exploring-apm-traces
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes span and trace data from external application services which could potentially contain malicious instructions aimed at influencing the agent's behavior.\n
- Ingestion points: APM trace and span data fetched via tools such as posthog:apm-trace-get and posthog:query-apm-spans, which are then analyzed by the provided Python scripts.\n
- Boundary markers: The SKILL.md instructions do not specify explicit delimiters or "ignore instructions" warnings when the agent reads the output from the parsing scripts.\n
- Capability inventory: The Python scripts (e.g., search_spans.py, print_summary.py) read local JSON results and print span operation names, service names, and OTel attributes directly into the agent's context.\n
- Sanitization: The scripts include a MAX_LEN environment variable to truncate long strings, providing a basic defense against context flooding, but they do not filter the trace content for potential prompt injection patterns.
Audit Metadata