otel-go
Pass
Audited by Gen Agent Trust Hub on May 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches release metadata and changelogs from official OpenTelemetry GitHub repositories.
- Evidence:
SKILL.mdprovides instructions to usegh apiandWebFetchto retrieve data from theopen-telemetryorganization. - [COMMAND_EXECUTION]: The skill utilizes the GitHub CLI to query repository information.
- Evidence:
SKILL.mdcontainsgh apicommands to fetch latest release tags and git references. - [PROMPT_INJECTION]: The skill processes external data from GitHub, which represents an indirect prompt injection surface.
- Ingestion points:
SKILL.md(fetching of changelogs and metadata viaWebFetchandgh api). - Boundary markers: Absent; no delimiters or instructions to ignore embedded content are specified for the fetched data.
- Capability inventory: Shell execution (via
ghtool) and network access (viaWebFetch). - Sanitization: None; the retrieved content is processed directly by the agent.
Audit Metadata