Habilidades golang-observability
📦
golang-observability
v1.3.2 Revisión del contenido r1 Riesgo alto ⚙️ Comandos externos🌐 Acceso a red📁 Acceso al sistema de archivos🔑 Variables de entorno⚡ Contiene scripts
Instrument Go Services for Production Observability
Missing telemetry makes production failures difficult to diagnose. This skill guides Go instrumentation with structured logs, metrics, traces, profiling, and analytics privacy considerations.
Compatible con: Codex Code(CC)
Detente y solicita confirmación antes de instalar.
Revisa el plan y obtén el consentimiento explícito del usuario antes de modificar archivos.
Instalar con mi Agente
Copia esta solicitud en tu Agente. Incluye la página canónica del Skill y el manifiesto.
Solicitud de agente
Review the Skillstore skill "golang-observability" from https://skillstore.io/skills/samber-golang-observability.md and its manifest at https://skillstore.io/api/skills/samber-golang-observability/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Tu Agente debe seguir mostrando su plan y solicitar cualquier confirmación exigida por la política de seguridad.
Recursos legibles por agentes
Usa estos enlaces cuando un agente de IA, crawler o script necesite contexto limpio en vez de leer la página completa.
Pruébalo
Usando "golang-observability". Review request metrics that label every request with its full path and user ID.
Resultado esperado:
- Both labels can create unbounded time series and increase monitoring memory use.
- Replace raw paths with route templates and remove user IDs from metric labels.
- Use access-controlled traces for necessary user-level correlation.
Usando "golang-observability". Our 99.9% availability alert produces noise during short error spikes.
Resultado esperado:
- Review the availability definition and error-budget calculation.
- Pair short and long burn-rate windows to distinguish sustained degradation from brief spikes.
- Validate thresholds and persistence durations against historical traffic before enabling paging.
Usando "golang-observability". Review a proposed production profiling integration.
Resultado esperado:
- Keep pprof on a protected internal listener.
- Use encrypted collector transport and redact credentials from startup logs.
- Start with selected profile types and measure overhead on a limited replica set.
Auditoría de seguridad
Riesgo altov1 • 18/10/2026 Abrir el informe versionado
Most static findings are false positives involving Markdown, Go syntax, PromQL expressions, and evaluation fixtures; one profiling URL example encourages credentials over plaintext HTTP. Five additional findings cover credential logging, missing authorization in privacy examples, incomplete erasure reporting, unbounded metric labels, and misleading identifier privacy claims. No evidence found of malicious execution, unauthorized exfiltration intent, or audit-directed prompt injection.
9
Archivos escaneados
2,288
Líneas analizadas
1
Elementos de revisión
0
Falsos positivos ignorados
Preocupaciones de seguridad confirmadas (5)
Alto
Profiling Startup Log Can Expose Collector Credentials
The success log emits the entire PYROSCOPE_URL. The same example permits embedded credentials, exposing them to log storage and downstream collectors.
The log directly reads the same environment variable illustrated with URL credentials. Exposure occurs when users adopt that documented credential format.
Alto
Privacy Handler Examples Omit Subject Authorization
Export and deletion handlers use chi.URLParam(r, "id") without checking caller ownership. Without external authorization, callers could export or delete another user's data.
Both handlers pass caller-selected IDs directly to sensitive repository operations. No authorization middleware is shown, so deployment exploitability depends on integration.
Medio
Erasure Handler Reports Success After Vendor Failures
Vendor deletion errors are logged without retry or failure propagation. The handler still reports completion and HTTP 204, potentially retaining analytics data after apparent erasure.
Both vendor error branches continue to an unconditional completion log and success response. No durable retry or pending deletion state appears.
Medio
Latency Middleware Creates Unbounded Metric Labels
The latency middleware uses r.URL.Path directly as a histogram label. Attacker-controlled paths can create excessive time series and exhaust monitoring resources.
The example records raw paths instead of route templates. Later cardinality warnings do not change this copyable middleware example.
Medio
Analytics Guidance Misclassifies Linkable User Identifiers
The guide calls internal user_id values "not PII" and repeats this in its privacy checklist. Linkable identifiers remain personal data despite replacing email.
The examples link identifiers to specific users and business events. Calling them non-personal can incorrectly exempt analytics data from privacy safeguards.
Elementos de revisión de capacidades (1)
Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.
Medio
Hardcoded URL
ServerAddress: os.Getenv("PYROSCOPE_URL"), // e.g., http://user:pass@pyroscope:4040
The example puts username and password credentials in a plaintext HTTP collector URL. Copying this configuration can expose authentication and profile data in transit.
Factores de riesgo
⚙️ Comandos externos (38)
evals/evals.json:360 SKILL.md:3 SKILL.md:24 SKILL.md:32 SKILL.md:42 SKILL.md:44 SKILL.md:47 SKILL.md:58 SKILL.md:59 SKILL.md:60 SKILL.md:61 SKILL.md:62 SKILL.md:66 SKILL.md:68-73 SKILL.md:73-81 SKILL.md:81-91 SKILL.md:91 SKILL.md:93-95 SKILL.md:95 SKILL.md:101 SKILL.md:109-111 SKILL.md:111-121 SKILL.md:121-125 SKILL.md:125-134 SKILL.md:134-138 SKILL.md:138 SKILL.md:142 SKILL.md:144 SKILL.md:152 SKILL.md:153-155 SKILL.md:155-159 SKILL.md:159-170 SKILL.md:170-172 SKILL.md:172-178 SKILL.md:178-180 SKILL.md:180-186 SKILL.md:186-188 SKILL.md:188-200
🌐 Acceso a red (8)
📁 Acceso al sistema de archivos (5)
🔑 Variables de entorno (1)
⚡ Contiene scripts (2)
Auditado por: codex
Compartir y citar este informe
Comparte el informe de evaluación versionado, la insignia neutral, la tarjeta insertable y las citas. Skillstore presenta evidencias sin decidir si este Skill es seguro.
Copiar enlace del informe
https://skillstore.io/skills/samber-golang-observability/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportInsignia Markdown
[](https://skillstore.io/skills/samber-golang-observability?utm_source=security_passport_badge)Insignia HTML
<a href="https://skillstore.io/skills/samber-golang-observability?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/samber-golang-observability/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Tarjeta para insertar
<iframe src="https://skillstore.io/embed/skills/samber-golang-observability.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Citas académicas (APA · BibTeX · CFF)
Cita APA
samber. (2026). golang-observability security audit report (audit version 1) [Author version 1.3.2]. Skillstore. https://skillstore.io/skills/samber-golang-observability/audits/1Cita BibTeX
@techreport{samber-samber-golang-observability-2026,
author = {samber},
title = {golang-observability security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/samber-golang-observability/audits/1},
note = {Author version 1.3.2}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "golang-observability security audit report (audit version 1)"
version: "1.3.2"
type: report
authors:
- name: "samber"
date-released: "2026-10-18"
url: "https://skillstore.io/skills/samber-golang-observability/audits/1"
identifiers:
- type: other
value: "skillstore:samber-golang-observability:audit:1"
description: "Skillstore immutable audit report identifier"
Puntuación de Skillstore
Por qué esta puntuación Confianza de la evidencia: Medio 45
Arquitectura
100
Mantenibilidad
87
Contenido
65
Comunidad
100
Cumplimiento de la especificación
Lo que puedes crear
Instrument a New Go API
Add request metrics, structured logs, and trace spans before releasing a new service.
Improve Production Alerting
Review metric labels, latency histograms, and error-budget alerts to reduce monitoring noise and identify coverage gaps.
Review Analytics Data Flows
Evaluate server-side event tracking, consent handling, identifiers, and deletion workflows with engineering and privacy stakeholders.
Prueba estos prompts
Review Basic Logging
Review this Go handler for structured slog fields, context propagation, log levels, and sensitive data. Explain the smallest useful changes.
Add Request Metrics
Instrument this Go router with request counters and latency histograms. Use route templates, bounded labels, suitable buckets, and PromQL comments.
Connect Logs and Traces
Review this Go service's OpenTelemetry setup. Preserve context across database and HTTP calls, correlate slog records, and propose sampling and exemplar settings.
Audit Production Coverage
Audit this Go repository across logs, metrics, traces, profiles, and analytics. Report evidence, security gaps, and prioritized fixes without changing production settings.
Mejores prácticas
- Validate library APIs and telemetry examples against the versions installed in your project.
- Use bounded metric labels, intentional sampling, and tested alert thresholds before production rollout.
- Protect profiling endpoints, redact secrets, and verify authorization and consent before processing user telemetry.
Evitar
- Copying examples into production without security review or integration tests.
- Using raw paths, user IDs, or request IDs as metric labels.
- Treating pseudonymous identifiers as anonymous data or assuming analytics examples guarantee compliance.
Preguntas frecuentes
Which assistants can use this skill?
The skill declares compatibility with Codex and Claude Code.
Does it install monitoring infrastructure?
No. It provides guidance and examples; you configure collectors, storage, dashboards, credentials, and deployment separately.
Which telemetry signals does it cover?
It covers structured logs, Prometheus metrics, OpenTelemetry traces, profiling, and server-side analytics.
Can it help migrate existing Go loggers?
Yes. It describes incremental migration from zap, logrus, and zerolog to slog through bridge handlers and call-site changes.
Does its analytics guidance guarantee GDPR or CCPA compliance?
No. Obtain privacy review, treat linkable user identifiers as personal data, and validate consent, authorization, retention, and deletion behavior.
Are the examples ready for production without changes?
No. Review credentials, transport encryption, endpoint authorization, metric labels, and failure handling before adapting them.