Skills py-observability
📦
py-observability
Content revision r1 Medium Risk ⚙️ External commands🔑 Env variables
Add Python Observability
Python services are difficult to debug when logs, metrics, and traces are inconsistent. This skill provides practical patterns for structured logging, Prometheus metrics, Sentry setup, health checks, and redaction.
Supports: Claude Codex Code(CC)
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "py-observability" from https://skillstore.io/skills/cjharmath-py-observability.md and its manifest at https://skillstore.io/api/skills/cjharmath-py-observability/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "py-observability". Add observability to a FastAPI endpoint that submits an assessment.
Expected outcome:
- Adds a request-scoped identifier to every log entry.
- Records request duration and submission status metrics.
- Logs validation failures with user and assessment context after redaction.
Using "py-observability". Review a production workflow that is hard to debug.
Expected outcome:
- Identifies silent returns and missing failure logs.
- Recommends a flow identifier for each multi-step operation.
- Adds checklist items for Sentry context, metrics, and health checks.
Using "py-observability". Add safe error tracking to a Python backend.
Expected outcome:
- Configures Sentry integrations with controlled sampling.
- Adds event tags and context for debugging.
- Flags personal data that should be omitted, hashed, or redacted.
Security Audit
Medium Riskv7 • 7/6/2026 Open versioned report
Static findings for external commands, environment access, and reconnaissance are false positives caused by Markdown code fences, redaction key names, and request correlation examples. No prompt injection or malicious executable behavior was found in SKILL.md. Semantic review found privacy and information disclosure risks in the Sentry user context and readiness endpoint examples.
1
Files scanned
507
Lines analyzed
0
Review items
0
False positives ignored
Confirmed security concerns (2)
Medium
Personal Data Sent to Error Tracking
The Sentry example disables default PII capture but then explicitly sets user context with an email address. This can send personal data to a third-party error tracking service unless the team has consent, retention, and redaction controls.
The cited lines import Sentry user context helpers and set the user email explicitly. The privacy risk is clear, although it may be acceptable in some deployments with proper policy controls.
Medium
Detailed Dependency Errors in Readiness Response
The readiness check returns raw exception text for database and Redis failures. Public or broadly accessible health endpoints can expose infrastructure details and internal error messages.
The cited readiness endpoint places exception strings directly into response fields. This is a common information disclosure issue when health endpoints are exposed outside trusted operators.
Risk Factors
⚙️ External commands (23)
SKILL.md:18-44 SKILL.md:44-48 SKILL.md:48-89 SKILL.md:89-97 SKILL.md:97-128 SKILL.md:128-134 SKILL.md:134-165 SKILL.md:165-173 SKILL.md:173-189 SKILL.md:189-195 SKILL.md:195-215 SKILL.md:215-221 SKILL.md:221-267 SKILL.md:267-271 SKILL.md:271-310 SKILL.md:310-316 SKILL.md:316-359 SKILL.md:359-367 SKILL.md:367-414 SKILL.md:414-420 SKILL.md:420-457 SKILL.md:457-463 SKILL.md:463-483
🔑 Env variables (2)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/cjharmath-py-observability/audits/7?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/cjharmath-py-observability?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/cjharmath-py-observability?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/cjharmath-py-observability/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/cjharmath-py-observability.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
CJHarmath. (2026). py-observability security audit report (audit version 7) [Author version unspecified]. Skillstore. https://skillstore.io/skills/cjharmath-py-observability/audits/7BibTeX citation
@techreport{cjharmath-cjharmath-py-observability-2026,
author = {CJHarmath},
title = {py-observability security audit report (audit version 7)},
institution = {Skillstore},
year = {2026},
number = {7},
url = {https://skillstore.io/skills/cjharmath-py-observability/audits/7},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "py-observability security audit report (audit version 7)"
version: "unspecified"
type: report
authors:
- name: "CJHarmath"
date-released: "2026-07-06"
url: "https://skillstore.io/skills/cjharmath-py-observability/audits/7"
identifiers:
- type: other
value: "skillstore:cjharmath-py-observability:audit:7"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: High 55
Architecture
85
Maintainability
87
Content
71
Community
78
Spec Compliance
What You Can Build
Instrument a FastAPI Service
Add request IDs, structured logs, metrics, and readiness checks to a Python backend.
Improve Incident Debugging
Make failures easier to trace with contextual logs, flow IDs, and Sentry events.
Review Observability Coverage
Use the checklist to find missing logs, metrics, redaction, and health checks before release.
Try These Prompts
Add Basic Logging
Use the py-observability skill to add structured logging to this Python endpoint. Include request context and useful event names.
Add Metrics
Use the py-observability skill to add Prometheus metrics for this FastAPI route. Include request duration and success or failure counters.
Prepare Production Debugging
Use the py-observability skill to instrument this multi-step workflow. Add flow tracing, error context, metrics, and sensitive data redaction.
Audit Observability Design
Use the py-observability skill to review this service for observability gaps. Identify missing logs, metrics, traces, health checks, and privacy risks.
Best Practices
- Use stable event names and structured fields instead of formatted log messages.
- Redact secrets and personal data before sending logs or error events.
- Add metrics and health checks beside the code paths they describe.
Avoid
- Do not log raw request bodies, credentials, tokens, or authorization headers.
- Do not expose detailed dependency errors from public health endpoints.
- Do not add high-cardinality labels such as user IDs to Prometheus metrics.
Frequently Asked Questions
What Python frameworks does this skill target?
The examples focus on FastAPI, structlog, Prometheus, Sentry, and SQLAlchemy patterns.
Does it install monitoring tools?
No. It provides implementation patterns that you adapt to your existing dependencies and deployment.
Can it help with production incidents?
Yes. It suggests request IDs, flow IDs, contextual errors, metrics, and checklists for faster debugging.
Does it handle sensitive data safely?
It includes redaction examples, but teams should strengthen them for their privacy and compliance requirements.
Can Claude, Codex, and Claude Code use it?
Yes. The report lists support for Claude, Codex, and Claude Code compatible workflows.
Is it a complete observability architecture?
No. It is a pattern library for application code, not a full logging, tracing, alerting, or dashboard system.