otel-dotnet

Pass

Audited by Gen Agent Trust Hub on Oct 27, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the agent to fetch versioning information and changelogs from official OpenTelemetry repositories on GitHub and package metadata from NuGet. These are well-known and reputable sources for the subject matter.
  • [COMMAND_EXECUTION]: Includes instructions for utilizing the GitHub CLI (gh api) to programmatically determine the latest release tags for OpenTelemetry core and instrumentation libraries. It also suggests using grep to audit local .csproj and .cs files for existing telemetry configurations.
  • [REMOTE_CODE_EXECUTION]: The skill provides a standard installation command for the OpenTelemetry .NET auto-instrumentation agent, which involves downloading and executing a shell script (otel-dotnet-auto-install.sh) directly from the official OpenTelemetry GitHub release assets. As the source is the official repository for a well-known industry-standard project, this is considered a safe and intended operation.
  • [INDIRECT_PROMPT_INJECTION]: The skill incorporates external data processing by fetching and analyzing changelogs and package information from GitHub and NuGet.
  • Ingestion points: Data enters the context via gh api calls and WebFetch operations targeting raw.githubusercontent.com and nuget.org in SKILL.md and references/breaking-changes.md.
  • Boundary markers: No specific boundary markers or instructions to ignore embedded commands within the fetched changelogs are specified.
  • Capability inventory: The skill includes instructions for shell command execution (gh, grep) and remote script installation (curl | bash) across its reference files.
  • Sanitization: Fetched content is not explicitly sanitized before being presented to the agent. However, the use of official project sources significantly reduces the risk of malicious content injection.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 27, 2026, 08:51 AM