otel-semantic-conventions
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches OpenTelemetry semantic convention definitions and metadata from official GitHub repositories. These downloads are performed via
curltargeting theopen-telemetryorganization, which is a well-known and trusted source. - [COMMAND_EXECUTION]: The skill executes a bundled bash script to query and parse semantic convention models. The script utilizes standard tools like
awk,jq, andcurl, and optionally usesgitto query local repository checkouts if configured by the user via environment variables. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external GitHub repositories which acts as a potential attack surface for indirect prompt injection.
- Ingestion points: Remote YAML model files fetched in
scripts/query-otel-semantic-conventions.shand presented to the agent context. - Boundary markers: No explicit delimiters or warnings are defined for the output generated by the lookup script.
- Capability inventory: The skill scripts use
curlfor network access,gitfor local file system interaction, andawkfor text parsing. - Sanitization: Input parameters for group lookups are sanitized using
trto prevent command injection, and identifiers are handled as variables withinawkscripts to ensure safe parsing of retrieved content.
Audit Metadata