opik-external-integrations
Build or update an Opik integration that lives OUTSIDE this repo — a standalone opik-* package (e.g. opik-openclaw, opik-claude-code-plugin) or Opik support contributed into a third-party project (e.g. LiteLLM, Dify). Use ONLY when the user names an external repository or external package as the target; for integrations under sdks/ use the opik-integrations skill instead.
76
96%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
Low
Low-risk findings.
2 low severity findings. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
The required runtime workflow explicitly clones/acquires an external host repo (e.g., any GitHub URL provided by the user) and then runs “Investigate the host / Implement / Test / Document” against that checkout, which will cause outsider-authored free text from the host repo (README/CONTRIBUTING/docs/code comments and other prose) to be read and ingested by the agent while planning and writing the integration.
W012: Unverifiable external dependency detected (runtime URL that controls agent).
What this means
The skill fetches instructions or code from an external URL at runtime, and the fetched content directly controls the agent’s prompts or executes code. This dynamic dependency allows the external source to modify the agent’s behavior without any changes to the skill itself.
Why it was flagged
The skill explicitly instructs the agent to "acquire the repo: clone/checkout into the scratchpad" and to "start from" concrete GitHub repos (e.g. https://github.com/comet-ml/opik-openclaw listed in references.md), meaning these external repository URLs would be fetched and the fetched code built/run during skill execution, which results in executing remote code at runtime.
- Repository
- comet-ml/opik
- Commit
aae4650
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.