observability

Pass

Audited by Gen Agent Trust Hub on Oct 23, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill implements observability patterns using official OpenTelemetry (OTel) SDKs and components.
  • [DATA_EXPOSURE_PREVENTION]: The skill includes explicit instructions and rules to protect sensitive data. Rule 6 in SKILL.md mandates no personal data in telemetry by default and warns that even opaque IDs can be PII. LOGGING.md provides a list of items that must never be logged, including secrets, API keys, and passwords.
  • [CREDENTIALS_SAFE]: The skill correctly instructs users to keep authentication tokens (like OTEL_EXPORTER_OTLP_HEADERS) in secret stores or environment variables rather than hardcoding them or including them in logs.
  • [NODE_PACKAGES]: The skill references standard, well-known packages from the OpenTelemetry ecosystem, such as @opentelemetry/sdk-node, @opentelemetry/api, and @opentelemetry/auto-instrumentations-node. These are fetched from official registries and used according to documented best practices.
  • [COMMAND_EXECUTION]: Code snippets for instrumentation and health checks (in INSTRUMENT.md and HEALTH.md) use standard Node.js APIs for their intended purposes (e.g., performance.now, Promise.all, AsyncLocalStorage). No arbitrary command execution or shell injection patterns were detected.
  • [EXTERNAL_DOWNLOADS]: All external references point to authoritative documentation (opentelemetry.io, kubernetes.io, sre.google) or well-known technical resources. There are no patterns involving remote script execution or unverifiable downloads.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 23, 2026, 11:53 PM