instrument-logs
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill automates the installation of logging dependencies using standard package managers like npm, pip, go, and maven. All referenced packages are official SDKs from the OpenTelemetry project or the vendor's own verified repositories.
- [COMMAND_EXECUTION]: To set up the logging environment, the skill executes common package management commands to install the necessary libraries for the detected programming language or framework.
- [INDIRECT_PROMPT_INJECTION]: The skill analyzes local codebase files (such as dependency manifests and source code) to determine the existing logging setup and platform, which constitutes an ingestion surface for potentially untrusted data. This is a necessary function for the skill's purpose of automated instrumentation.
- [DATA_EXFILTRATION]: The skill configures an OpenTelemetry (OTLP) exporter to transmit application logs to the vendor's ingestion endpoints. This behavior is the primary intended function and is documented clearly.
- [CREDENTIALS_UNSAFE]: While the skill handles sensitive project tokens, it correctly instructs the agent to retrieve them via secure MCP tools or user prompts and store them in environment variable files rather than hardcoding them in the application source code.
Audit Metadata