signoz-reducing-telemetry-cost
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external telemetry data (logs and traces) via tools such as
signoz_search_logsandsignoz_aggregate_traces(SKILL.md). This data-processing surface is susceptible to indirect prompt injection if log bodies or span attributes contain adversarial instructions. However, the risk is mitigated as the skill's capabilities are restricted to read-only diagnostic queries and reporting, with no automated write actions or external network exfiltration capabilities. No explicit sanitization or boundary markers are defined for the ingested telemetry chunks. - [SAFE]: The skill uses official vendor tools (
signoz_*) and references official documentation (signoz.io) to perform its stated purpose of cost optimization. It implements mandatory 'do-not-drop' guards to protect critical infrastructure metrics, demonstrating a security-conscious design for its intended domain.
Audit Metadata