otel-component-telemetry
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill clones source code from repositories in the official OpenTelemetry GitHub organization to perform instrumentation analysis.
- [COMMAND_EXECUTION]: The orchestration script 'scan.sh' executes standard system utilities including 'git', 'jq', 'awk', and 'envsubst' to manage repository tags and prepare prompts.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it analyzes external source code where malicious content could influence the agent's behavior. 1. Ingestion points: Cloned source code from repositories listed in config.json. 2. Boundary markers: Absent in the prompt logic. 3. Capability inventory: File system write operations for telemetry inventory markdown files. 4. Sanitization: No filtering or validation of the analyzed source code content is performed.
Audit Metadata