{"data":{"skill":{"slug":"sickn33-datadog-automation","name":"datadog-automation","icon":"📦","repo":"https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/datadog-automation","status":"approved","author":"sickn33","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"b1c2174a-b1b0-44d6-a663-b432fa7432d0","skill_id":"57ffdb4a-5546-497b-a45f-b46a38d63325","version":5,"content_hash":"v3:f9e2c34b4f19c7f3e6b0a1e93227b5f77cc12526:4ff6d8d835abd6d83bd8bde0f6f2f38b1c79c76aae807db49ac324c89699fd0b:98d02e04e576a6454dbec806cc2bac6df1fda26fb685947e966c837b39c9681b:736b696c6c732f7369636b6e33332f64617461646f672d6175746f6d6174696f6e:435e20c5cf99ff36250c979bbd726ce0","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 80 shell-backtick findings and eight reconnaissance findings are false positives caused by Markdown formatting, Datadog identifiers, and query examples. The Rube MCP URL is a confirmed low-severity external dependency. Semantic review found missing confirmation controls for alert suppression and irreversible dashboard deletion.","remediation":[{"issue":"Alert suppression can proceed without explicit confirmation.","severity":"medium","suggestion":"Require approval after showing monitor, scope, start, end, and affected services. Reject indefinite downtimes unless the user explicitly requests one."},{"issue":"Dashboard deletion has no mandatory confirmation or recovery step.","severity":"medium","suggestion":"Fetch and display the dashboard title and identifier, export its definition, then require explicit confirmation before deletion."},{"issue":"Rube MCP introduces a third-party network and authorization boundary.","severity":"low","suggestion":"Disclose the data path, verify the MCP endpoint, request least-privilege Datadog scopes, and document credential revocation."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":16,"line_start":16},{"file":"SKILL.md","line_end":17,"line_start":17},{"file":"SKILL.md","line_end":21,"line_start":21},{"file":"SKILL.md","line_end":24,"line_start":24},{"file":"SKILL.md","line_end":25,"line_start":25},{"file":"SKILL.md","line_end":36,"line_start":36},{"file":"SKILL.md","line_end":37,"line_start":37},{"file":"SKILL.md","line_end":40,"line_start":40},{"file":"SKILL.md","line_end":41,"line_start":41},{"file":"SKILL.md","line_end":42,"line_start":42},{"file":"SKILL.md","line_end":43,"line_start":43},{"file":"SKILL.md","line_end":46,"line_start":46},{"file":"SKILL.md","line_end":47,"line_start":47},{"file":"SKILL.md","line_end":48,"line_start":48},{"file":"SKILL.md","line_end":49,"line_start":49},{"file":"SKILL.md","line_end":57,"line_start":57},{"file":"SKILL.md","line_end":58,"line_start":58},{"file":"SKILL.md","line_end":61,"line_start":61},{"file":"SKILL.md","line_end":62,"line_start":62},{"file":"SKILL.md","line_end":63,"line_start":63},{"file":"SKILL.md","line_end":64,"line_start":64},{"file":"SKILL.md","line_end":65,"line_start":65},{"file":"SKILL.md","line_end":68,"line_start":68},{"file":"SKILL.md","line_end":78,"line_start":78},{"file":"SKILL.md","line_end":79,"line_start":79},{"file":"SKILL.md","line_end":80,"line_start":80},{"file":"SKILL.md","line_end":81,"line_start":81},{"file":"SKILL.md","line_end":82,"line_start":82},{"file":"SKILL.md","line_end":83,"line_start":83},{"file":"SKILL.md","line_end":86,"line_start":86},{"file":"SKILL.md","line_end":87,"line_start":87},{"file":"SKILL.md","line_end":88,"line_start":88},{"file":"SKILL.md","line_end":89,"line_start":89},{"file":"SKILL.md","line_end":90,"line_start":90},{"file":"SKILL.md","line_end":91,"line_start":91},{"file":"SKILL.md","line_end":92,"line_start":92},{"file":"SKILL.md","line_end":95,"line_start":95},{"file":"SKILL.md","line_end":96,"line_start":96},{"file":"SKILL.md","line_end":97,"line_start":97},{"file":"SKILL.md","line_end":106,"line_start":106},{"file":"SKILL.md","line_end":107,"line_start":107},{"file":"SKILL.md","line_end":108,"line_start":108},{"file":"SKILL.md","line_end":109,"line_start":109},{"file":"SKILL.md","line_end":112,"line_start":112},{"file":"SKILL.md","line_end":113,"line_start":113},{"file":"SKILL.md","line_end":114,"line_start":114},{"file":"SKILL.md","line_end":115,"line_start":115},{"file":"SKILL.md","line_end":116,"line_start":116},{"file":"SKILL.md","line_end":120,"line_start":120},{"file":"SKILL.md","line_end":129,"line_start":129}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":21,"line_start":21}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Alert suppression lacks confirmation controls","locations":[{"file":"SKILL.md","line_end":83,"line_start":78},{"file":"SKILL.md","line_end":150,"line_start":129}],"confidence":0.96,"description":"The workflow can mute monitors or create broad downtimes without requiring explicit confirmation, scope review, or a bounded duration.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The cited workflows expose monitor muting and scoped downtime creation. The text recommends an end time but does not require approval before suppressing alerts."},{"title":"Irreversible dashboard deletion lacks confirmation","locations":[{"file":"SKILL.md","line_end":122,"line_start":103}],"confidence":0.99,"description":"The workflow exposes permanent dashboard deletion and warns that no undo exists, but it does not require identity verification, backup, or user confirmation.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The cited section explicitly describes DATADOG_DELETE_DASHBOARD as irreversible and permanent. No mandatory confirmation or recovery step is provided."}],"low_findings":[{"title":"Hardcoded URL","locations":[{"file":"SKILL.md","line_end":21,"line_start":21}],"confidence":0.98,"description":"**Get Rube MCP**: Add `https://rube.app/mcp` as an MCP server in your client configuration. No API k","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The skill explicitly directs users to add https://rube.app/mcp and authenticate Datadog through it, creating a real third-party network dependency. This matches the declared integration."}],"dangerous_patterns":[],"files_scanned":1,"total_lines":245,"audit_model":"codex","audited_at":"2026-07-23T22:48:47.914+00:00","created_at":"2026-07-26T08:23:17.505032+00:00","static_findings":[{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Active Datadog connection via `RUBE_MANAGE_CONNECTIONS` with toolkit `datadog`","category":"external_commands","line_end":16,"severity":"medium","line_start":16},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Always call `RUBE_SEARCH_TOOLS` first to get current tool schemas","category":"external_commands","line_end":17,"severity":"medium","line_start":17},{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Get Rube MCP**: Add `https://rube.app/mcp` as an MCP server in your client configuration. No API k","category":"external_commands","line_end":21,"severity":"medium","line_start":21},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. Verify Rube MCP is available by confirming `RUBE_SEARCH_TOOLS` responds","category":"external_commands","line_end":24,"severity":"medium","line_start":24},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. Call `RUBE_MANAGE_CONNECTIONS` with toolkit `datadog`","category":"external_commands","line_end":25,"severity":"medium","line_start":25},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. `DATADOG_LIST_METRICS` - List available metric names [Optional]","category":"external_commands","line_end":36,"severity":"medium","line_start":36},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. `DATADOG_QUERY_METRICS` - Query metric time series data [Required]","category":"external_commands","line_end":37,"severity":"medium","line_start":37},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `query`: Datadog metric query string (e.g., `avg:system.cpu.user{host:web01}`)","category":"external_commands","line_end":40,"severity":"medium","line_start":40},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `from`: Start timestamp (Unix epoch seconds)","category":"external_commands","line_end":41,"severity":"medium","line_start":41},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `to`: End timestamp (Unix epoch seconds)","category":"external_commands","line_end":42,"severity":"medium","line_start":42},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `q`: Search string for listing metrics","category":"external_commands","line_end":43,"severity":"medium","line_start":43},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Query syntax follows Datadog's metric query format: `aggregation:metric_name{tag_filters}`","category":"external_commands","line_end":46,"severity":"medium","line_start":46},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `from` and `to` are Unix epoch timestamps in seconds, not milliseconds","category":"external_commands","line_end":47,"severity":"medium","line_start":47},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Valid aggregations: `avg`, `sum`, `min`, `max`, `count`","category":"external_commands","line_end":48,"severity":"medium","line_start":48},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Tag filters use curly braces: `{host:web01,env:prod}`","category":"external_commands","line_end":49,"severity":"medium","line_start":49},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. `DATADOG_LIST_LOG_INDEXES` - List available log indexes [Optional]","category":"external_commands","line_end":57,"severity":"medium","line_start":57},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. `DATADOG_SEARCH_LOGS` - Search logs with query and filters [Required]","category":"external_commands","line_end":58,"severity":"medium","line_start":58},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `query`: Log search query using Datadog log query syntax","category":"external_commands","line_end":61,"severity":"medium","line_start":61},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `from`: Start time (ISO 8601 or Unix timestamp)","category":"external_commands","line_end":62,"severity":"medium","line_start":62},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `to`: End time (ISO 8601 or Unix timestamp)","category":"external_commands","line_end":63,"severity":"medium","line_start":63},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `sort`: Sort order ('asc' or 'desc')","category":"external_commands","line_end":64,"severity":"medium","line_start":64},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `limit`: Number of log entries to return","category":"external_commands","line_end":65,"severity":"medium","line_start":65},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Log queries use Datadog's log search syntax: `service:web status:error`","category":"external_commands","line_end":68,"severity":"medium","line_start":68},{"id":"external_commands:SKILL.md:78:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. `DATADOG_LIST_MONITORS` - List all monitors with filters [Required]","category":"external_commands","line_end":78,"severity":"medium","line_start":78},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. `DATADOG_GET_MONITOR` - Get specific monitor details [Optional]","category":"external_commands","line_end":79,"severity":"medium","line_start":79},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. `DATADOG_CREATE_MONITOR` - Create a new monitor [Optional]","category":"external_commands","line_end":80,"severity":"medium","line_start":80},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"4. `DATADOG_UPDATE_MONITOR` - Update monitor configuration [Optional]","category":"external_commands","line_end":81,"severity":"medium","line_start":81},{"id":"external_commands:SKILL.md:82:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"5. `DATADOG_MUTE_MONITOR` - Silence a monitor temporarily [Optional]","category":"external_commands","line_end":82,"severity":"medium","line_start":82},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"6. `DATADOG_UNMUTE_MONITOR` - Re-enable a muted monitor [Optional]","category":"external_commands","line_end":83,"severity":"medium","line_start":83},{"id":"external_commands:SKILL.md:86:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `monitor_id`: Numeric monitor ID","category":"external_commands","line_end":86,"severity":"medium","line_start":86},{"id":"external_commands:SKILL.md:87:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `name`: Monitor display name","category":"external_commands","line_end":87,"severity":"medium","line_start":87},{"id":"external_commands:SKILL.md:88:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `type`: Monitor type ('metric alert', 'service check', 'log alert', 'query alert', etc.)","category":"external_commands","line_end":88,"severity":"medium","line_start":88},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `query`: Monitor query defining the alert condition","category":"external_commands","line_end":89,"severity":"medium","line_start":89},{"id":"external_commands:SKILL.md:90:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `message`: Notification message with @mentions","category":"external_commands","line_end":90,"severity":"medium","line_start":90},{"id":"external_commands:SKILL.md:91:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `tags`: Array of tag strings","category":"external_commands","line_end":91,"severity":"medium","line_start":91},{"id":"external_commands:SKILL.md:92:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `thresholds`: Alert threshold values (`critical`, `warning`, `ok`)","category":"external_commands","line_end":92,"severity":"medium","line_start":92},{"id":"external_commands:SKILL.md:95:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Monitor `type` must match the query type; mismatches cause creation failures","category":"external_commands","line_end":95,"severity":"medium","line_start":95},{"id":"external_commands:SKILL.md:96:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `message` supports @mentions for notifications (e.g., `@slack-channel`, `@pagerduty`)","category":"external_commands","line_end":96,"severity":"medium","line_start":96},{"id":"external_commands:SKILL.md:97:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Thresholds vary by monitor type; metric monitors need `critical` at minimum","category":"external_commands","line_end":97,"severity":"medium","line_start":97},{"id":"external_commands:SKILL.md:106:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. `DATADOG_LIST_DASHBOARDS` - List all dashboards [Required]","category":"external_commands","line_end":106,"severity":"medium","line_start":106},{"id":"external_commands:SKILL.md:107:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. `DATADOG_GET_DASHBOARD` - Get full dashboard definition [Optional]","category":"external_commands","line_end":107,"severity":"medium","line_start":107},{"id":"external_commands:SKILL.md:108:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. `DATADOG_UPDATE_DASHBOARD` - Update dashboard layout or widgets [Optional]","category":"external_commands","line_end":108,"severity":"medium","line_start":108},{"id":"external_commands:SKILL.md:109:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"4. `DATADOG_DELETE_DASHBOARD` - Remove a dashboard (irreversible) [Optional]","category":"external_commands","line_end":109,"severity":"medium","line_start":109},{"id":"external_commands:SKILL.md:112:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `dashboard_id`: Dashboard identifier string","category":"external_commands","line_end":112,"severity":"medium","line_start":112},{"id":"external_commands:SKILL.md:113:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `title`: Dashboard title","category":"external_commands","line_end":113,"severity":"medium","line_start":113},{"id":"external_commands:SKILL.md:114:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `layout_type`: 'ordered' (grid) or 'free' (freeform positioning)","category":"external_commands","line_end":114,"severity":"medium","line_start":114},{"id":"external_commands:SKILL.md:115:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `widgets`: Array of widget definition objects","category":"external_commands","line_end":115,"severity":"medium","line_start":115},{"id":"external_commands:SKILL.md:116:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `description`: Dashboard description","category":"external_commands","line_end":116,"severity":"medium","line_start":116},{"id":"external_commands:SKILL.md:120:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `layout_type` cannot be changed after creation; must recreate the dashboard","category":"external_commands","line_end":120,"severity":"medium","line_start":120},{"id":"external_commands:SKILL.md:129:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. `DATADOG_LIST_EVENTS` - List existing events [Optional]","category":"external_commands","line_end":129,"severity":"medium","line_start":129},{"id":"external_commands:SKILL.md:130:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. `DATADOG_CREATE_EVENT` - Post a new event [Required]","category":"external_commands","line_end":130,"severity":"medium","line_start":130},{"id":"external_commands:SKILL.md:131:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. `DATADOG_CREATE_DOWNTIME` - Schedule a maintenance downtime [Optional]","category":"external_commands","line_end":131,"severity":"medium","line_start":131},{"id":"external_commands:SKILL.md:134:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `title`: Event title","category":"external_commands","line_end":134,"severity":"medium","line_start":134},{"id":"external_commands:SKILL.md:135:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `text`: Event body text (supports markdown)","category":"external_commands","line_end":135,"severity":"medium","line_start":135},{"id":"external_commands:SKILL.md:136:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `alert_type`: Event severity ('error', 'warning', 'info', 'success')","category":"external_commands","line_end":136,"severity":"medium","line_start":136},{"id":"external_commands:SKILL.md:137:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `tags`: Array of tag strings","category":"external_commands","line_end":137,"severity":"medium","line_start":137},{"id":"external_commands:SKILL.md:140:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `scope`: Tag scope for the downtime (e.g., `host:web01`)","category":"external_commands","line_end":140,"severity":"medium","line_start":140},{"id":"external_commands:SKILL.md:141:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `start`: Start time (Unix epoch)","category":"external_commands","line_end":141,"severity":"medium","line_start":141},{"id":"external_commands:SKILL.md:142:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `end`: End time (Unix epoch; omit for indefinite)","category":"external_commands","line_end":142,"severity":"medium","line_start":142},{"id":"external_commands:SKILL.md:143:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `message`: Downtime description","category":"external_commands","line_end":143,"severity":"medium","line_start":143},{"id":"external_commands:SKILL.md:144:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `monitor_id`: Specific monitor to downtime (optional, omit for scope-based)","category":"external_commands","line_end":144,"severity":"medium","line_start":144},{"id":"external_commands:SKILL.md:147:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Event `text` supports Datadog's markdown format including @mentions","category":"external_commands","line_end":147,"severity":"medium","line_start":147},{"id":"external_commands:SKILL.md:148:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Downtimes scope uses tag syntax: `host:web01`, `env:staging`","category":"external_commands","line_end":148,"severity":"medium","line_start":148},{"id":"external_commands:SKILL.md:149:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Omitting `end` creates an indefinite downtime; always set an end time for maintenance","category":"external_commands","line_end":149,"severity":"medium","line_start":149},{"id":"external_commands:SKILL.md:150:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Downtime `monitor_id` narrows to a single monitor; scope applies to all matching monitors","category":"external_commands","line_end":150,"severity":"medium","line_start":150},{"id":"external_commands:SKILL.md:157:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. `DATADOG_LIST_HOSTS` - List all reporting hosts [Required]","category":"external_commands","line_end":157,"severity":"medium","line_start":157},{"id":"external_commands:SKILL.md:158:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. `DATADOG_GET_TRACE_BY_ID` - Get a specific distributed trace [Optional]","category":"external_commands","line_end":158,"severity":"medium","line_start":158},{"id":"external_commands:SKILL.md:161:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `filter`: Host search filter string","category":"external_commands","line_end":161,"severity":"medium","line_start":161},{"id":"external_commands:SKILL.md:162:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `sort_field`: Sort hosts by field (e.g., 'name', 'apps', 'cpu')","category":"external_commands","line_end":162,"severity":"medium","line_start":162},{"id":"external_commands:SKILL.md:163:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `sort_dir`: Sort direction ('asc' or 'desc')","category":"external_commands","line_end":163,"severity":"medium","line_start":163},{"id":"external_commands:SKILL.md:164:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `trace_id`: Distributed trace ID for trace lookup","category":"external_commands","line_end":164,"severity":"medium","line_start":164},{"id":"external_commands:SKILL.md:176:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":178,"severity":"medium","line_start":176},{"id":"external_commands:SKILL.md:178:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":181,"severity":"medium","line_start":178},{"id":"external_commands:SKILL.md:181:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":183,"severity":"medium","line_start":181},{"id":"external_commands:SKILL.md:183:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":187,"severity":"medium","line_start":183},{"id":"external_commands:SKILL.md:187:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Tags use `key:value` format: `host:web01`, `env:prod`, `service:api`","category":"external_commands","line_end":187,"severity":"medium","line_start":187},{"id":"external_commands:SKILL.md:188:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Multiple tags: `{host:web01,env:prod}` (AND logic)","category":"external_commands","line_end":189,"severity":"medium","line_start":188},{"id":"external_commands:SKILL.md:189:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Wildcard: `host:web*`","category":"external_commands","line_end":193,"severity":"medium","line_start":189},{"id":"external_commands:SKILL.md:193:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Use `page` and `page_size` or offset-based pagination depending on endpoint","category":"external_commands","line_end":193,"severity":"medium","line_start":193},{"id":"external_commands:SKILL.md:205:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Metric queries: `aggregation:metric{tags}`","category":"external_commands","line_end":206,"severity":"medium","line_start":205},{"id":"network:SKILL.md:21:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"**Get Rube MCP**: Add `https://rube.app/mcp` as an MCP server in your client configuration. No API k","category":"network","line_end":21,"severity":"low","line_start":21},{"id":"blocker:SKILL.md:48:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- Valid aggregations: `avg`, `sum`, `min`, `max`, `count`","category":"blocker","line_end":48,"severity":"low","line_start":48},{"id":"blocker:SKILL.md:223:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"| Get monitor | DATADOG_GET_MONITOR | monitor_id |","category":"blocker","line_end":223,"severity":"low","line_start":223},{"id":"blocker:SKILL.md:225:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"| Update monitor | DATADOG_UPDATE_MONITOR | monitor_id |","category":"blocker","line_end":225,"severity":"low","line_start":225},{"id":"blocker:SKILL.md:226:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"| Mute monitor | DATADOG_MUTE_MONITOR | monitor_id |","category":"blocker","line_end":226,"severity":"low","line_start":226},{"id":"blocker:SKILL.md:227:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"| Unmute monitor | DATADOG_UNMUTE_MONITOR | monitor_id |","category":"blocker","line_end":227,"severity":"low","line_start":227},{"id":"blocker:SKILL.md:229:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"| Get dashboard | DATADOG_GET_DASHBOARD | dashboard_id |","category":"blocker","line_end":229,"severity":"low","line_start":229},{"id":"blocker:SKILL.md:231:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"| Delete dashboard | DATADOG_DELETE_DASHBOARD | dashboard_id |","category":"blocker","line_end":231,"severity":"low","line_start":231},{"id":"blocker:SKILL.md:236:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"| Get trace | DATADOG_GET_TRACE_BY_ID | trace_id |","category":"blocker","line_end":236,"severity":"low","line_start":236}],"finding_verdicts":[{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:78:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:82:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:86:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:87:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:88:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:90:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:91:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:92:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:95:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:96:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:97:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:106:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:107:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:108:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:109:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:112:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:113:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:114:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:115:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:116:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:120:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:129:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:130:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:131:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:134:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:135:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:136:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:137:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:140:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:141:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:142:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:143:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:144:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:147:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:148:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:149:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:150:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:157:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:158:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:161:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:162:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:163:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:164:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:176:ruby-shell-backtick-execution","reason":"The triple backticks delimit Datadog query examples in Markdown; they are not Ruby or shell execution syntax. No local command is invoked.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:178:ruby-shell-backtick-execution","reason":"The triple backticks delimit Datadog query examples in Markdown; they are not Ruby or shell execution syntax. No local command is invoked.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:181:ruby-shell-backtick-execution","reason":"The triple backticks delimit Datadog query examples in Markdown; they are not Ruby or shell execution syntax. No local command is invoked.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:183:ruby-shell-backtick-execution","reason":"The triple backticks delimit Datadog query examples in Markdown; they are not Ruby or shell execution syntax. No local command is invoked.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:187:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:188:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:189:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:193:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:205:ruby-shell-backtick-execution","reason":"The backticks only format Markdown identifiers, parameters, or Datadog query examples; SKILL.md contains no Ruby or shell execution expression. MCP tool names are documentation, not local commands.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:21:hardcoded-url","reason":"The skill explicitly directs users to add https://rube.app/mcp and authenticate Datadog through it, creating a real third-party network dependency. This matches the declared integration.","verdict":"confirmed","severity":"low","confidence":0.98},{"id":"blocker:SKILL.md:48:system-reconnaissance","reason":"This line lists valid Datadog aggregation names; it neither discovers host details nor invokes reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:223:system-reconnaissance","reason":"This quick-reference row documents a Datadog object identifier for an intended API operation; it performs no system discovery or reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:225:system-reconnaissance","reason":"This quick-reference row documents a Datadog object identifier for an intended API operation; it performs no system discovery or reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:226:system-reconnaissance","reason":"This quick-reference row documents a Datadog object identifier for an intended API operation; it performs no system discovery or reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:227:system-reconnaissance","reason":"This quick-reference row documents a Datadog object identifier for an intended API operation; it performs no system discovery or reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:229:system-reconnaissance","reason":"This quick-reference row documents a Datadog object identifier for an intended API operation; it performs no system discovery or reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:231:system-reconnaissance","reason":"This quick-reference row documents a Datadog object identifier for an intended API operation; it performs no system discovery or reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:236:system-reconnaissance","reason":"This quick-reference row documents a Datadog object identifier for an intended API operation; it performs no system discovery or reconnaissance.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[{"title":"Alert suppression lacks confirmation controls","severity":"medium","locations":[{"file":"SKILL.md","line_end":83,"line_start":78},{"file":"SKILL.md","line_end":150,"line_start":129}],"confidence":0.96,"description":"The workflow can mute monitors or create broad downtimes without requiring explicit confirmation, scope review, or a bounded duration.","confidence_reasoning":"The cited workflows expose monitor muting and scoped downtime creation. The text recommends an end time but does not require approval before suppressing alerts."},{"title":"Irreversible dashboard deletion lacks confirmation","severity":"medium","locations":[{"file":"SKILL.md","line_end":122,"line_start":103}],"confidence":0.99,"description":"The workflow exposes permanent dashboard deletion and warns that no undo exists, but it does not require identity verification, backup, or user confirmation.","confidence_reasoning":"The cited section explicitly describes DATADOG_DELETE_DASHBOARD as irreversible and permanent. No mandatory confirmation or recovery step is provided."}],"subject_marketplace_commit_sha":"f9e2c34b4f19c7f3e6b0a1e93227b5f77cc12526","subject_content_hash":"4ff6d8d835abd6d83bd8bde0f6f2f38b1c79c76aae807db49ac324c89699fd0b","subject_tree_hash":"98d02e04e576a6454dbec806cc2bac6df1fda26fb685947e966c837b39c9681b","subject_plugin_path":"skills/sickn33/datadog-automation","audit_payload_hash":"435e20c5cf99ff36250c979bbd726ce0","confirmed_risk_level":"medium","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"f9e2c34b4f19c7f3e6b0a1e93227b5f77cc12526","contentHash":"4ff6d8d835abd6d83bd8bde0f6f2f38b1c79c76aae807db49ac324c89699fd0b","treeHash":"98d02e04e576a6454dbec806cc2bac6df1fda26fb685947e966c837b39c9681b","pluginPath":"skills/sickn33/datadog-automation","auditPayloadHash":"435e20c5cf99ff36250c979bbd726ce0"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/sickn33-datadog-automation/audits/5/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"medium","confirmedFindingCount":2,"capabilityReviewCount":1,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}