oodle-traces

Pass

Audited by Gen Agent Trust Hub on Jun 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill directs the agent to install the oodle CLI via Homebrew from the vendor's official repository (oodle-ai/oodle/oodle).
  • [COMMAND_EXECUTION]: The skill involves executing several oodle traces commands to list service names, filter traces by status or duration, and retrieve detailed span information. These commands are typically used with jq for JSON output processing.
  • [CREDENTIALS_UNSAFE]: The skill references standard authentication methods for the Oodle service, including the use of an OODLE_API_KEY environment variable and the oodle configure initialization command.
  • [PROMPT_INJECTION]: The skill processes external trace and span data from the Oodle APM service, which presents an indirect prompt injection surface.
  • Ingestion points: External trace data enters the context via oodle traces list and oodle traces get command outputs in SKILL.md.
  • Boundary markers: No explicit delimiters or instructions to ignore embedded content are provided when processing trace outputs.
  • Capability inventory: The skill utilizes shell command execution and jq for data manipulation as described in SKILL.md.
  • Sanitization: No specific sanitization or filtering is performed on trace content (such as operation names or error messages) before the agent analyzes it.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 15, 2026, 04:40 PM
Security Audit — agent-trust-hub — oodle-traces