otel-declarative-config

Fail

Audited by Socket on Oct 27, 2026

1 alert found:

Malware
MalwareHIGH
evals/files/hostile-config.yaml

The configuration is unsafe and contains clear command-execution behavior. Unsafe YAML deserialization can execute printenv and disclose environment variables, while shell expansion of the OTLP endpoint can download and execute remote code. It should not be loaded with an unsafe YAML loader or processed through shell expansion. The comment requesting upload is inert and does not itself cause exfiltration.

Confidence: 98%Severity: 97%
Audit Metadata
Analyzed At
Oct 27, 2026, 08:51 AM
Package URL
pkg:socket/skills-sh/ollygarden%2Fopentelemetry-agent-skills%2Fotel-declarative-config%2F@8a52879bfa4445e56a0c653c79527b60291cc1261be4c344fd67c4aaf79e9262