otel-go
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches version metadata and changelogs from the official OpenTelemetry GitHub repositories (open-telemetry/opentelemetry-go and open-telemetry/opentelemetry-go-contrib) using the GitHub CLI and web fetch commands. These are well-known technology repositories and the operations are used for legitimate configuration management.
- [COMMAND_EXECUTION]: The instructions involve standard development toolchain commands, such as
go getfor installing official OpenTelemetry modules andgh apifor querying release information. These commands are appropriately scoped to the OpenTelemetry project. - [DYNAMIC_EXECUTION]: The documentation describes the use of
otelc, a tool for compile-time instrumentation that injects telemetry hooks into binaries using the Go toolchain's-toolexecmechanism. This is a primary feature of the discussed OpenTelemetry project and is documented with relevant safety and requirement details. - [INDIRECT_PROMPT_INJECTION]: The skill provides guidance based on analysis of the user's Go source code (e.g., checking for specific imports or middleware). While this involves processing external data, the capabilities available to the skill are centered on standard software development tasks and do not introduce high-risk autonomous operations.
- Ingestion points: The agent is instructed to read local source files to identify existing instrumentation patterns and library usage.
- Boundary markers: The skill uses specific comparison tables and code blocks to differentiate between existing code and recommended changes.
- Capability inventory: Available capabilities include dependency management via Go modules, binary compilation, and querying GitHub repository metadata.
- Sanitization: Standard LLM code analysis is used without explicit secondary sanitization layers for source code content.
Audit Metadata