exploring-apm-traces
Pass
Audited by Gen Agent Trust Hub on Nov 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a set of Python scripts in the
scripts/directory (e.g.,print_summary.py,print_timeline.py,extract_span.py) and instructs the agent to execute them to parse JSON trace data. These scripts use standard Python libraries to perform structural analysis and summarization of the data, providing a legitimate way to handle large payloads that would otherwise exceed the agent's context window.- [INDIRECT_PROMPT_INJECTION]: The skill processes external data from OpenTelemetry spans and traces. This ingestion of untrusted data represents a standard surface for indirect prompt injection. The risk is mitigated by the skill's workflow, which uses dedicated parsing scripts to provide structured insights to the agent rather than exposing it to raw, unparsed content. - Ingestion points: JSON files containing results from the
posthog:apm-trace-gettool, which are persisted to disk when large. - Boundary markers: The agent is guided to use the structured output of the provided Python scripts to explore the data.
- Capability inventory: PostHog APM tools and local execution of the included Python analysis scripts.
- Sanitization: The scripts perform data extraction, filtering, and summarization; they do not execute or evaluate strings found within the trace attributes.
Audit Metadata