omnibus-instrument-llm-analytics
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill directs the agent to install necessary dependencies using standard package managers such as pip and npm. It specifically recommends running these installations as background tasks to optimize the workflow.
- [INDIRECT_PROMPT_INJECTION]: The skill involves analyzing the user's project codebase, including dependency files and imports, to detect the specific LLM stack. This represents an ingestion of external data to drive the instrumentation logic.
- Ingestion point: Scanning the codebase for LLM provider SDKs and AI frameworks (SKILL.md, Step 1).
- Capabilities: Executing package manager commands (Step 3), writing instrumentation code to project files (Step 4), and configuring environment variables (Step 6).
- Mitigation: The skill focuses on standard, well-known providers and provides static reference documentation for each, minimizing the risk from arbitrary code patterns.
- [SAFE]: The skill follows security best practices by instructing the agent to use environment variables for sensitive project tokens and API keys rather than hardcoding them. All suggested packages and URLs are official resources from the vendor.
Audit Metadata