve and parse versioning information from external repositories. These operations are aligned with the skill's primary purpose of telemetry validation.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 07:59 PM