instrument-tracing
Pass
Audited by Gen Agent Trust Hub on Nov 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the official OpenTelemetry Java agent directly from GitHub (
https://github.com/open-telemetry/opentelemetry-java-instrumentation/releases/latest/download/opentelemetry-javaagent.jar) to provide zero-code instrumentation. - [COMMAND_EXECUTION]: Instructions involve executing standard package manager commands (e.g.,
npm install,pip install,go get,composer require) and runtime commands (e.g.,opentelemetry-bootstrap -a install,java -javaagent:...) to set up tracing infrastructure. - [INDIRECT_PROMPT_INJECTION]: The skill analyzes untrusted codebase files to determine the project stack and configuration.
- Ingestion points: Project configuration and dependency files such as
package.json,requirements.txt,go.mod, etc. - Boundary markers: Absent; the skill scans the entire project structure.
- Capability inventory: The skill possesses the ability to install packages, write to environment files, and modify application source code.
- Sanitization: Absent; it relies on the agent's internal logic to parse codebase metadata.
- [DATA_EXFILTRATION]: The skill configures applications to send trace data to PostHog's ingestion endpoints (
https://us.i.posthog.com/i/v1/tracesorhttps://eu.i.posthog.com/i/v1/traces). This behavior is consistent with the skill's primary purpose and targets the vendor's own infrastructure.
Audit Metadata