Skills datadog-automation
📦

datadog-automation

Content revision r2 Medium Risk ⚙️ External commands🌐 Network access

Automate Datadog Monitoring Operations

Manual Datadog investigations and configuration changes consume operational time. This skill guides metrics, logs, monitors, dashboards, events, downtimes, hosts, and traces through Rube MCP.

Supports: Claude Codex Code(CC)
⚠️ 50 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "datadog-automation" from https://skillstore.io/skills/sickn33-datadog-automation.md and its manifest at https://skillstore.io/api/skills/sickn33-datadog-automation/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/sickn33-datadog-automation.md Signed manifest GET /api/skills/sickn33-datadog-automation/manifest Signed lockfile GET /api/skills/sickn33-datadog-automation/lockfile

Test it

Using "datadog-automation". Query average CPU usage for host web01 during the last hour.

Expected outcome:

  • Average CPU usage was 64 percent, with a peak of 92 percent at 14:18 UTC.
  • Usage exceeded 85 percent for seven minutes.
  • No metric gaps appeared in the requested window.

Using "datadog-automation". Investigate checkout service errors from 09:00 to 09:30 UTC.

Expected outcome:

Error volume increased after 09:12 UTC and aligned with database timeout logs. Two traces show elevated database latency; deployment correlation remains unverified.

Using "datadog-automation". Schedule downtime for env:staging during tomorrow's maintenance.

Expected outcome:

Prepared a bounded staging downtime with the requested window and affected monitor scope. Creation is paused pending explicit confirmation.

Security Audit

Medium Risk
v5 • 7/23/2026 Open versioned report

All 80 shell-backtick findings and eight reconnaissance findings are false positives caused by Markdown formatting, Datadog identifiers, and query examples. The Rube MCP URL is a confirmed low-severity external dependency. Semantic review found missing confirmation controls for alert suppression and irreversible dashboard deletion.

1
Files scanned
245
Lines analyzed
1
Review items
0
False positives ignored

Confirmed security concerns (2)

Medium
SKILL.md:78-83SKILL.md:129-150
Alert suppression lacks confirmation controls
The workflow can mute monitors or create broad downtimes without requiring explicit confirmation, scope review, or a bounded duration.
The cited workflows expose monitor muting and scoped downtime creation. The text recommends an end time but does not require approval before suppressing alerts.
Medium
SKILL.md:103-122
Irreversible dashboard deletion lacks confirmation
The workflow exposes permanent dashboard deletion and warns that no undo exists, but it does not require identity verification, backup, or user confirmation.
The cited section explicitly describes DATADOG_DELETE_DASHBOARD as irreversible and permanent. No mandatory confirmation or recovery step is provided.
Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Low
SKILL.md:21
Hardcoded URL
**Get Rube MCP**: Add `https://rube.app/mcp` as an MCP server in your client configuration. No API k
The skill explicitly directs users to add https://rube.app/mcp and authenticate Datadog through it, creating a real third-party network dependency. This matches the declared integration.

Risk Factors

⚙️ External commands (50)
SKILL.md:16 SKILL.md:17 SKILL.md:21 SKILL.md:24 SKILL.md:25 SKILL.md:36 SKILL.md:37 SKILL.md:40 SKILL.md:41 SKILL.md:42 SKILL.md:43 SKILL.md:46 SKILL.md:47 SKILL.md:48 SKILL.md:49 SKILL.md:57 SKILL.md:58 SKILL.md:61 SKILL.md:62 SKILL.md:63 SKILL.md:64 SKILL.md:65 SKILL.md:68 SKILL.md:78 SKILL.md:79 SKILL.md:80 SKILL.md:81 SKILL.md:82 SKILL.md:83 SKILL.md:86 SKILL.md:87 SKILL.md:88 SKILL.md:89 SKILL.md:90 SKILL.md:91 SKILL.md:92 SKILL.md:95 SKILL.md:96 SKILL.md:97 SKILL.md:106 SKILL.md:107 SKILL.md:108 SKILL.md:109 SKILL.md:112 SKILL.md:113 SKILL.md:114 SKILL.md:115 SKILL.md:116 SKILL.md:120 SKILL.md:129
🌐 Network access (1)
SKILL.md:21
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/sickn33-datadog-automation/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/sickn33-datadog-automation/security.svg)](https://skillstore.io/skills/sickn33-datadog-automation?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/sickn33-datadog-automation?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-datadog-automation/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/sickn33-datadog-automation.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

sickn33. (2026). datadog-automation security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-datadog-automation/audits/5

BibTeX citation

@techreport{sickn33-sickn33-datadog-automation-2026, author = {sickn33}, title = {datadog-automation security audit report (audit version 5)}, institution = {Skillstore}, year = {2026}, number = {5}, url = {https://skillstore.io/skills/sickn33-datadog-automation/audits/5}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "datadog-automation security audit report (audit version 5)" version: "unspecified" type: report authors: - name: "sickn33" date-released: "2026-07-23" url: "https://skillstore.io/skills/sickn33-datadog-automation/audits/5" identifiers: - type: other value: "skillstore:sickn33-datadog-automation:audit:5" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High
55
Architecture
85
Maintainability
87
Content
68
Community
83
Spec Compliance

What You Can Build

Investigate Production Incidents

Correlate service metrics, error logs, hosts, and traces within a defined incident window.

Maintain Alerting

Inspect monitor settings, prepare threshold changes, and schedule bounded maintenance downtimes.

Administer Observability Assets

Review dashboards, publish deployment events, and inventory reporting hosts across environments.

Try These Prompts

Query Host CPU 
Search current Datadog tools, then query average CPU usage for {host} from {start_time} to {end_time}. Summarize peaks, averages, and data gaps.
Investigate Service Errors 
Investigate {service} errors between {start_time} and {end_time}. Search current tools, query relevant metrics and logs, then summarize likely causes with evidence.
Prepare Maintenance Downtime 
Draft a Datadog downtime for {scope} from {start_time} to {end_time}. Show affected monitors and request explicit confirmation before creating it.
Correlate an Incident 
Analyze incident {incident_id} across {services}. Correlate metrics, logs, monitor states, hosts, and trace {trace_id}; rank hypotheses and identify missing evidence.

Best Practices

  • Search current Rube tool schemas before selecting tools or parameters.
  • Use narrow time windows, explicit tag scopes, bounded result limits, and pagination.
  • Require explicit confirmation before mutations, especially monitor muting, downtimes, dashboard changes, and deletions.

Avoid

  • Do not assume documented tool names or parameter schemas remain current.
  • Do not create broad or indefinite downtimes, mute monitors, or delete dashboards without approval.
  • Do not expose sensitive log, trace, host, or monitor data beyond the requested scope.

Frequently Asked Questions

What connection does this skill require?
It requires Rube MCP and an active Datadog connection authenticated through the returned authorization flow.
Does it require a Datadog API key in the prompt?
No. Authentication occurs through the Rube MCP connection flow, and credentials should never appear in prompts.
Can it change Datadog configuration?
Yes. It can create or update monitors, update dashboards, mute alerts, create downtimes, and delete dashboards when tools permit.
Can it search historical logs and metrics?
Yes, within Datadog retention limits, account permissions, valid time ranges, and endpoint rate limits.
How does it handle changing tool schemas?
Each workflow should search Rube MCP for current Datadog tool definitions before making calls.
What requires extra review?
Monitor muting, downtimes, dashboard updates, and deletions require scope review, explicit approval, and a recovery plan.

Developer Details

Author

sickn33

License

MIT

Skillstore revision

r2

Version notice

The author did not declare a version.

Repository

https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/datadog-automation

Ref

f9e2c34b4f19c7f3e6b0a1e93227b5f77cc12526

Maintenance freshness

7/26/2026

Usage

9 downloads · 97 views

File structure

📄 SKILL.md