스킬 groundcover-cli
📦
groundcover-cli
콘텐츠 리비전 r1 안전 ⚙️ 외부 명령어🌐 네트워크 접근📁 파일 시스템 접근🔑 환경 변수
Investigate Groundcover Production Issues
Production investigations require correlated logs, traces, metrics, and Kubernetes context. This skill provides Groundcover CLI workflows for querying telemetry and managing observability resources.
지원: Claude Codex Code(CC)
내 에이전트로 설치
이 요청을 에이전트에 복사하세요. 공식 Skill 페이지와 매니페스트가 포함되어 있습니다.
에이전트 요청
Review the Skillstore skill "groundcover-cli" from https://skillstore.io/skills/paymog-groundcover-cli.md and its manifest at https://skillstore.io/api/skills/paymog-groundcover-cli/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.에이전트는 계속해서 계획을 표시하고 보안 정책에서 요구하는 확인을 요청해야 합니다.
에이전트가 읽기 쉬운 리소스
AI 에이전트, 크롤러, 스크립트가 전체 페이지 대신 정리된 컨텍스트만 필요할 때 이 링크를 사용하세요.
테스트해 보기
"groundcover-cli" 사용 중입니다. Summarize a service incident after reviewing its telemetry.
예상 결과:
- Illustrative summary: Error logs show repeated upstream timeouts during the selected window.
- Slow traces overlap with elevated latency metrics.
- The available evidence suggests an upstream dependency issue, but does not establish the root cause.
- No production settings were changed.
"groundcover-cli" 사용 중입니다. Review a proposed dashboard change before applying it.
예상 결과:
- Illustrative review: Preserve the current revision and existing widgets.
- Place stat panels at the top level and check every panel against the 24-column grid.
- Validate each metric expression with a range query.
- The change remains unapplied pending approval; visual rendering has not been verified.
보안 감사
안전v1 • 2026. 10. 19. 버전별 보고서 열기
All 244 static findings were adjudicated; three overlapping detections confirm one unverified remote-installer execution risk. Other detections concern Markdown, documented authentication, standard input, or application identifiers. No evidence found of prompt injection, covert exfiltration, or malicious intent in the supplied skill text; external implementations were not reviewed.
1
스캔된 파일
513
분석된 줄 수
3
검토 항목
0
오탐 무시됨
기능 검토 항목 (3)
이 스킬에 대해 예상될 수 있는 실제 로컬 기능이므로 검토가 필요하지만, 확인된 악의적 동작으로는 집계되지 않습니다.
높음
Shell command substitution
sh -c "$(curl -fsSL https://groundcover.com/install.sh)" # installs to ~/.groundcover/bin
The command passes a downloaded HTTPS installer directly to sh without pinning or integrity verification. A compromised response could execute arbitrary local code.
높음
Template literal with command substitution
```sh
Although this is a Markdown shell fence, its recipe executes the downloaded installer through sh. The missing integrity check creates remote-code execution risk.
높음
Hardcoded URL
sh -c "$(curl -fsSL https://groundcover.com/install.sh)" # installs to ~/.groundcover/bin
The installer URL supplies code that is immediately executed by sh without integrity verification. HTTPS alone does not protect against compromised upstream content.
위험 요인
⚙️ 외부 명령어 (50)
SKILL.md:3 SKILL.md:8 SKILL.md:12-14 SKILL.md:14-16 SKILL.md:16 SKILL.md:17-18 SKILL.md:18-20 SKILL.md:20-22 SKILL.md:22 SKILL.md:25-26 SKILL.md:26-28 SKILL.md:28 SKILL.md:30 SKILL.md:32 SKILL.md:36 SKILL.md:38-46 SKILL.md:46-48 SKILL.md:48 SKILL.md:50 SKILL.md:56-57 SKILL.md:57-63 SKILL.md:63-64 SKILL.md:64-65 SKILL.md:65 SKILL.md:66 SKILL.md:67-69 SKILL.md:69 SKILL.md:73-75 SKILL.md:75 SKILL.md:76 SKILL.md:77 SKILL.md:78 SKILL.md:79 SKILL.md:80 SKILL.md:81 SKILL.md:82-83 SKILL.md:83 SKILL.md:84 SKILL.md:85 SKILL.md:86-87 SKILL.md:87 SKILL.md:89 SKILL.md:93-99 SKILL.md:99-101 SKILL.md:101 SKILL.md:105 SKILL.md:106-107 SKILL.md:107-109 SKILL.md:109-110 SKILL.md:110-112
🌐 네트워크 접근 (5)
📁 파일 시스템 접근 (22)
🔑 환경 변수 (4)
감사자: codex
이 보고서 공유 및 인용
버전이 지정된 평가 보고서, 중립 배지, 임베드 카드 및 인용을 공유하세요. Skillstore는 근거를 보고하지만 이 Skill의 안전 여부를 판단하지 않습니다.
보고서 링크 복사
https://skillstore.io/skills/paymog-groundcover-cli/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 배지
[](https://skillstore.io/skills/paymog-groundcover-cli?utm_source=security_passport_badge)HTML 배지
<a href="https://skillstore.io/skills/paymog-groundcover-cli?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/paymog-groundcover-cli/security.svg" alt="Skillstore security assessment" loading="lazy"></a>임베드 카드
<iframe src="https://skillstore.io/embed/skills/paymog-groundcover-cli.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>학술 인용 (APA · BibTeX · CFF)
APA 인용
paymog. (2026). groundcover-cli security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/paymog-groundcover-cli/audits/1BibTeX 인용
@techreport{paymog-paymog-groundcover-cli-2026,
author = {paymog},
title = {groundcover-cli security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/paymog-groundcover-cli/audits/1},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "groundcover-cli security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
- name: "paymog"
date-released: "2026-10-19"
url: "https://skillstore.io/skills/paymog-groundcover-cli/audits/1"
identifiers:
- type: other
value: "skillstore:paymog-groundcover-cli:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore 점수
이 점수의 이유 증거 신뢰도: 중간 55
아키텍처
85
유지보수성
87
콘텐츠
65
커뮤니티
78
사양 준수
만들 수 있는 것
Investigate Production Errors
Correlate service error logs, slow traces, latency metrics, and Kubernetes warnings within a defined incident window.
Validate Service Telemetry
Discover available metrics and labels, then compare request latency and error patterns for an application service.
Maintain Observability Dashboards
Inspect dashboard presets, prepare revision-aware changes, and validate queries and layout constraints before deployment.
이 프롬프트를 사용해 보세요
Check Authentication Setup
Explain how to check my Groundcover profile and authentication status without printing tokens. Do not install software or create credentials.
Review Recent Service Errors
Using my authorized profile, inspect error logs for service api over the last hour. Summarize recurring errors without exposing sensitive log values.
Correlate Latency and Restarts
Investigate api latency over the last 30 minutes using traces, PromQL range queries, and Kubernetes warnings. Separate observations from hypotheses; make no changes.
Prepare a Dashboard Update
Inspect dashboard <uuid> and propose p99 panels. Preserve its revision and existing widgets. Validate queries and layout; request approval before applying changes.
모범 사례
- Use authorized, least-privilege profiles and confirm the tenant and destination before querying or changing resources.
- Use narrow UTC windows and discriminating filters; remove secrets and personal data from shared findings.
- Preserve current revisions and complete settings; obtain approval before writes, alert silences, or software installation.
피하기
- Executing the remote installer without reviewing it and verifying a pinned artifact.
- Printing API tokens or copying unredacted production logs into reports.
- Silencing alerts or overwriting production dashboards without explicit approval and a recovery plan.
자주 묻는 질문
Does this skill include the Groundcover executable?
No. It provides CLI instructions and request templates. You must install the appropriate executable separately.
Which API key type is required?
Standard API workflows require a service-account key with the gcsa_ prefix. Ingestion keys do not authenticate these commands.
Can the same key access embedded Grafana?
No. The documented Grafana workflows require a separate glsa_ service-account token and tenant-admin setup.
Should I use SDK-backed or raw commands?
Prefer SDK-backed commands. Use raw endpoint discovery when the SDK lacks the required operation.
Can this skill change production resources?
Yes, its documented commands include updates, deletions, credential creation, and alert silences. Use least privilege and require approval for changes.
Why can an instant metric query fail?
The skill documents instant-query failures. Use a short range query and inspect the latest point, accounting for delayed metric ingestion.