otel-upgrade

Pass

Audited by Gen Agent Trust Hub on Sep 4, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill directs the agent to query authoritative package registries (including NPM, PyPI, Go, Maven, RubyGems, and NuGet) and official GitHub repositories within the open-telemetry organization. These operations are used to retrieve stable release versions, distribution manifests, and migration notes from well-known sources relevant to the skill's purpose.
  • [COMMAND_EXECUTION]: The workflow involves executing standard package manager commands (e.g., go list, npm view, python -m pip index) and the OpenTelemetry Collector Builder (ocb version) to verify environment metadata and available versions.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted project files such as manifests, lockfiles, and configurations to assess upgrade feasibility. It includes instructions to run validation steps like compilation and tests to verify compatibility. The potential risk of malicious instructions in these files is addressed by the explicit instruction to perform these checks in an isolated environment (such as a temporary copy or worktree) and the requirement to resolve configurations without exposing secrets.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 4, 2026, 10:19 AM
Security Audit — agent-trust-hub — otel-upgrade