Habilidades groundcover-cli

📦

groundcover-cli

Name: groundcover-cli
Author: paymog

Revisión del contenido r1 Seguro ⚙️ Comandos externos🌐 Acceso a red📁 Acceso al sistema de archivos🔑 Variables de entorno

Investigate Groundcover Production Issues

Production investigations require correlated logs, traces, metrics, and Kubernetes context. This skill provides Groundcover CLI workflows for querying telemetry and managing observability resources.

Compatible con: Claude Codex Code(CC)

🥉 77 Bronce

Maintain this Skill? Claim it 🥉 77 Bronce

Instalar con mi Agente

Copia esta solicitud en tu Agente. Incluye la página canónica del Skill y el manifiesto.

Solicitud de agente

Review the Skillstore skill "groundcover-cli" from https://skillstore.io/skills/paymog-groundcover-cli.md and its manifest at https://skillstore.io/api/skills/paymog-groundcover-cli/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Tu Agente debe seguir mostrando su plan y solicitar cualquier confirmación exigida por la política de seguridad.

Recursos legibles por agentes

Usa estos enlaces cuando un agente de IA, crawler o script necesite contexto limpio en vez de leer la página completa.

Detalle Markdown GET /skills/paymog-groundcover-cli.md Manifest firmado GET /api/skills/paymog-groundcover-cli/manifest Lockfile firmado GET /api/skills/paymog-groundcover-cli/lockfile

Pruébalo

Usando "groundcover-cli". Summarize a service incident after reviewing its telemetry.

Resultado esperado:

Illustrative summary: Error logs show repeated upstream timeouts during the selected window.
Slow traces overlap with elevated latency metrics.
The available evidence suggests an upstream dependency issue, but does not establish the root cause.
No production settings were changed.

Usando "groundcover-cli". Review a proposed dashboard change before applying it.

Resultado esperado:

Illustrative review: Preserve the current revision and existing widgets.
Place stat panels at the top level and check every panel against the 24-column grid.
Validate each metric expression with a range query.
The change remains unapplied pending approval; visual rendering has not been verified.

Auditoría de seguridad

Seguro

v1 • 19/10/2026 Abrir el informe versionado

All 244 static findings were adjudicated; three overlapping detections confirm one unverified remote-installer execution risk. Other detections concern Markdown, documented authentication, standard input, or application identifiers. No evidence found of prompt injection, covert exfiltration, or malicious intent in the supplied skill text; external implementations were not reviewed.

Archivos escaneados

513

Líneas analizadas

Elementos de revisión

Falsos positivos ignorados

Elementos de revisión de capacidades (3)

Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.

Alto

SKILL.md:241

Shell command substitution

sh -c "$(curl -fsSL https://groundcover.com/install.sh)" # installs to ~/.groundcover/bin

The command passes a downloaded HTTPS installer directly to sh without pinning or integrity verification. A compromised response could execute arbitrary local code.

Alto

SKILL.md:240-245

Template literal with command substitution

```sh

Although this is a Markdown shell fence, its recipe executes the downloaded installer through sh. The missing integrity check creates remote-code execution risk.

Alto

SKILL.md:241

Hardcoded URL

sh -c "$(curl -fsSL https://groundcover.com/install.sh)" # installs to ~/.groundcover/bin

The installer URL supplies code that is immediately executed by sh without integrity verification. HTTPS alone does not protect against compromised upstream content.

Factores de riesgo

⚙️ Comandos externos (50)

🌐 Acceso a red (5)

SKILL.md:8 SKILL.md:25 SKILL.md:241 SKILL.md:258 SKILL.md:376

📁 Acceso al sistema de archivos (22)

🔑 Variables de entorno (4)

SKILL.md:13 SKILL.md:22 SKILL.md:36 SKILL.md:48

Auditado por: codex

Compartir y citar este informe

Comparte el informe de evaluación versionado, la insignia neutral, la tarjeta insertable y las citas. Skillstore presenta evidencias sin decidir si este Skill es seguro.

Abrir el informe versionado

Copiar enlace del informe

https://skillstore.io/skills/paymog-groundcover-cli/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Insignia Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/paymog-groundcover-cli/security.svg)](https://skillstore.io/skills/paymog-groundcover-cli?utm_source=security_passport_badge)

Insignia HTML

<a href="https://skillstore.io/skills/paymog-groundcover-cli?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/paymog-groundcover-cli/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Tarjeta para insertar

<iframe src="https://skillstore.io/embed/skills/paymog-groundcover-cli.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citas académicas (APA · BibTeX · CFF)

Cita APA

paymog. (2026). groundcover-cli security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/paymog-groundcover-cli/audits/1

Cita BibTeX

@techreport{paymog-paymog-groundcover-cli-2026,
  author = {paymog},
  title = {groundcover-cli security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/paymog-groundcover-cli/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "groundcover-cli security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "paymog"
date-released: "2026-10-19"
url: "https://skillstore.io/skills/paymog-groundcover-cli/audits/1"
identifiers:
  - type: other
    value: "skillstore:paymog-groundcover-cli:audit:1"
    description: "Skillstore immutable audit report identifier"

Puntuación de Skillstore

Por qué esta puntuación Confianza de la evidencia: Medio

Arquitectura

Mantenibilidad

Contenido

Comunidad

Cumplimiento de la especificación

Lo que puedes crear

Investigate Production Errors

Correlate service error logs, slow traces, latency metrics, and Kubernetes warnings within a defined incident window.

Validate Service Telemetry

Discover available metrics and labels, then compare request latency and error patterns for an application service.

Maintain Observability Dashboards

Inspect dashboard presets, prepare revision-aware changes, and validate queries and layout constraints before deployment.

Prueba estos prompts

Check Authentication Setup

Explain how to check my Groundcover profile and authentication status without printing tokens. Do not install software or create credentials.

Review Recent Service Errors

Using my authorized profile, inspect error logs for service api over the last hour. Summarize recurring errors without exposing sensitive log values.

Correlate Latency and Restarts

Investigate api latency over the last 30 minutes using traces, PromQL range queries, and Kubernetes warnings. Separate observations from hypotheses; make no changes.

Prepare a Dashboard Update

Inspect dashboard <uuid> and propose p99 panels. Preserve its revision and existing widgets. Validate queries and layout; request approval before applying changes.

Mejores prácticas

Use authorized, least-privilege profiles and confirm the tenant and destination before querying or changing resources.
Use narrow UTC windows and discriminating filters; remove secrets and personal data from shared findings.
Preserve current revisions and complete settings; obtain approval before writes, alert silences, or software installation.

Evitar

Executing the remote installer without reviewing it and verifying a pinned artifact.
Printing API tokens or copying unredacted production logs into reports.
Silencing alerts or overwriting production dashboards without explicit approval and a recovery plan.

Preguntas frecuentes

Does this skill include the Groundcover executable?

No. It provides CLI instructions and request templates. You must install the appropriate executable separately.

Which API key type is required?

Standard API workflows require a service-account key with the gcsa_ prefix. Ingestion keys do not authenticate these commands.

Can the same key access embedded Grafana?

No. The documented Grafana workflows require a separate glsa_ service-account token and tenant-admin setup.

Should I use SDK-backed or raw commands?

Prefer SDK-backed commands. Use raw endpoint discovery when the SDK lacks the required operation.

Can this skill change production resources?

Yes, its documented commands include updates, deletions, credential creation, and alert silences. Use least privilege and require approval for changes.

Why can an instant metric query fail?

The skill documents instant-query failures. Use a short range query and inspect the latest point, accounting for delayed metric ingestion.

Detalles del desarrollador

Autor

paymog

Licencia

MIT

Revisión de Skillstore

Aviso de versión

El autor no declaró una versión.

Repositorio

https://github.com/paymog/groundcover-cli/tree/456ed7234e18208e0db2bb7e4a2520ba7e88d61d/skills/groundcover-cli

Ref.

9ad001c2f8b967cac562a7f66e834d8ed61815f5

Actualidad del mantenimiento

19/10/2026

Uso

0 descargas · 0 vistas

Estructura de archivos

📄 SKILL.md