otel-collector-builder
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the processing of user-provided configuration manifests (
builder.yaml), which serves as an ingestion surface for untrusted data that could attempt to influence agent behavior through field values. - Ingestion points: User-supplied manifest files and local filesystem paths for custom components.
- Boundary markers: No specific delimiters or safety instructions are defined to separate manifest data from agent instructions.
- Capability inventory: The skill involves shell command execution (e.g.,
go install,ocb,docker run) and filesystem read/write operations for generating and compiling code. - Sanitization: The documentation does not specify validation or sanitization steps for manifest content before processing.
- [EXTERNAL_DOWNLOADS]: The skill includes instructions to fetch the builder tool from the official OpenTelemetry project's Go module proxy and utilizes official container images from the
otelorganization on Docker Hub. - [COMMAND_EXECUTION]: The skill describes the execution of shell commands for installing development tools, scaffolding projects, and performing the compilation of custom collector binaries. All commands are standard for the described OpenTelemetry development workflow.
Audit Metadata