스킬 golang-observability
📦
golang-observability
v1.3.2 콘텐츠 리비전 r1 높은 위험 ⚙️ 외부 명령어🌐 네트워크 접근📁 파일 시스템 접근🔑 환경 변수⚡ 스크립트 포함
Instrument Go Services for Production Observability
Missing telemetry makes production failures difficult to diagnose. This skill guides Go instrumentation with structured logs, metrics, traces, profiling, and analytics privacy considerations.
지원: Codex Code(CC)
설치 전에 중지하고 확인을 요청하세요.
계획을 검토하고 파일을 변경하기 전에 사용자의 명시적 동의를 받으세요.
내 에이전트로 설치
이 요청을 에이전트에 복사하세요. 공식 Skill 페이지와 매니페스트가 포함되어 있습니다.
에이전트 요청
Review the Skillstore skill "golang-observability" from https://skillstore.io/skills/samber-golang-observability.md and its manifest at https://skillstore.io/api/skills/samber-golang-observability/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.에이전트는 계속해서 계획을 표시하고 보안 정책에서 요구하는 확인을 요청해야 합니다.
에이전트가 읽기 쉬운 리소스
AI 에이전트, 크롤러, 스크립트가 전체 페이지 대신 정리된 컨텍스트만 필요할 때 이 링크를 사용하세요.
테스트해 보기
"golang-observability" 사용 중입니다. Review request metrics that label every request with its full path and user ID.
예상 결과:
- Both labels can create unbounded time series and increase monitoring memory use.
- Replace raw paths with route templates and remove user IDs from metric labels.
- Use access-controlled traces for necessary user-level correlation.
"golang-observability" 사용 중입니다. Our 99.9% availability alert produces noise during short error spikes.
예상 결과:
- Review the availability definition and error-budget calculation.
- Pair short and long burn-rate windows to distinguish sustained degradation from brief spikes.
- Validate thresholds and persistence durations against historical traffic before enabling paging.
"golang-observability" 사용 중입니다. Review a proposed production profiling integration.
예상 결과:
- Keep pprof on a protected internal listener.
- Use encrypted collector transport and redact credentials from startup logs.
- Start with selected profile types and measure overhead on a limited replica set.
보안 감사
높은 위험v1 • 2026. 10. 18. 버전별 보고서 열기
Most static findings are false positives involving Markdown, Go syntax, PromQL expressions, and evaluation fixtures; one profiling URL example encourages credentials over plaintext HTTP. Five additional findings cover credential logging, missing authorization in privacy examples, incomplete erasure reporting, unbounded metric labels, and misleading identifier privacy claims. No evidence found of malicious execution, unauthorized exfiltration intent, or audit-directed prompt injection.
9
스캔된 파일
2,288
분석된 줄 수
1
검토 항목
0
오탐 무시됨
확인된 보안 우려 사항 (5)
높음
Profiling Startup Log Can Expose Collector Credentials
The success log emits the entire PYROSCOPE_URL. The same example permits embedded credentials, exposing them to log storage and downstream collectors.
The log directly reads the same environment variable illustrated with URL credentials. Exposure occurs when users adopt that documented credential format.
높음
Privacy Handler Examples Omit Subject Authorization
Export and deletion handlers use chi.URLParam(r, "id") without checking caller ownership. Without external authorization, callers could export or delete another user's data.
Both handlers pass caller-selected IDs directly to sensitive repository operations. No authorization middleware is shown, so deployment exploitability depends on integration.
중간
Erasure Handler Reports Success After Vendor Failures
Vendor deletion errors are logged without retry or failure propagation. The handler still reports completion and HTTP 204, potentially retaining analytics data after apparent erasure.
Both vendor error branches continue to an unconditional completion log and success response. No durable retry or pending deletion state appears.
중간
Latency Middleware Creates Unbounded Metric Labels
The latency middleware uses r.URL.Path directly as a histogram label. Attacker-controlled paths can create excessive time series and exhaust monitoring resources.
The example records raw paths instead of route templates. Later cardinality warnings do not change this copyable middleware example.
중간
Analytics Guidance Misclassifies Linkable User Identifiers
The guide calls internal user_id values "not PII" and repeats this in its privacy checklist. Linkable identifiers remain personal data despite replacing email.
The examples link identifiers to specific users and business events. Calling them non-personal can incorrectly exempt analytics data from privacy safeguards.
기능 검토 항목 (1)
이 스킬에 대해 예상될 수 있는 실제 로컬 기능이므로 검토가 필요하지만, 확인된 악의적 동작으로는 집계되지 않습니다.
중간
Hardcoded URL
ServerAddress: os.Getenv("PYROSCOPE_URL"), // e.g., http://user:pass@pyroscope:4040
The example puts username and password credentials in a plaintext HTTP collector URL. Copying this configuration can expose authentication and profile data in transit.
위험 요인
⚙️ 외부 명령어 (38)
evals/evals.json:360 SKILL.md:3 SKILL.md:24 SKILL.md:32 SKILL.md:42 SKILL.md:44 SKILL.md:47 SKILL.md:58 SKILL.md:59 SKILL.md:60 SKILL.md:61 SKILL.md:62 SKILL.md:66 SKILL.md:68-73 SKILL.md:73-81 SKILL.md:81-91 SKILL.md:91 SKILL.md:93-95 SKILL.md:95 SKILL.md:101 SKILL.md:109-111 SKILL.md:111-121 SKILL.md:121-125 SKILL.md:125-134 SKILL.md:134-138 SKILL.md:138 SKILL.md:142 SKILL.md:144 SKILL.md:152 SKILL.md:153-155 SKILL.md:155-159 SKILL.md:159-170 SKILL.md:170-172 SKILL.md:172-178 SKILL.md:178-180 SKILL.md:180-186 SKILL.md:186-188 SKILL.md:188-200
🌐 네트워크 접근 (8)
📁 파일 시스템 접근 (5)
🔑 환경 변수 (1)
⚡ 스크립트 포함 (2)
감사자: codex
이 보고서 공유 및 인용
버전이 지정된 평가 보고서, 중립 배지, 임베드 카드 및 인용을 공유하세요. Skillstore는 근거를 보고하지만 이 Skill의 안전 여부를 판단하지 않습니다.
보고서 링크 복사
https://skillstore.io/skills/samber-golang-observability/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 배지
[](https://skillstore.io/skills/samber-golang-observability?utm_source=security_passport_badge)HTML 배지
<a href="https://skillstore.io/skills/samber-golang-observability?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/samber-golang-observability/security.svg" alt="Skillstore security assessment" loading="lazy"></a>임베드 카드
<iframe src="https://skillstore.io/embed/skills/samber-golang-observability.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>학술 인용 (APA · BibTeX · CFF)
APA 인용
samber. (2026). golang-observability security audit report (audit version 1) [Author version 1.3.2]. Skillstore. https://skillstore.io/skills/samber-golang-observability/audits/1BibTeX 인용
@techreport{samber-samber-golang-observability-2026,
author = {samber},
title = {golang-observability security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/samber-golang-observability/audits/1},
note = {Author version 1.3.2}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "golang-observability security audit report (audit version 1)"
version: "1.3.2"
type: report
authors:
- name: "samber"
date-released: "2026-10-18"
url: "https://skillstore.io/skills/samber-golang-observability/audits/1"
identifiers:
- type: other
value: "skillstore:samber-golang-observability:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore 점수
이 점수의 이유 증거 신뢰도: 중간 45
아키텍처
100
유지보수성
87
콘텐츠
65
커뮤니티
100
사양 준수
만들 수 있는 것
Instrument a New Go API
Add request metrics, structured logs, and trace spans before releasing a new service.
Improve Production Alerting
Review metric labels, latency histograms, and error-budget alerts to reduce monitoring noise and identify coverage gaps.
Review Analytics Data Flows
Evaluate server-side event tracking, consent handling, identifiers, and deletion workflows with engineering and privacy stakeholders.
이 프롬프트를 사용해 보세요
Review Basic Logging
Review this Go handler for structured slog fields, context propagation, log levels, and sensitive data. Explain the smallest useful changes.
Add Request Metrics
Instrument this Go router with request counters and latency histograms. Use route templates, bounded labels, suitable buckets, and PromQL comments.
Connect Logs and Traces
Review this Go service's OpenTelemetry setup. Preserve context across database and HTTP calls, correlate slog records, and propose sampling and exemplar settings.
Audit Production Coverage
Audit this Go repository across logs, metrics, traces, profiles, and analytics. Report evidence, security gaps, and prioritized fixes without changing production settings.
모범 사례
- Validate library APIs and telemetry examples against the versions installed in your project.
- Use bounded metric labels, intentional sampling, and tested alert thresholds before production rollout.
- Protect profiling endpoints, redact secrets, and verify authorization and consent before processing user telemetry.
피하기
- Copying examples into production without security review or integration tests.
- Using raw paths, user IDs, or request IDs as metric labels.
- Treating pseudonymous identifiers as anonymous data or assuming analytics examples guarantee compliance.
자주 묻는 질문
Which assistants can use this skill?
The skill declares compatibility with Codex and Claude Code.
Does it install monitoring infrastructure?
No. It provides guidance and examples; you configure collectors, storage, dashboards, credentials, and deployment separately.
Which telemetry signals does it cover?
It covers structured logs, Prometheus metrics, OpenTelemetry traces, profiling, and server-side analytics.
Can it help migrate existing Go loggers?
Yes. It describes incremental migration from zap, logrus, and zerolog to slog through bridge handlers and call-site changes.
Does its analytics guidance guarantee GDPR or CCPA compliance?
No. Obtain privacy review, treat linkable user identifiers as personal data, and validate consent, authorization, retention, and deletion behavior.
Are the examples ready for production without changes?
No. Review credentials, transport encryption, endpoint authorization, metric labels, and failure handling before adapting them.