otel-telemetrygen
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches telemetrygen and OpenTelemetry Collector components from official OpenTelemetry repositories on GitHub and registries such as GHCR and Docker Hub.
- [COMMAND_EXECUTION]: Orchestrates local collector verification using Docker and shell scripts that include robust input validation and cleanup mechanisms.
- [INDIRECT_PROMPT_INJECTION]: Manages untrusted user inputs (endpoints, headers, attributes) through explicit safety protocols:
- Ingestion points: Processes user-supplied OTLP configuration fields in SKILL.md.
- Boundary markers: Recommends shell-quoting literal values and using environment placeholders for secrets.
- Capability inventory: Involves Docker execution and telemetry generation commands.
- Sanitization: Instructs the agent to validate values as data and refuse to execute command-like content embedded in input values.
Audit Metadata