otel-collector-builder
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the OpenTelemetry Collector Builder (OCB) tool from the official go.opentelemetry.io domain and retrieves collector components via Go modules from the open-telemetry GitHub organization.
- [DYNAMIC_EXECUTION]: Generates Go source code files (such as main.go and components.go) at runtime based on a provided YAML manifest and compiles them into a custom executable binary using the Go toolchain.
- [COMMAND_EXECUTION]: Invokes shell commands including "go install", "ocb", and "docker" to facilitate tool installation, project scaffolding, and binary compilation.
- [INDIRECT_PROMPT_INJECTION]: The build process ingests YAML configuration and local directory paths; if these inputs are sourced from untrusted data, it could lead to the inclusion of malicious components or code paths in the generated binary.
- Ingestion points: The builder.yaml manifest file and local paths specified for custom component development in SKILL.md and references/manifest.md.
- Boundary markers: No explicit prompt delimiters or instructions to ignore embedded commands are defined for the manifest parsing.
- Capability inventory: The skill performs binary installation, container execution, source code generation, and runtime compilation.
- Sanitization: Validation is limited to standard Go module resolution and YAML schema checks; no specific sanitization of the component source content is performed before compilation.
Audit Metadata