The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Recommends the installation of standard observability and telemetry packages from official registries, including @langfuse/otel, langsmith, @opentelemetry/sdk-node, and @assistant-ui/react-o11y.
[DATA_EXFILTRATION]: Configures the transmission of telemetry and tracing data (prompts, completions, and metadata) to well-known observability providers such as Langfuse, LangSmith, and Helicone. This behavior is consistent with the skill's primary stated purpose.
[CREDENTIALS_UNSAFE]: Promotes secure secret management by utilizing environment variables (e.g., process.env.HELICONE_API_KEY, process.env.LANGSMITH_API_KEY) to manage authentication tokens, avoiding the use of hardcoded credentials.
[PROMPT_INJECTION]: The skill provides a surface for indirect prompt injection by ingesting trace data (spans) for visualization within a React-based user interface. This is a common characteristic of observability tools.
Ingestion points: The TraceView component and SpanResource utility (documented in SKILL.md and references/react-o11y.md) process raw span data for display.
Boundary markers: The provided code snippets do not explicitly define boundary markers or instructions to ignore embedded content within the traces.
Capability inventory: The skill focuses on UI rendering and telemetry forwarding; it does not include dangerous capabilities such as arbitrary shell command execution, sensitive file system access, or uncontrolled network operations.
Sanitization: Rendering is performed using React components, which provides inherent protection against common cross-site scripting (XSS) attacks by escaping text content by default.

observability