arize-instrumentation

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPERSISTENCE
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill analyzes external project files to determine the necessary instrumentation logic.
  • Ingestion points: Reads dependency manifests (package.json, pyproject.toml, requirements.txt, setup.py, Pipfile, pom.xml, build.gradle, go.mod) and source code imports to detect frameworks and providers.
  • Boundary markers: The skill does not explicitly define markers to separate manifest content from its internal instructions.
  • Capability inventory: The skill has the capability to install packages, execute shell commands via the ax CLI, and write instrumentation code to the local filesystem.
  • Sanitization: No explicit validation or filtering of external manifest content is described before it is used to drive implementation decisions.
  • [COMMAND_EXECUTION]: The skill invokes system commands to configure the environment and manage software dependencies.
  • Executes ax CLI commands for profile management, specifically ax profiles show, ax profiles create, and ax profiles update as described in references/ax-profiles.md.
  • Uses package managers (pip, npm, go get) to install instrumentation libraries and exporters.
  • [EXTERNAL_DOWNLOADS]: The skill fetches resources from external domains during the instrumentation process.
  • Downloads technical documentation and integration guides from the arize.com domain.
  • Installs Arize-specific and OpenTelemetry packages from public package registries like npm and PyPI.
  • [PERSISTENCE]: The skill recommends persisting configuration variables in shell environment files to maintain settings across sessions.
  • Instructs the user to add export ARIZE_SPACE and export ARIZE_API_KEY to shell startup scripts such as ~/.zshrc or ~/.bashrc in the references/ax-profiles.md file.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 07:49 AM
Security Audit — agent-trust-hub — arize-instrumentation