arize-instrumentation
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPERSISTENCE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill analyzes external project files to determine the necessary instrumentation logic.
- Ingestion points: Reads dependency manifests (
package.json,pyproject.toml,requirements.txt,setup.py,Pipfile,pom.xml,build.gradle,go.mod) and source code imports to detect frameworks and providers. - Boundary markers: The skill does not explicitly define markers to separate manifest content from its internal instructions.
- Capability inventory: The skill has the capability to install packages, execute shell commands via the
axCLI, and write instrumentation code to the local filesystem. - Sanitization: No explicit validation or filtering of external manifest content is described before it is used to drive implementation decisions.
- [COMMAND_EXECUTION]: The skill invokes system commands to configure the environment and manage software dependencies.
- Executes
axCLI commands for profile management, specificallyax profiles show,ax profiles create, andax profiles updateas described inreferences/ax-profiles.md. - Uses package managers (
pip,npm,go get) to install instrumentation libraries and exporters. - [EXTERNAL_DOWNLOADS]: The skill fetches resources from external domains during the instrumentation process.
- Downloads technical documentation and integration guides from the
arize.comdomain. - Installs Arize-specific and OpenTelemetry packages from public package registries like npm and PyPI.
- [PERSISTENCE]: The skill recommends persisting configuration variables in shell environment files to maintain settings across sessions.
- Instructs the user to add
export ARIZE_SPACEandexport ARIZE_API_KEYto shell startup scripts such as~/.zshrcor~/.bashrcin thereferences/ax-profiles.mdfile.
Audit Metadata