tracekit-laravel-sdk

Pass

Audited by Gen Agent Trust Hub on Apr 15, 2026

Risk Level: SAFE
Full Analysis
  • [PROMPT_INJECTION]: The skill contains instructions to streamline the user experience by automating authentication steps ("Do not tell the user to go sign up... manually create an API key before setup"). While these instructions direct the agent to handle certain tasks without immediate user prompting, they are intended to facilitate a vendor-specific authentication flow rather than to bypass safety filters or conceal malicious behavior.
  • [DATA_EXFILTRATION]: The skill references accessing ~/.tracekitconfig and environment variables to manage authentication tokens. It configures the application to transmit telemetry data to https://app.tracekit.dev/v1/traces. These operations are consistent with the stated purpose of an Application Performance Monitoring (APM) tool and involve the vendor's own infrastructure.
  • [EXTERNAL_DOWNLOADS]: The instructions guide the agent to install the tracekit/laravel-apm package using Composer. This is the official SDK provided by the vendor for the Laravel framework.
  • [COMMAND_EXECUTION]: The skill utilizes standard development commands such as composer require and php artisan, as well as a vendor-specific script ./scripts/run-tracekit-auth.sh. These commands are used for package management, configuration publishing, and authentication status verification within the project environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 15, 2026, 12:37 PM