tracekit-go-sdk
Pass
Audited by Gen Agent Trust Hub on Apr 15, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to run a local script
./scripts/run-tracekit-auth.shto check for existing authentication and manage the registration flow. This is a standard bootstrapping process for the vendor's service. - [EXTERNAL_DOWNLOADS]: The skill installs the official Go SDK from
github.com/Tracekit-Dev/go-sdk. This is the vendor's authoritative repository and is used for its intended purpose. - [DATA_EXFILTRATION]: As an APM (Application Performance Monitoring) tool, the skill configures the Go application to transmit telemetry data (traces, spans, and error logs) to the vendor's endpoint at
https://app.tracekit.dev/v1/traces. The documentation clearly states that LLM content capture (prompts/completions) is an optional feature requiring explicit environment variable configuration (TRACEKIT_LLM_CAPTURE_CONTENT=true). - [PROMPT_INJECTION]: A static detector flagged a potential concealment pattern regarding the instruction to not prompt the user for manual signup if auth is already present. This is a legitimate UX optimization for the agent's workflow and does not represent a security threat or malicious concealment of actions.
Audit Metadata