span-timeline-events
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill describes the processing of external OpenTelemetry span event data within the trace view. 1. Ingestion points: Span events are loaded via app/presenters/v3/SpanPresenter.server.ts and queried from ClickHouse in app/v3/eventRepository/clickhouseEventRepository.server.ts. 2. Boundary markers: The timeline rendering logic enforces a filter where only event names starting with trigger.dev/ are processed. 3. Capability inventory: The skill uses Read, Write, Edit, Glob, Grep, and Bash tools to interact with the codebase. 4. Sanitization: Display names and visibility are controlled via getFriendlyNameForEvent() and getAdminOnlyForEvent() in app/utils/timelineSpanEvents.ts.
- [SAFE]: The documentation focuses on internal application architecture and development workflows for the Trigger.dev platform. No malicious patterns, obfuscation, or unauthorized network activity were detected.
Audit Metadata