Compétences golang-observability

📦

golang-observability

Name: golang-observability
Author: samber

v1.3.2 Révision du contenu r1 Risque élevé ⚙️ Commandes externes🌐 Accès réseau📁 Accès au système de fichiers🔑 Variables d’environnement⚡ Contient des scripts

Instrument Go Services for Production Observability

Missing telemetry makes production failures difficult to diagnose. This skill guides Go instrumentation with structured logs, metrics, traces, profiling, and analytics privacy considerations.

Prend en charge: Codex Code(CC)

⚠️ 38 Médiocre

Maintain this Skill? Claim it ⚠️ 38 Médiocre

Arrêtez-vous et demandez confirmation avant l’installation.

Examinez le plan et obtenez le consentement explicite de l’utilisateur avant de modifier des fichiers.

Installer avec mon Agent

Copiez cette demande dans votre Agent. Elle contient la page Skill de référence et le manifeste.

Demande d’agent

Review the Skillstore skill "golang-observability" from https://skillstore.io/skills/samber-golang-observability.md and its manifest at https://skillstore.io/api/skills/samber-golang-observability/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Votre Agent doit toujours présenter son plan et demander toute confirmation exigée par la politique de sécurité.

Ressources lisibles par les agents

Utilisez ces liens lorsqu’un Agent IA, un crawler ou un script a besoin d’un contexte propre au lieu de lire toute la page.

Détail Markdown GET /skills/samber-golang-observability.md manifest signé GET /api/skills/samber-golang-observability/manifest lockfile signé GET /api/skills/samber-golang-observability/lockfile

Tester

Utilisation de « golang-observability ». Review request metrics that label every request with its full path and user ID.

Résultat attendu:

Both labels can create unbounded time series and increase monitoring memory use.
Replace raw paths with route templates and remove user IDs from metric labels.
Use access-controlled traces for necessary user-level correlation.

Utilisation de « golang-observability ». Our 99.9% availability alert produces noise during short error spikes.

Résultat attendu:

Review the availability definition and error-budget calculation.
Pair short and long burn-rate windows to distinguish sustained degradation from brief spikes.
Validate thresholds and persistence durations against historical traffic before enabling paging.

Utilisation de « golang-observability ». Review a proposed production profiling integration.

Résultat attendu:

Keep pprof on a protected internal listener.
Use encrypted collector transport and redact credentials from startup logs.
Start with selected profile types and measure overhead on a limited replica set.

Audit de sécurité

Risque élevé

v1 • 18/10/2026 Ouvrir le rapport versionné

Most static findings are false positives involving Markdown, Go syntax, PromQL expressions, and evaluation fixtures; one profiling URL example encourages credentials over plaintext HTTP. Five additional findings cover credential logging, missing authorization in privacy examples, incomplete erasure reporting, unbounded metric labels, and misleading identifier privacy claims. No evidence found of malicious execution, unauthorized exfiltration intent, or audit-directed prompt injection.

Fichiers analysés

2,288

Lignes analysées

Éléments à examiner

Faux positifs ignorés

Préoccupations de sécurité confirmées (5)

Élevé

references/profiling.md:29-48

Profiling Startup Log Can Expose Collector Credentials

The success log emits the entire PYROSCOPE_URL. The same example permits embedded credentials, exposing them to log storage and downstream collectors.

The log directly reads the same environment variable illustrated with URL credentials. Exposure occurs when users adopt that documented credential format.

Élevé

references/rum.md:195-235

Privacy Handler Examples Omit Subject Authorization

Export and deletion handlers use chi.URLParam(r, "id") without checking caller ownership. Without external authorization, callers could export or delete another user's data.

Both handlers pass caller-selected IDs directly to sensitive repository operations. No authorization middleware is shown, so deployment exploitability depends on integration.

Moyen

references/rum.md:208-219

Erasure Handler Reports Success After Vendor Failures

Vendor deletion errors are logged without retry or failure propagation. The handler still reports completion and HTTP 204, potentially retaining analytics data after apparent erasure.

Both vendor error branches continue to an unconditional completion log and success response. No durable retry or pending deletion state appears.

Moyen

references/metrics.md:62-71

Latency Middleware Creates Unbounded Metric Labels

The latency middleware uses r.URL.Path directly as a histogram label. Attacker-controlled paths can create excessive time series and exhaust monitoring resources.

The example records raw paths instead of route templates. Later cardinality warnings do not change this copyable middleware example.

Moyen

references/rum.md:42-45 references/rum.md:243-248

Analytics Guidance Misclassifies Linkable User Identifiers

The guide calls internal user_id values "not PII" and repeats this in its privacy checklist. Linkable identifiers remain personal data despite replacing email.

The examples link identifiers to specific users and business events. Calling them non-personal can incorrectly exempt analytics data from privacy safeguards.

Éléments d’évaluation des capacités (1)

Il s’agit de capacités locales réelles qui peuvent être attendues pour cette compétence ; elles nécessitent donc un examen, mais ne sont pas comptabilisées comme comportement malveillant confirmé.

Moyen

references/profiling.md:31

Hardcoded URL

ServerAddress: os.Getenv("PYROSCOPE_URL"), // e.g., http://user:pass@pyroscope:4040

The example puts username and password credentials in a plaintext HTTP collector URL. Copying this configuration can expose authentication and profile data in transit.

Facteurs de risque

⚙️ Commandes externes (38)

🌐 Accès réseau (8)

evals/evals.json:116 references/metrics.md:206 references/profiling.md:31 SKILL.md:12 SKILL.md:54 SKILL.md:101 SKILL.md:143 SKILL.md:154

📁 Accès au système de fichiers (5)

evals/evals.json:62 evals/evals.json:75 evals/evals.json:89 evals/evals.json:169 evals/evals.json:401

🔑 Variables d’environnement (1)

references/rum.md:74

⚡ Contient des scripts (2)

references/tracing.md:27-33 references/tracing.md:134-136

Audité par: codex

Partager et citer ce rapport

Partagez le rapport d’évaluation versionné, le badge neutre, la carte intégrable et les citations. Skillstore présente les preuves sans décider si ce Skill est sûr.

Ouvrir le rapport versionné

Copier le lien du rapport

https://skillstore.io/skills/samber-golang-observability/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/samber-golang-observability/security.svg)](https://skillstore.io/skills/samber-golang-observability?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/samber-golang-observability?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/samber-golang-observability/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Carte intégrable

<iframe src="https://skillstore.io/embed/skills/samber-golang-observability.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citations académiques (APA · BibTeX · CFF)

Citation APA

samber. (2026). golang-observability security audit report (audit version 1) [Author version 1.3.2]. Skillstore. https://skillstore.io/skills/samber-golang-observability/audits/1

Citation BibTeX

@techreport{samber-samber-golang-observability-2026,
  author = {samber},
  title = {golang-observability security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/samber-golang-observability/audits/1},
  note = {Author version 1.3.2}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "golang-observability security audit report (audit version 1)"
version: "1.3.2"
type: report
authors:
  - name: "samber"
date-released: "2026-10-18"
url: "https://skillstore.io/skills/samber-golang-observability/audits/1"
identifiers:
  - type: other
    value: "skillstore:samber-golang-observability:audit:1"
    description: "Skillstore immutable audit report identifier"

Score Skillstore

Pourquoi ce score Niveau de confiance des preuves: Moyen

Architecture

100

Maintenabilité

Contenu

Communauté

100

Conformité aux spécifications

Ce que vous pouvez créer

Instrument a New Go API

Add request metrics, structured logs, and trace spans before releasing a new service.

Improve Production Alerting

Review metric labels, latency histograms, and error-budget alerts to reduce monitoring noise and identify coverage gaps.

Review Analytics Data Flows

Evaluate server-side event tracking, consent handling, identifiers, and deletion workflows with engineering and privacy stakeholders.

Essayez ces prompts

Review Basic Logging

Review this Go handler for structured slog fields, context propagation, log levels, and sensitive data. Explain the smallest useful changes.

Add Request Metrics

Instrument this Go router with request counters and latency histograms. Use route templates, bounded labels, suitable buckets, and PromQL comments.

Connect Logs and Traces

Review this Go service's OpenTelemetry setup. Preserve context across database and HTTP calls, correlate slog records, and propose sampling and exemplar settings.

Audit Production Coverage

Audit this Go repository across logs, metrics, traces, profiles, and analytics. Report evidence, security gaps, and prioritized fixes without changing production settings.

Bonnes pratiques

Validate library APIs and telemetry examples against the versions installed in your project.
Use bounded metric labels, intentional sampling, and tested alert thresholds before production rollout.
Protect profiling endpoints, redact secrets, and verify authorization and consent before processing user telemetry.

Éviter

Copying examples into production without security review or integration tests.
Using raw paths, user IDs, or request IDs as metric labels.
Treating pseudonymous identifiers as anonymous data or assuming analytics examples guarantee compliance.