beacon
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides detailed guidance on implementing observability best practices without incorporating executable malicious code. All provided code snippets in the references are documentation templates intended for manual or agent-assisted implementation in the user's environment.
- [DATA_EXPOSURE]: The skill explicitly addresses data privacy concerns. In
reference/logging-design.md, it mandates source-side PII scrubbing for sensitive keys such as passwords, tokens, and credit card numbers. It also warns against including prompt/response content in telemetry spans to prevent PII leaks. - [INDIRECT_PROMPT_INJECTION]: While the skill defines a surface for processing external data (logs, traces, postmortems), it mitigates indirect injection risks by recommending structured JSON schemas, strict boundary markers (such as W3C TraceContext), and human-in-the-loop review for AI-generated incident reports.
- [COMMAND_EXECUTION]: The skill identifies tools and commands (e.g.,
kubectl,otelcol,promtool) as part of its SRE workflows. These are used in a descriptive context within runbook templates and do not represent arbitrary command execution by the skill itself. - [EXTERNAL_DOWNLOADS]: All external references and domains (e.g.,
opentelemetry.io,grafana.com,pagerduty.com,openslo.com) are well-known, trusted industry sources related to the skill's primary purpose.
Audit Metadata