Copilot Otel Metrics

title: Copilot OTel Metrics Skill Security Model description: STRIDE threat model for the copilot-otel-metrics skill organized by assets, adversaries, and trust buckets (editor OTLP ingest, telemetry at rest, reference helper scripts, container image supply chain, editor-global configuration mutation, host process control, cloud control-plane artifact generation) with in-design mitigations and acknowledged enterprise readiness gaps author: microsoft/hve-core ms.date: 2026-09-05 ms.topic: reference estimated_reading_time: 18 keywords:

• security

• STRIDE

• copilot-otel-metrics

• opentelemetry

• threat model

<!-- markdownlint-disable-file -->

Copilot OTel Metrics Skill Security Model

This document records the STRIDE threat model for the copilot-otel-metrics skill. The shipped runtime is examples/compose.yaml (the local stack definition), examples/otel-collector-local.yaml (the local filtering pipeline), two Grafana dashboards under examples/dashboards/, five reference helper scripts and one shared policy module under examples/, and the Azure templates under examples/azure/ (fleet collector configuration, the per-workstation relay under agent-host-relay/, Bicep, Terraform, and an Azure CLI script). The model is organized by trust bucket: editor OTLP ingest (B1), telemetry at rest and its query surfaces (B2), reference helper scripts to local service APIs (B3), container image supply chain (B4), editor-global configuration mutation (B5), host process control (B6), and cloud control-plane artifact generation (B7). Each bucket enumerates all six STRIDE categories. Assets and adversaries are enumerated first. Acknowledged enterprise readiness gaps are listed at the end.

The skill is an assistant rather than a reference pack, and that changes the model materially. It may write the user's global settings.json after presenting a diff and obtaining explicit approval, and it generates files intended for the user to execute. It never starts a service and never provisions infrastructure: docker compose, az deployment, and terraform apply are handed to the user, not run. Buckets B5 through B7 exist because generating and writing are themselves exposures, independent of who runs the result.

See also: repo-wide STRIDE model. This skill participates in the repository-wide threat model at docs/security/security-model.md and is registered in its Skill Security Models section. The seven buckets below are enumerated there as the OT threat family in § Copilot Telemetry Skill Threats; that section is authoritative for the current membership of the family. Each OT row derives its Likelihood, Impact, and Residual Risk from the risk-rating tables in this document wherever they rate the same failure mode, and marks any rating it does not inherit as a new assessment with a stated basis.

Executive Summary

The copilot-otel-metrics skill helps an operator turn on GitHub Copilot Chat's OTLP export and stand up somewhere for the data to land, locally or in Azure. Its highest-risk property is not the code, it is the payload. Spans emitted by the extension were directly observed carrying full prompt text, tool call arguments and results, and system instructions, on a configuration where content capture was left at its default. Anyone who follows this skill therefore accumulates a durable corpus of prompt content, in a Docker volume locally or in a billed Log Analytics workspace for an organization.

That exposure is not harmless and is not accepted silently. Both capture paths filter before storage, and they filter the same way. The local path routes every export through an OpenTelemetry Collector whose attribute policy is a fail-closed allow-list, so an attribute this skill has never seen is dropped rather than stored. The fleet path applies that same allow-list and the same content scrub to traces, metrics, and logs. The direction matters: the delete-list this configuration previously used removed the content attributes someone already knew about and passed through the one a future extension release adds, and it did not run on the metrics pipeline at all. Under the organization topology telemetry is filtered twice, once by the workstation relay before it leaves the machine and again by the fleet Collector before shared storage. What filtering cannot change is what the extension emits, so content still leaves the editor and still crosses the loopback hop in plaintext. The skill states the same position everywhere it appears: the endpoint is sensitive regardless of the captureContent setting, and the user owns the decision.

How far the local filtering reaches is measured, not asserted. tests/test_collector_carriers.py starts the pinned Collector with the shipped configuration, sends payloads placing a distinct marker in each of 28 OTLP carriers, and records what survives. Every claim about local minimization in this document is that module's output. Its method matters as much as its result: a paired run with the content processors removed establishes that the instrument would have rendered each marker had it survived, so a carrier is never called governed merely because its marker was absent. The map is asserted, so a configuration or image change that opens a carrier fails the suite.

That measurement corrected this document. The allow-list governs attributes at every level and a map-valued log body; it does not reach span names, span status messages, span event names, trace state, non-map log bodies, severity text, log event names, metric metadata, span link attributes, or metric exemplar attributes. The content scrub closes the reachable carriers that no shipped consumer needs: the pinned OTLP/HTTP carrier suite confirms that nonmatching span names plus metric descriptions and units are replaced with [redacted], while the dashboard-derived span-name family and metric names survive. Span links and exemplars remain open because this Collector distribution provides no known way to reach them, and instrumentation scope and schema fields remain open on an expectation about emitter behavior rather than on a control.

The design bounds the local case by construction: a filtering Collector is the only OTLP listener published on the host, its attribute policy is a fail-closed allow-list rather than a delete-list, every published port binds to 127.0.0.1, both images are pinned by manifest digest, Grafana requires an operator-supplied credential with anonymous access disabled, the documented settings block omits captureContent, and the skill supplies a verification command so a reader checks rather than assumes. Residual risk concentrates in four places the skill cannot close: the extension's own span content behavior before the Collector sees it, the carriers the Collector governs incompletely or not at all, the absence of authentication on the Prometheus and Tempo query APIs, and the lack of encryption on the persistent volume.

The assistant behaviors add three bounded exposures. The settings write mutates a user-owned JSONC file, which is contained by an executable that enforces a verified schema, splices only the target value span, backs up before writing without overwriting an earlier backup, stages the result and swaps it in atomically so a failed write leaves the original rather than a truncated file, and refuses to write when unrelated settings would change. Generated compose and IaC files are inert until the user runs them, and the agent is prohibited from running them. Organization capture places a shared write-side credential on every workstation with no per-user binding and no documented in-place rotation, which is the single largest new exposure and is the reason the Azure path leads with that fact rather than with the architecture. Holding that credential in the relay's own runtime environment keeps it out of the editor's environment and out of every agent-spawned subprocess, at the cost of making relay health a prerequisite for all of that workstation's telemetry.

Security Posture Overview

Contents

• System Description

• Trust Boundaries

• Assets

• Adversaries

• Bucket B1: Editor OTLP ingest

• Bucket B2: Telemetry at rest and query surfaces

• Bucket B3: Reference helper scripts to local service APIs

• Bucket B4: Container image supply chain

• Bucket B5: Editor-global configuration mutation

• Bucket B6: Host process control

• Bucket B7: Cloud control-plane artifact generation

• Enterprise Readiness Gaps

• References

System Description

Components

1. examples/compose.yaml — declares a Collector container publishing the only loopback-bound OTLP ports and one grafana/otel-lgtm container with no host OTLP mapping, joined by an explicit bridge network, mounting an external named volume at /data with a separate project-managed volume over Grafana's database at /data/grafana/data, requiring operator-supplied Grafana credentials with anonymous access disabled, and passing delta-to-cumulative conversion plus 120-day retention to Prometheus. Both images are digest-pinned, and the Collector service declares a memory limit, a read-only root filesystem, all capabilities dropped, and no-new-privileges.

2. examples/otel-collector-local.yaml — the local Collector pipeline. Applies a fail-closed redaction allow-list across the trace, metric, and log pipelines, masks recognizable credential shapes in surviving values, scrubs the content carriers the allow-list cannot reach, and exports only to the LGTM service over the internal network. What each of its controls actually reaches is recorded by tests/test_collector_carriers.py rather than inferred from the configuration.

3. examples/dashboards/copilot-otel.json — Grafana dashboard referencing the pre-provisioned prometheus and tempo datasource uids. Contains PromQL and TraceQL queries only.

4. examples/_input_policy.py — shared, not run directly. Centralizes endpoint scheme, authority, port, remote opt-in, redirect revalidation, path containment, and required-credential checks for the helpers that take configurable input.

5. examples/verify.py — read-only. Queries Grafana, Prometheus, and Tempo health plus stored signal presence. Exits non-zero when the stack is unhealthy. Takes no configurable endpoint.

6. examples/baseline.py — read-mostly. Snapshots Prometheus label values and Tempo trace names, writes one JSON file contained to the user cache root, and diffs a later store state against it.

7. examples/inspect_metrics.py — read-only. Enumerates copilot_chat and gen_ai series with labels and current values. Takes no configurable endpoint.

8. examples/validate_dashboard.py — imports a dashboard through the Grafana API with overwrite: true, then replays each panel query against Prometheus or Tempo. Every configurable endpoint and the dashboard path pass the shared policy first, and Grafana credentials are required with no default.

9. examples/settings_upsert.py — the settings mutation executable. Enforces a schema verified against a named extension build, splices only target value spans, backs up while retaining the five newest backups, stages the result and replaces the target atomically so a failed write leaves the original intact, and appends a redacted audit record whose endpoint summary carries no userinfo.

10. examples/dashboards/copilot-otel-azure.json — Grafana dashboard for the Azure path. Contains KQL queries against Log Analytics only.

11. examples/azure/otel-collector-config.yaml — fleet OpenTelemetry Collector pipeline. Requires active bearer authentication and TLS material from the environment, applies the local stack's fail-closed allow-list and content scrub to traces, metrics, and logs, labels the deployment environment after filtering, and exports to Application Insights using a connection string read from the environment.

12. examples/azure/agent-host-relay/ — the per-workstation relay: an OTLP/HTTP loopback receiver, the same filtering policy applied to every signal, and an exporter that authenticates with the fleet ingest token and verifies the fleet receiver's certificate against an operator-supplied CA bundle mounted read-only. Its Compose service is digest-pinned, restart-managed independently of VS Code, memory-limited, read-only, capability-dropped, and reads every runtime input from an operator-owned environment file outside this repository.

13. examples/azure/main.bicep, main.tf, variables.tf, outputs.tf, versions.tf, deploy.sh — templates that create a per-environment Log Analytics workspace, Application Insights component, Azure Monitor dashboard, and an optional workspace-scoped Monitoring Reader role assignment. Inert until an operator deploys them.

14. tests/ — static and behavioral tests over the local configuration, the shared policy, the settings executable, and the Azure templates, plus a fuzz harness and one runtime module. Most parse committed files and temporary fixtures. tests/test_collector_carriers.py is marked slow and does start disposable containers: the pinned Collector for the carrier map, and a relay plus an ephemeral TLS receiver for the forwarding evidence. Nothing in the suite contacts a cloud or uses a real credential.

15. SKILL.md and references/ — the instructional surface. It authorizes exactly two write behaviors: a diff-approved per-key upsert into the user's global settings.json, and writing generated artifacts to disk.

Data Flow

flowchart TD
    subgraph AGENT["Copilot agent running this skill (trust zone)"]
        SKILL["SKILL.md and references"]
        WRITE["Diff-approved settings upsert"]
        GEN["Generated artifacts:<br/>compose, dashboards, IaC"]
    end
    subgraph EDITOR["VS Code process (operator trust zone)"]
        EXT["Copilot Chat extension<br/>OTel exporter"]
        SETTINGS["Global settings.json<br/>(application-scoped, default profile)"]
    end
    subgraph HOST["Operator workstation, loopback only (trust zone)"]
        HELPERS["verify.py / baseline.py<br/>inspect_metrics.py / validate_dashboard.py"]
        SNAP["~/.cache/copilot-otel/<br/>pre-enable-baseline.json"]
    end
    subgraph STACK["Local stack (trust zone)"]
        LCOLL["OTel Collector<br/>:4318 / :4317 loopback<br/>fail-closed allow-list"]
        OTLP["LGTM OTLP receiver<br/>internal network only"]
        PROM["Prometheus :9090"]
        TEMPO["Tempo :3200"]
        GRAF["Grafana :3000<br/>(credential required)"]
        VOL[("copilot-otel-data<br/>volume /data")]
    end
    subgraph REGISTRY["Public container registry (external)"]
        IMG["grafana/otel-lgtm:0.29.2"]
    end
    subgraph AZURE["Azure subscription (external, operator-owned)"]
        COLL["OpenTelemetry Collector<br/>holds the connection string"]
        AI["Application Insights"]
        LAW[("Log Analytics workspace")]
        AMD["Azure Monitor dashboards<br/>with Grafana"]
    end
    SKILL --> WRITE
    SKILL --> GEN
    WRITE -->|"per-key upsert after approved diff"| SETTINGS
    GEN -.->|"written to disk, never executed by the agent"| HOST
    GEN -.->|"deployed by the operator"| AZURE
    SETTINGS -->|"configures endpoint"| EXT
    EXT -->|"OTLP/HTTP plaintext, spans carrying prompt content"| LCOLL
    LCOLL -->|"allow-listed attributes only, internal network"| OTLP
    EXT -->|"OTLP over TLS, fleet path"| COLL
    OTLP -->|"metrics"| PROM
    OTLP -->|"traces"| TEMPO
    PROM -->|"persists"| VOL
    TEMPO -->|"persists"| VOL
    GRAF -->|"PromQL / TraceQL"| PROM
    GRAF -->|"TraceQL"| TEMPO
    HELPERS -->|"HTTP GET, unauthenticated"| PROM
    HELPERS -->|"HTTP GET, unauthenticated"| TEMPO
    HELPERS -->|"HTTP POST dashboard import, basic auth"| GRAF
    HELPERS -->|"writes snapshot"| SNAP
    COLL -->|"connection string, content attributes stripped"| AI
    AI -->|"persists"| LAW
    AMD -->|"KQL, current-user auth"| LAW
    IMG -.->|"docker pull, digest-pinned"| STACK

Trust Boundaries

Boundary Diagram

┌────────────────────────────────────────────────────────────────┐
│ TRUST BOUNDARY: Copilot agent running this skill               │
│   writes settings (diff-approved) · writes generated files     │
│   NEVER starts a service · NEVER provisions infrastructure     │
└───────────┬──────────────────────────────┬─────────────────────┘
            │ per-key upsert               │ file writes only
┌───────────▼──────────────────────────────▼─────────────────────┐
│ TRUST BOUNDARY: Operator workstation                           │
│                                                                │
│  ┌──────────────────┐         ┌────────────────────────────┐   │
│  │ VS Code +        │         │ Reference helper scripts   │   │
│  │ Copilot Chat     │         │ (stdlib only, loopback)    │   │
│  │ global settings  │         │                            │   │
│  └────────┬─────────┘         └─────────────┬──────────────┘   │
│           │ OTLP/HTTP                       │ HTTP             │
│           │ prompt-bearing spans            │ queries          │
│  ─────────┼─────────────────────────────────┼───────────────   │
│           │   127.0.0.1 ONLY (no off-host listener)            │
│  ┌────────▼─────────────────────────────────────────────────┐  │
│  │ OTel Collector — the only published OTLP listener        │  │
│  │ fail-closed allow-list; unknown attributes dropped       │  │
│  └────────┬─────────────────────────────────────────────────┘  │
│           │ internal network, no host mapping                  │
│  ┌────────▼─────────────────────────────────────────────────┐  │
│  │ TRUST BOUNDARY: otel-lgtm container                      │  │
│  │  ┌──────────┐ ┌──────────┐ ┌────────┐ ┌───────────────┐  │  │
│  │  │ OTLP recv│ │Prometheus│ │ Tempo  │ │ Grafana       │  │  │
│  │  │ internal │ │  :9090   │ │ :3200  │ │ :3000 auth'd  │  │  │
│  │  └────┬─────┘ └────┬─────┘ └───┬────┘ └───────────────┘  │  │
│  │       └────────────┴───────────┘                         │  │
│  │                    │ persists                            │  │
│  │        ┌───────────▼────────────┐                        │  │
│  │        │ copilot-otel-data vol  │ prompt content at rest │  │
│  │        │ (unencrypted, 120d)    │ traces expire at 336h  │  │
│  │        └────────────────────────┘                        │  │
│  └──────────────────────────────────────────────────────────┘  │
└───────────────────────────┬────────────────────────────────────┘
                            │ image pull (digest-pinned)
              ┌─────────────▼───────────────┐
              │ TRUST BOUNDARY: public      │
              │ container registry          │
              └─────────────────────────────┘

  Organization path only, operator-deployed:
              ┌──────────────────────────────────────────────┐
              │ TRUST BOUNDARY: Azure subscription           │
              │  Collector (holds fleet write credential)    │
              │       │                                      │
              │  App Insights ──▶ Log Analytics ──▶ Grafana  │
              │  content attributes stripped at the collector│
              └──────────────────────────────────────────────┘

Boundary Descriptions

Assets

Adversaries

Bucket B1: Editor OTLP ingest

Covers the path from the Copilot Chat exporter to the container's OTLP receiver.

Spoofing

The OTLP receiver performs no authentication. Any process able to reach 127.0.0.1:4318 can submit spans and metrics using the copilot-chat service name and genuine Copilot metric names, making injected series indistinguishable from real editor output by inspection alone. examples/baseline.py exists specifically to make this detectable after the fact: it captures the pre-enablement store state and reports discriminators that require real editor activity. Detection, not prevention. Tracked as G-SPF-1.

Tampering

An unauthenticated writer can also poison existing series by submitting conflicting samples for the same metric and label set. The stack applies no ingest-side validation or allow-listing. Loopback binding limits this to local processes.

Repudiation

The receiver records no provenance for accepted payloads beyond the resource attributes the sender chooses to supply, so a submitting process cannot be identified after ingest. service_version and session_id label values are attacker-controlled in the injection case. baseline.py diffing provides a coarse before-and-after record rather than per-payload attribution, and it depends on session.id surviving the allow-list: the attribute is allow-listed for exactly that reason, and the runtime harness asserts per key that the running Collector keeps it.

Information Disclosure

This is the material risk in the entire model. Spans emitted with content capture left at its documented default were directly observed carrying copilot_chat.user_request (full prompt text), gen_ai.input.messages, gen_ai.output.messages, gen_ai.tool.call.arguments, gen_ai.tool.call.result, and gen_ai.system_instructions in plaintext. A seventh, copilot_chat.reasoning_content, was present but marked [encrypted]. The transport is plaintext HTTP. On loopback this is contained; the moment otlpEndpoint is redirected to a shared or hosted collector, prompt content leaves the machine in clear text. The skill documents this discrepancy explicitly and supplies a curl check so a reader verifies rather than trusts the documented default. Tracked as G-INF-1 and G-TLS-1.

What the Collector does about it downstream is measured by tests/test_collector_carriers.py against the pinned image, with a paired control run establishing that each marker is renderable before any of them is called governed:

The open rows differ in kind, and the difference decides whether any of them can be closed. Three dashboard TraceQL queries require the invoke_agent.* span-name family, baseline.py reads Tempo's rootTraceName as its injection discriminator, and every Prometheus query in the shipped dashboard selects by metric name. The pinned OTLP/HTTP carrier suite confirms that those identities survive while nonmatching span names, metric descriptions, and metric units are replaced with [redacted]. Span links and metric exemplars remain open by capability: verified against the pinned image, OTTL has no spanlink context and refuses to index links, and assigning to datapoint.exemplars parses without effect, so no processor in this distribution reaches them.

The scope and schema fields are open by low expected content, which is the weakest of the three justifications and is recorded as G-INF-11 rather than waved past. In normal operation they carry a library name, a version, and a specification URL. That is a statement about what a well-behaved emitter sends, not a control: the receiver is unauthenticated, these fields are attacker-settable by any local process that can reach it, and the harness shows no processor filters them. The same reasoning shape — this field carries identity, not content — is what the harness disproved for span links, so it is registered as a gap on the same footing as the others instead of resting on the argument alone.

One further boundary: the harness probes the OTLP/HTTP receiver. The shipped configuration also publishes OTLP/gRPC, which is unprobed and recorded as G-INF-10.

Denial of Service

Prometheus drops delta-temporality metrics by default, and a dropped delta metric was observed failing an entire batched write, discarding co-batched cumulative metrics. compose.yaml sets --enable-feature=otlp-deltatocumulative so conversion replaces dropping. The conversion state is held in memory and resets when the container restarts, producing a bounded gap rather than a persistent failure. Unauthenticated ingest also permits volumetric flooding of the local store by a local process. Tracked as G-DOS-1.

Elevation of Privilege

Not applicable. The receiver executes no submitted content; OTLP payloads are parsed as data into the metric and trace stores, and no code path evaluates them.

Risk Rating

Bucket B2: Telemetry at rest and query surfaces

Covers the persistent volume, Prometheus, Tempo, and the Grafana UI.

Spoofing

Grafana no longer runs on a published default. The compose file disables anonymous access, restores the login form, and requires COPILOT_OTEL_GRAFANA_USER and COPILOT_OTEL_GRAFANA_PASSWORD through the ${VAR:?message} form, so the stack fails to start rather than coming up on a credential everyone knows. This matters more than it appears: the pinned image enables anonymous access with the Admin role by default, so the previous configuration exposed every panel and every stored prompt fragment to anything that could reach port 3000 without presenting a credential at all. Prometheus and Tempo still expose no authentication, and loopback binding remains their only control. Tracked as G-SPF-1.

Tampering

A Grafana administrator can alter or delete dashboards and datasource definitions. examples/validate_dashboard.py performs exactly this operation with overwrite: true, which is intended for a dashboard the operator is checking but would overwrite an unrelated dashboard occupying the same uid. The helper refuses a non-loopback Grafana unless the operator sets COPILOT_OTEL_ALLOW_REMOTE=1, which confines the overwrite to a local stack by default. Direct volume access permits arbitrary modification of stored series. Tracked as G-TAM-1.

Repudiation

Grafana's default configuration retains limited audit history, and Prometheus and Tempo record no query log. Actions taken through the shared admin account are attributable to the account, not to a person, so on a shared workstation no meaningful attribution exists.

Information Disclosure

The volume holds A1 and A2 unencrypted for the life of the volume. Prometheus retention is set to 120 days deliberately, so monthly token aggregates are real rather than silently truncated at the 15-day default; the same setting extends how long usage data persists. Tempo retention is not configured here, so trace content carrying prompt text persists under the image's own default. Any local user with Docker access or filesystem access to the volume can read all of it. docker compose down deliberately preserves the volume, so an operator who believes they have torn the stack down has in fact retained the corpus. Teardown documentation states both variants explicitly. Tracked as G-INF-1 and G-INF-2.

Denial of Service

The volume grows without bound for traces, because no Tempo retention limit is set. A long-running stack on a small disk can exhaust local storage. Prometheus is bounded by its 120-day retention setting.

Elevation of Privilege

Grafana's administrator role is the highest privilege in this bucket. It was previously reachable with published default credentials, and on this image with anonymous Admin access, from any local process. The compose file now disables anonymous access and requires an operator-supplied credential. Even before that change this was privilege escalation within the stack rather than beyond the host user's existing authority, since the same actor could read the volume directly. Tracked as G-EOP-1.

Risk Rating

Bucket B3: Reference helper scripts to local service APIs

Covers the four Python files under examples/. None is agent-executed.

Spoofing

Every helper targets loopback http://localhost URLs by default with no certificate or identity verification, which is inherent to plaintext loopback HTTP. A local process that binds one of these ports before the container does can impersonate the service and return fabricated results, causing verify.py to report a healthy stack that does not exist. Low likelihood, and it requires an adversary already executing on the host. validate_dashboard.py accepts an environment override for its target and refuses a non-loopback host unless the operator sets COPILOT_OTEL_ALLOW_REMOTE=1, so redirecting it away from the local stack is a deliberate act rather than an accident.

Tampering

Three of the four helpers issue only HTTP GET requests and mutate nothing. validate_dashboard.py issues one POST to the Grafana dashboard import API with overwrite: true, and it refuses to do so against a non-loopback host without an explicit opt-in. baseline.py writes a single JSON file, defaulting to ~/.cache/copilot-otel/pre-enable-baseline.json and overridable through COPILOT_OTEL_BASELINE. The path is derived from the environment rather than from any service response, so a hostile service cannot redirect the write.

Repudiation

Not applicable. The helpers are operator-invoked interactive tools that print their results to standard output and keep no log that a security decision depends on.

Information Disclosure

The helpers print metric names, label values, and series values to the terminal. inspect_metrics.py prints label sets, which include model names, tool names, and session identifiers, but not span content: prompt-bearing attributes live on spans in Tempo and are not enumerated by any shipped helper. baseline.py persists metric names, service names, service versions, session ids, and trace names to its snapshot file. No helper writes prompt content to disk. No helper transmits anything off the host, and that now rests on the transport rather than on the address alone: open_url builds its opener with an explicitly empty ProxyHandler, because urllib.request.build_opener otherwise installs the default proxy handler and proxy_bypass does not exempt loopback. Before that pin, a HTTP_PROXY value in the operator's environment would have carried a loopback-addressed request — including the Grafana Basic credential validate_dashboard.py attaches — to the proxy host in plaintext, unless no_proxy happened to cover loopback. Terminal output may still be captured by shell history or a session recorder.

Everything returned from the store is untrusted data, never instructions. B1 Spoofing establishes that any local process can inject series carrying genuine Copilot names with attacker-controlled service_version and session_id values, and those values are exactly what these helpers print. The same applies to span attributes and trace names read through Tempo. Treat helper output, query results, and dashboard content as data to be inspected, and never act on text embedded in them.

Denial of Service

validate_dashboard.py replays every dashboard panel query, which is the heaviest operation the skill performs against Prometheus and Tempo. It is bounded by the panel count and by per-request timeouts. baseline.py and verify.py issue one query per metric name, which scales with the store's cardinality. All are operator-triggered and none loops.

Elevation of Privilege

Not applicable. The helpers run with the invoking user's privileges, spawn no subprocess, evaluate no fetched content, and require no elevation. They import only the Python standard library, so they introduce no third-party dependency.

Risk Rating

Bucket B4: Container image supply chain

Covers acquisition of the three images this skill runs: grafana/otel-lgtm and otel/opentelemetry-collector-contrib in the local stack, and the same Collector image in the workstation relay.

Spoofing

Every image is referenced by multi-architecture manifest digest, with the human-readable tag retained in a comment beside it. A registry or namespace compromise able to repoint a tag is therefore rejected, because the digest no longer resolves. What is not performed is signature or provenance verification before the container runs, so a compromise of the publisher's own signing path would still be accepted. Tracked as G-SUP-1.

Tampering

A republished tag cannot reach a host that pulls by digest, which is what removes the substitution vector a mutable tag leaves open. The residual is narrower: an image whose digest this repository records could itself have been built from compromised inputs, and nothing here verifies the publisher's build provenance. Tracked as G-SUP-1.

Repudiation

Docker records the resolved image digest locally after a pull, so the specific image actually running is identifiable on that host after the fact. Because the reference is the digest, two hosts pulling at different times run the same image by construction rather than by coincidence.

Information Disclosure

Not applicable. The pull requests a public image by name and reveals nothing beyond ordinary registry access patterns. The skill supplies no credentials to the registry.

Denial of Service

Registry unavailability blocks the first run only. Once layers are cached, docker compose up -d succeeds without network access, and restart: unless-stopped returns the stack after a host reboot. For the relay this matters more than it does locally, because a relay that cannot start takes that workstation's whole telemetry path with it (G-DOS-3).

Elevation of Privilege

The containers run under the Docker daemon with whatever privileges the image declares. The local Collector and the relay drop all capabilities, set no-new-privileges, mount a read-only root filesystem, declare a memory limit, and mount no host paths beyond their read-only configuration, the named data volume, and the relay's read-only CA bundle. A compromised image would nonetheless hold whatever authority the daemon grants, which on a typical developer workstation is root-equivalent. That is inherent to running any container and is bounded here by digest pinning and by those container constraints. Tracked as G-SUP-1 and G-EOP-2.

Risk Rating

Bucket B5: Editor-global configuration mutation

Covers the assisted write into the user's global settings.json. This bucket exists because the skill now acts on a file it does not own.

Spoofing

Not applicable. The write is a local filesystem operation performed by the agent under the user's own identity. No authentication is presented and none is claimed.

Tampering

This is the material risk in this bucket, and the tampering risk runs toward the user's file rather than from an attacker. settings.json is JSONC: it may hold comments, trailing commas, and formatting the user chose. A naive parse-and-reserialize destroys all of it silently. The mitigation is structural rather than advisory: a timestamped backup is taken first, the write is a per-key upsert that replaces only the value spans of the eleven target keys and inserts absent keys before the closing brace, all other content is left byte-identical, the resulting file is re-parsed, and a parse failure triggers an immediate restore from the backup. Concurrent writes by VS Code itself remain possible and are not preventable from outside the editor; the backup is the recovery path. Tracked as G-TAM-2.

Repudiation

The write leaves the timestamped backup file beside the settings file, which records the pre-change state and the time. There is no per-key change log, so a user reconstructing what changed compares the backup against the current file. The approved diff shown before the write is the contemporaneous record and lives only in the conversation.

Information Disclosure

The agent reads the whole settings file to perform the upsert, so unrelated settings enter model context. On a developer workstation that file frequently holds API endpoints, internal hostnames, and occasionally tokens that other extensions store there. The skill mitigates exposure in output rather than in reading: the presented diff shows only the changed lines, so unrelated values are not echoed. Tracked as G-INF-4.

Denial of Service

A corrupted settings file would prevent VS Code from applying user configuration until repaired. The post-write parse plus automatic restore reduces this to a transient condition, and the backup makes it recoverable by hand even if the automatic restore fails.

Elevation of Privilege

Not applicable. The write occurs under the invoking user's own filesystem privileges, targets a file that user already owns, and requires no elevation. Application-scoped settings confer no authority beyond the editor.

Risk Rating

Bucket B6: Host process control

Covers artifacts the skill generates for the user to execute: the compose file and the local stack it defines.

Spoofing

Not applicable. Generated files carry no identity claim and authenticate to nothing at generation time.

Tampering

A generated compose file sits in the user's workspace between generation and execution, so anything with write access to that path can modify it before docker compose up runs. That is the ordinary trust model of any file in a workspace and is not specific to this skill. The relevant control is that the user reads and runs the file themselves, which puts a human between generation and execution.

Repudiation

The generated file is the record of what was proposed. Because the agent does not run it, execution is attributable to the user's own shell history and Docker daemon records rather than to the agent.

Information Disclosure

The generated compose file contains no credentials. Grafana's admin credentials are read from operator-supplied environment variables that the file requires and does not default, so a generated stack carries no secret and refuses to start without one. What the generated stack subsequently collects is covered by B1 and B2.

Denial of Service

Running the generated stack binds five loopback ports, pulls a multi-hundred-megabyte image, and creates a Docker volume that outlives the container. A port already in use causes the stack to fail to start rather than to displace the existing listener. These are the reasons the skill hands over the command rather than running it: they are consequences a user should choose.

Elevation of Privilege

This is the reason the boundary exists. docker compose up executes with Docker daemon authority, which on a typical developer workstation is root-equivalent. An agent that ran generated compose files on the user's behalf would be converting file-write capability into root-equivalent execution without a human decision in between. The skill therefore prohibits it: docker compose, az deployment, az group create, and terraform apply are printed for the user, never executed. That prohibition is advisory prose rather than an enforced control, which is its residual weakness. Tracked as G-EOP-4.

Risk Rating

Bucket B7: Cloud control-plane artifact generation

Covers the collector configuration, Bicep, Terraform, and Azure CLI templates under examples/azure/, and the organization data path they establish.

Spoofing

Fleet telemetry authenticates to the collector with whatever static credential the managed settings distribute, because Copilot's exporter can only send a fixed header set. Every workstation therefore presents the same credential and no request is bound to a particular user or device. Anything holding that value can submit telemetry indistinguishable from a real developer's. Tracked as G-INF-3.

That credential does not reach every sender. Managed telemetry.headers are applied to the extension exporter directly and deliberately not through the environment, because an environment variable is inherited by the tool subprocesses the agent spawns and would place a fleet-wide write credential inside every model-directed subprocess. The agent host therefore exports without a credential, a receiver that requires one answers HTTP 401 or gRPC UNAUTHENTICATED, and OTLP treats neither as retryable, so that telemetry is dropped rather than queued. The two obvious remedies are both worse than the problem: exporting the token defeats the separation, and dropping receiver authentication reopens ingestion on a billed backend.

The documented remedy is a per-workstation loopback relay that accepts the unauthenticated local export and adds the fleet credential upstream, keeping that credential in the relay's own configuration rather than in the editor's environment. It moves the exposure rather than removing it: the relay's listener is unauthenticated, so any local process reaching loopback can inject through it, and loopback binding constrains reachability without establishing provenance. Mutual TLS would bind a workstation rather than the fleet, and the receiver half is available in this Collector, but whether the agent host can present a client certificate is unestablished, so it is recorded as preferred and blocked rather than offered. Tracked as G-INF-7.

Tampering

The consequence of the shared credential is that dashboards can be made to say anything. An actor holding it can inject fabricated spans carrying real service names and attribute values, so token totals, tool counts, and per-team breakdowns are all forgeable. The blast radius is write-side only: the credential does not grant read access to the workspace, which is governed separately by Azure RBAC.

Repudiation

Ingested telemetry carries no per-user provenance beyond the resource attributes the sender chose to send, and those are attacker-controlled in the injection case. There is no documented in-place rotation for the connection string, so revoking it means recreating the component and redistributing to the whole fleet. That makes incident response a fleet-wide operation rather than a per-user one.

Information Disclosure

Prompt and response text has been observed on spans even with captureContent disabled, which for the organization path would place developer prompt content into a shared, queryable, billed workspace readable by anyone with Monitoring Reader. The generated collector configuration therefore deletes the six attributes observed carrying plaintext content, copilot_chat.user_request, gen_ai.input.messages, gen_ai.output.messages, gen_ai.system_instructions, gen_ai.tool.call.arguments, and gen_ai.tool.call.result, plus copilot_chat.reasoning_content defensively, which was observed marked [encrypted]. This is the strongest available control, because it acts before data reaches storage. It is defeated by removing the processor, so the configuration says so in place. The Azure dashboard also ships a panel that counts these attributes, so a workspace receiving content is visible rather than silent. Tracked as G-INF-1.

Denial of Service

The shared credential permits unbounded ingestion against a billed backend, so the practical denial of service is financial rather than availability. Templates default dailyQuotaGb to 5 and name it as the only spend guardrail, and disabling the cap requires setting it to -1 deliberately. captureContent is named as the dominant volume multiplier wherever cost is discussed. Tracked as G-DOS-2.

Elevation of Privilege

Deployment creates billable Azure resources and, when a principal is supplied, a Monitoring Reader role assignment on the workspace. That authority comes from the operator's own Azure credentials, which the agent never holds and never uses: the agent writes templates and the operator deploys them. The residual concern is a template that over-grants by default, which is why the role assignment is opt-in through an empty-by-default parameter rather than applied automatically. Tracked as G-EOP-3.

Risk Rating

Enterprise Readiness Gaps

References

• Monitor agent usage with OpenTelemetry

• Manage AI settings in enterprise environments

• OTel GenAI semantic conventions

• Grafana OTel-LGTM image

• Prometheus OTLP receiver documentation

• Visualize Azure Monitor data with Grafana

• Azure Monitor OpenTelemetry overview

• Repo-wide STRIDE model

🤖 Crafted with precision by ✨Copilot following brilliant human instruction, then carefully refined by our team of discerning human reviewers.