instrument-logs
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute standard package manager commands (e.g.,
npm install,pip install,go get,yarn add,npx expo install) to add OpenTelemetry and PostHog libraries to the user's project. - [EXTERNAL_DOWNLOADS]: The skill facilitates the download of well-known monitoring and logging libraries from official registries (npm, PyPI, Maven, etc.) and configures application telemetry to be sent to PostHog's ingestion endpoints (e.g.,
us.i.posthog.com). - [INDIRECT_PROMPT_INJECTION]: The skill analyzes local codebase files, including manifest files (like
package.jsonorrequirements.txt) and source code, to determine the project's platform and logging architecture. This creates a surface where malicious codebase content could theoretically influence agent behavior, though the skill's instructions are narrowly focused on instrumentation. - Ingestion points: Project configuration files (e.g.,
package.json,Podfile,go.mod,pom.xml,requirements.txt) and application source code. - Boundary markers: Not explicitly defined in the skill instructions.
- Capability inventory: File system read/write access, command-line execution for package management, network communication via SDKs, and access to PostHog MCP tools.
- Sanitization: The skill does not explicitly describe sanitization of the analyzed codebase content.
Audit Metadata