スキル instrument-app

📦

instrument-app

Name: instrument-app
Author: logbrewco

コンテンツリビジョン r1 中リスク ⚡ スクリプトを含む⚙️ 外部コマンド🔑 環境変数📁 ファイルシステムへのアクセス

Instrument Your App with LogBrew

Application errors and logs can be difficult to trace across deployments. This skill configures LogBrew instrumentation and checks that a test event can be read back.

対応: Claude Codex Code(CC)

⚠️ 50 不十分

Maintain this Skill? Claim it ⚠️ 50 不十分

自分のエージェントでインストール

このリクエストをエージェントにコピーしてください。正規の Skill ページとマニフェストが含まれています。

エージェントリクエスト

Review the Skillstore skill "instrument-app" from https://skillstore.io/skills/logbrewco-instrument-app.md and its manifest at https://skillstore.io/api/skills/logbrewco-instrument-app/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

エージェントは引き続き計画を提示し、セキュリティポリシーで必要な確認を求める必要があります。

エージェントが読めるリソース

AI エージェント、クローラー、スクリプトがページ全体ではなく整理されたコンテキストを必要とする場合は、これらのリンクを使ってください。

Markdown詳細 GET /skills/logbrewco-instrument-app.md 署名済み manifest GET /api/skills/logbrewco-instrument-app/manifest 署名済み lockfile GET /api/skills/logbrewco-instrument-app/lockfile

テストする

「instrument-app」を使用しています。 Instrument an Express service and verify delivery.

期待される結果:

The service uses the Express integration. The test event was read back with the expected service, environment, and release.

「instrument-app」を使用しています。 Check why a test event is missing.

期待される結果:

The read-back returned no event. Check the project, time range, ingest key, and client flush behavior before reporting success.

セキュリティ監査

中リスク

v1 • 2026/10/27 バージョン別レポートを開く

Most static matches are Markdown, SDK configuration, or safe secret-handling guidance. The Rails key export can expose a secret in shell history, and the workflow should validate install commands and review existing logs before forwarding them.

スキャンされたファイル

520

解析済み行数

レビュー項目

誤検知を無視

確認済みのセキュリティ上の懸念 (2)

中

SKILL.md:42-45 SKILL.md:73-75

Unreviewed generated install command

The instructions execute the CLI-provided install command without requiring validation of its executable, arguments, or package source. A compromised CLI or manipulated output could cause unintended command execution.

The instructions explicitly use and run the generated command, but exploitation depends on compromised or manipulated CLI output.

中

SKILL.md:85-86 SKILL.md:23-24

Existing logs may expose sensitive data

Connecting the existing logger can send current logs to an external service without first checking their contents. Existing records may contain sensitive data despite the rules for newly added logs.

The skill forwards current logs while applying logging rules to added events; exposure depends on the existing application logs and SDK privacy settings.

機能レビュー項目 (1)

これらは、このスキルに期待される可能性のある実際のローカル機能であるため、レビューが必要ですが、確認済みの悪意ある動作としてはカウントされません。

高

references/frameworks.md:282

Generic API/secret keys

export LOGBREW_SERVER_API_KEY="your project-scoped server ingest key"

The shell export example invites entry of an actual ingest key in a command, which can persist in shell history.

リスク要因

⚡ スクリプトを含む (1)

references/frameworks.md:209-221

⚙️ 外部コマンド (31)

🔑 環境変数 (17)

references/frameworks.md:51 references/frameworks.md:86 references/frameworks.md:51 references/frameworks.md:86 references/frameworks.md:148 references/frameworks.md:178 references/frameworks.md:51 references/frameworks.md:86 references/frameworks.md:148 references/frameworks.md:178 references/frameworks.md:198 references/frameworks.md:230 references/frameworks.md:282 references/frameworks.md:286 references/frameworks.md:292 SKILL.md:79 SKILL.md:129

📁 ファイルシステムへのアクセス (3)

SKILL.md:63 SKILL.md:64 SKILL.md:65

監査者: codex

このレポートを共有・引用

バージョン付き評価レポート、中立的なバッジ、埋め込みカード、引用を共有できます。Skillstore は証拠を報告しますが、この Skill が安全かどうかは判断しません。

バージョン別レポートを開く

レポートリンクをコピー

https://skillstore.io/skills/logbrewco-instrument-app/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdownバッジ

[![Skillstore security assessment](https://skillstore.io/badges/skills/logbrewco-instrument-app/security.svg)](https://skillstore.io/skills/logbrewco-instrument-app?utm_source=security_passport_badge)

HTMLバッジ

<a href="https://skillstore.io/skills/logbrewco-instrument-app?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/logbrewco-instrument-app/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

埋め込みカード

<iframe src="https://skillstore.io/embed/skills/logbrewco-instrument-app.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学術引用 (APA · BibTeX · CFF)

APA形式の引用

logbrewco. (2026). instrument-app security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/logbrewco-instrument-app/audits/1

BibTeX形式の引用

@techreport{logbrewco-logbrewco-instrument-app-2026,
  author = {logbrewco},
  title = {instrument-app security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/logbrewco-instrument-app/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "instrument-app security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "logbrewco"
date-released: "2026-10-27"
url: "https://skillstore.io/skills/logbrewco-instrument-app/audits/1"
identifiers:
  - type: other
    value: "skillstore:logbrewco-instrument-app:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore スコア

このスコアの理由証拠の信頼度: 中

アーキテクチャ

保守性

コンテンツ

コミュニティ

仕様準拠

作成できるもの

Instrument a web service

Add server-side error capture and structured logging to an existing service.

Verify a deployment

Send a test event and confirm its service, environment, and release.

Improve logging practices

Review event fields, secret handling, and trace correlation guidance.

これらのプロンプトを試す

Review the application

Identify the framework, existing logger, and entry point in this application.

Add instrumentation

Set up LogBrew for this application using its existing framework and secret configuration.

Verify delivery

Send a safe test event and verify its service, environment, and release by reading it back.

Review an existing integration

Inspect the existing instrumentation for duplicate senders, sensitive log fields, release metadata, and shutdown flushing.

ベストプラクティス

Store ingest keys in protected secret configuration and never paste them into chat.
Review existing logs and SDK capture defaults for sensitive data before forwarding.
Confirm the test event through read-back and verify its deployment metadata.

回避

Treat an accepted send as proof that an event is readable.
Add a second sender for the same signal without discussing existing instrumentation.
Log credentials, full request bodies, or unnecessary personal data.