observable-gepa-migration
Warn
Audited by Gen Agent Trust Hub on Feb 21, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS] (MEDIUM): The migration guide instructs the user to install
dspy-gepa-loggervia pip. This package is not provided by a trusted organization according to the [TRUST-SCOPE-RULE] and represents an unverifiable dependency. - [DATA_EXFILTRATION] (MEDIUM): The skill configures the agent to transmit internal data, including LM calls (
capture_lm_calls: True) and standard output (capture_stdout: True), to an external endpoint (server_url). If an attacker provides a malicious server URL, sensitive system information or proprietary prompt data could be exfiltrated. - [INDIRECT_PROMPT_INJECTION] (LOW):
- Ingestion points: Processes Language Model calls and console output for logging.
- Boundary markers: None specified; raw data is captured and sent to the observer system.
- Capability inventory: Networking (HTTP POST to server_url).
- Sanitization: No explicit sanitization or filtering of logged content is mentioned in the migration steps.
Audit Metadata