otel-semantic-conventions

Pass

Audited by Gen Agent Trust Hub on Sep 4, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches OpenTelemetry semantic convention definitions and metadata from official GitHub repositories. These downloads are performed via curl targeting the open-telemetry organization, which is a well-known and trusted source.
  • [COMMAND_EXECUTION]: The skill executes a bundled bash script to query and parse semantic convention models. The script utilizes standard tools like awk, jq, and curl, and optionally uses git to query local repository checkouts if configured by the user via environment variables.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external GitHub repositories which acts as a potential attack surface for indirect prompt injection.
  • Ingestion points: Remote YAML model files fetched in scripts/query-otel-semantic-conventions.sh and presented to the agent context.
  • Boundary markers: No explicit delimiters or warnings are defined for the output generated by the lookup script.
  • Capability inventory: The skill scripts use curl for network access, git for local file system interaction, and awk for text parsing.
  • Sanitization: Input parameters for group lookups are sanitized using tr to prevent command injection, and identifiers are handled as variables within awk scripts to ensure safe parsing of retrieved content.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 4, 2026, 10:19 AM
Security Audit — agent-trust-hub — otel-semantic-conventions