instrument-logs
Pass
Audited by Gen Agent Trust Hub on May 19, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs standard OpenTelemetry SDKs and OTLP exporters from official package registries like NPM and PyPI to enable log instrumentation. These are verified libraries from a well-known observability framework.\n- [COMMAND_EXECUTION]: Uses local package managers (npm, pip, go, etc.) to install necessary dependencies. It also performs safe environment discovery to identify the application's framework and existing logging setup.\n- [DATA_EXFILTRATION]: Configures the application to export log data to PostHog's official ingestion endpoints (posthog.com). This behavior is the explicit and documented purpose of the skill and follows standard OTLP protocols.\n- [PROMPT_INJECTION]: The skill analyzes project source code and pull request data to determine the platform and logging configuration. While this creates a surface for indirect prompt injection from untrusted data, the skill's capabilities are appropriately restricted to adding logging instrumentation.\n- [SAFE]: Secret management practices are sound; the skill avoids hardcoding credentials, opting for environment variables and using the PostHog MCP server's projects-get tool to securely retrieve API tokens.
Audit Metadata