observability
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements observability patterns using official OpenTelemetry (OTel) SDKs and components.
- [DATA_EXPOSURE_PREVENTION]: The skill includes explicit instructions and rules to protect sensitive data. Rule 6 in
SKILL.mdmandates no personal data in telemetry by default and warns that even opaque IDs can be PII.LOGGING.mdprovides a list of items that must never be logged, including secrets, API keys, and passwords. - [CREDENTIALS_SAFE]: The skill correctly instructs users to keep authentication tokens (like
OTEL_EXPORTER_OTLP_HEADERS) in secret stores or environment variables rather than hardcoding them or including them in logs. - [NODE_PACKAGES]: The skill references standard, well-known packages from the OpenTelemetry ecosystem, such as
@opentelemetry/sdk-node,@opentelemetry/api, and@opentelemetry/auto-instrumentations-node. These are fetched from official registries and used according to documented best practices. - [COMMAND_EXECUTION]: Code snippets for instrumentation and health checks (in
INSTRUMENT.mdandHEALTH.md) use standard Node.js APIs for their intended purposes (e.g.,performance.now,Promise.all,AsyncLocalStorage). No arbitrary command execution or shell injection patterns were detected. - [EXTERNAL_DOWNLOADS]: All external references point to authoritative documentation (opentelemetry.io, kubernetes.io, sre.google) or well-known technical resources. There are no patterns involving remote script execution or unverifiable downloads.
Audit Metadata