otel-dotnet
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to fetch versioning information and changelogs from official OpenTelemetry repositories on GitHub and package metadata from NuGet. These are well-known and reputable sources for the subject matter.
- [COMMAND_EXECUTION]: Includes instructions for utilizing the GitHub CLI (
gh api) to programmatically determine the latest release tags for OpenTelemetry core and instrumentation libraries. It also suggests usinggrepto audit local.csprojand.csfiles for existing telemetry configurations. - [REMOTE_CODE_EXECUTION]: The skill provides a standard installation command for the OpenTelemetry .NET auto-instrumentation agent, which involves downloading and executing a shell script (
otel-dotnet-auto-install.sh) directly from the official OpenTelemetry GitHub release assets. As the source is the official repository for a well-known industry-standard project, this is considered a safe and intended operation. - [INDIRECT_PROMPT_INJECTION]: The skill incorporates external data processing by fetching and analyzing changelogs and package information from GitHub and NuGet.
- Ingestion points: Data enters the context via
gh apicalls andWebFetchoperations targetingraw.githubusercontent.comandnuget.orginSKILL.mdandreferences/breaking-changes.md. - Boundary markers: No specific boundary markers or instructions to ignore embedded commands within the fetched changelogs are specified.
- Capability inventory: The skill includes instructions for shell command execution (
gh,grep) and remote script installation (curl | bash) across its reference files. - Sanitization: Fetched content is not explicitly sanitized before being presented to the agent. However, the use of official project sources significantly reduces the risk of malicious content injection.
Audit Metadata