The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill utilizes gh api and WebFetch to retrieve version metadata and changelogs from the official OpenTelemetry project repositories on GitHub (open-telemetry/opentelemetry-go). These sources are well-known and recognized as trusted for the purpose of maintaining up-to-date telemetry configurations.
[COMMAND_EXECUTION]: Instructions include standard Go development commands such as go get, go mod tidy, and go build. These are used for routine dependency management and local build verification, with specific guidance to avoid testing against production endpoints.
[DYNAMIC_EXECUTION]: The skill documents the use of otelc, a compile-time instrumentation tool from the OpenTelemetry project. It uses the Go toolchain's -toolexec flag and //go:linkname to inject telemetry hooks into application binaries. This is a documented and legitimate method for providing zero-code instrumentation in Go.
[INDIRECT_PROMPT_INJECTION]: As the skill is designed to assist in configuring and instrumenting Go source code and YAML files, it presents a potential surface for indirect prompt injection if those files contain malicious instructions. However, the risk is inherent to the developer-assistance use case, and no exploitable patterns were found in the skill's own logic.
[DATA_EXFILTRATION]: No malicious exfiltration patterns were detected. The skill proactively identifies the risk of PII exposure in database queries (e.g., via the GORM plugin) and explicitly instructs users to disable query-variable capture to prevent data leaks.

otel-go