monitoring-observability
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and integrates with well-known technology services including Langfuse, Prometheus, Grafana, and OpenTelemetry. It provides instructions for installing official SDKs and instrumentation packages from public registries such as NPM and PyPI.
- [INDIRECT_PROMPT_INJECTION]: The skill defines templates for automated quality evaluation using "LLM-as-judge" patterns.
- Ingestion points: Untrusted agent responses are processed as input for evaluation prompts in
rules/silent-degraded-quality.md. - Boundary markers: Explicit delimiters for the response content are absent in the provided judge prompt example.
- Capability inventory: The skill utilizes
llm.generateto execute quality evaluation and scoring logic. - Sanitization: No input filtering or escaping is implemented for the data being evaluated.
- [CREDENTIALS_UNSAFE]: The skill demonstrates secure credential handling by referencing environment variables and application configuration objects (e.g.,
settings.LANGFUSE_SECRET_KEY) for API keys. It avoids hardcoding sensitive tokens and follows established secret management best practices for monitoring integrations.
Audit Metadata