testland/jaeger-trace-tests
Author integration tests that query a tracing backend for cross-service trace verification - Jaeger, Zipkin, or Grafana Tempo, same run-query-assert workflow. Jaeger all-in-one Docker for CI (OTLP gRPC :4317 + HTTP :4318 ingest, query API on :16686), `/api/traces?service=X&operation=Y` query patterns, span set + parent-child + duration assertions; Zipkin (:9411 REST API, B3 single/multi-header propagation tests, dependency graph) in references/zipkin.md; Tempo (TraceQL span selectors + structural operators, /api/search, single-binary Docker) in references/tempo.md. Use when verifying that a request produces the expected spans across service boundaries in a running Jaeger, Zipkin, or Tempo backend.
74
93%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
Low
Low-risk findings.
2 low severity findings. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
At runtime the workflow issues unauthenticated HTTP reads to the tracing backend query endpoints (e.g., Jaeger `GET /api/traces` at `http://localhost:16686/api/traces?service=...&operation=...` after flushing), but the only outsider-authored text that reaches the LLM is the backend’s trace/tag values it returns (which are ultimately derived from submitted spans, not from free-text sources like email/chat/issue bodies).
Where we found it
localhost:16686
domain · 1 site
The plugin queries the Jaeger query API at localhost:16686 and acts on the returned trace/span JSON data.
SKILL.md
93
http://localhost:16686/api/traces
localhost:3200
domain · 2 sites
The plugin queries the Grafana Tempo HTTP API at localhost:3200 and acts on the returned trace data.
references/tempo.md
38
http://localhost:3200/ready
references/tempo.md
84
http://localhost:3200/api/search
localhost:9411
domain · 4 sites
The plugin queries the Zipkin REST API at localhost:9411 and acts on the returned trace/dependency data.
references/zipkin.md
41
http://localhost:9411/api/v2/spans
references/zipkin.md
50
http://localhost:9411/api/v2/traces
references/zipkin.md
80
http://localhost:9411/api/v2/trace/{trace_id}
references/zipkin.md
91
http://localhost:9411/api/v2/dependencies
W012: Unverifiable external dependency detected (runtime URL that controls agent).
What this means
The skill fetches instructions or code from an external URL at runtime, and the fetched content directly controls the agent’s prompts or executes code. This dynamic dependency allows the external source to modify the agent’s behavior without any changes to the skill itself.
Why it was flagged
The skill runs Docker images at runtime (pull + run) which execute remote code — e.g. cr.jaegertracing.io/jaegertracing/jaeger:2.17.0, grafana/tempo:latest, and openzipkin/zipkin are pulled/executed by the provided docker run/service instructions.
Where we found it
cr.jaegertracing.io/jaegertracing/jaeger:2.17.0
dependency · 3 sites
The plugin instructs docker run/service to pull and execute this Jaeger all-in-one image at runtime, executing remote code from the cr.jaegertracing.io registry.
SKILL.md
45
cr.jaegertracing.io/jaegertracing/jaeger:2.17.0
references/query-api-and-ci-wiring.md
68
image: cr.jaegertracing.io/jaegertracing/jaeger:2.17.0
101
cr.jaegertracing.io/jaegertracing/jaeger:2.17.0 \
grafana/tempo:latest
dependency · 1 site
The plugin instructs docker run to pull and execute the grafana/tempo:latest image at runtime, executing remote code from Docker Hub.
references/tempo.md
36
grafana/tempo:latest -target=all -config.file=/etc/tempo.yaml
openzipkin/zipkin
dependency · 2 sites
The plugin instructs docker run/service to pull and execute the openzipkin/zipkin image at runtime, executing remote code from Docker Hub.
references/zipkin.md
14
docker run -d -p 9411:9411 openzipkin/zipkin
references/zipkin.md
20
image: openzipkin/zipkin
- Audited
- Security analysis