Versioned security assessment

Report ID: SA-DEF8987E

6/30/2026, 6:18:02 PM

service-mesh-observability security assessment v2

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
service-mesh-observability
Version
v2
Maintainer
sickn33
Source
github.com/sickn33/antigravity-awesome-skills/tree/main/skills/service-mesh-observability
Coverage
1 Files scanned · 396 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Medium

1 confirmed security finding requires attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Static analysis reported many high-risk patterns, but most are false positives from Markdown code fences, PromQL expressions, and documentation links. Real publish concerns remain in example manifests that enable anonymous Kiali access, wildcard namespace visibility, broad listener bindings, and insecure telemetry TLS settings.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 396 Lines analyzed

3 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 11 evidence locations

Filesystem access

May read or write local files.

Not recorded by this audit

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 1 evidence location

Capability review items (2)
Medium
SKILL.md:289-308
Insecure Telemetry Collector Example
The OpenTelemetry example binds receivers and a Prometheus exporter to 0.0.0.0 and disables TLS verification for the Jaeger exporter.
The endpoint and tls.insecure settings are visible in the example. The risk depends on deployment context, so the finding is medium rather than high.
Low
SKILL.md:172-190
Documented Cluster Commands Require Operator Review
The Linkerd section includes shell commands that install or query mesh observability components. They are legitimate examples but can alter a Kubernetes cluster if copied.
The commands are visible and relevant to the skill purpose. They are not hidden or malicious, but they deserve user review before execution.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (1)

RISK-001 Medium
SKILL.md:264-268
Anonymous Kiali Access Across All Namespaces
The Kiali example sets anonymous authentication and wildcard namespace access. If copied into a shared cluster, it can expose mesh topology and service metadata too broadly.
The configuration explicitly uses anonymous access and accessible_namespaces set to a wildcard. This is a clear copy-paste security risk, although it is documentation and not executed by the skill.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (4)
Low
SKILL.md:20SKILL.md:35SKILL.md:46SKILL.md:61SKILL.md:97SKILL.md:101SKILL.md:121SKILL.md:125SKILL.md:168SKILL.md:172SKILL.md:191SKILL.md:195SKILL.md:252SKILL.md:256SKILL.md:276SKILL.md:280SKILL.md:332SKILL.md:336
False Positive: Markdown Backticks Flagged as Ruby Shell Execution
The reported external command locations are Markdown code fences or inline resource references. The skill contains documentation, not Ruby code that executes shell backticks.
Line review shows Markdown fences and one bash example block. No Ruby runtime, interpolation, or automatic command execution path is present.
Low
SKILL.md:3SKILL.md:50SKILL.md:103SKILL.md:106-107SKILL.md:111-112SKILL.md:115SKILL.md:119-120SKILL.md:205-206SKILL.md:235-236SKILL.md:245SKILL.md:348-349SKILL.md:354SKILL.md:359SKILL.md:364
False Positive: Weak Cryptography Alerts Match Query Syntax
No weak cryptographic algorithm usage was found. The alerts map to service mesh text, PromQL rate windows, histogram queries, and alert annotations.
The reviewed lines contain observability descriptions and query expressions, not crypto APIs or hashing functions. The scanner appears to match short substrings in normal text.
Low
SKILL.md:215
False Positive: Path Traversal Alert in PromQL Regex
The path traversal alert is caused by a response-code regular expression in a Grafana query. It is not a filesystem path or file access operation.
The line is a PromQL expression matching 5xx response codes. There is no path handling, file read, or filesystem write behavior nearby.
Low
SKILL.md:271SKILL.md:273SKILL.md:275SKILL.md:392SKILL.md:393SKILL.md:394SKILL.md:395
Hardcoded URLs Are Documentation and Internal Service Examples
The hardcoded URLs point to in-cluster observability services and public documentation. They do not send secrets or perform outbound exfiltration.
The URLs are visible in YAML examples and resource links. No code path collects local data or transmits credentials to those endpoints.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable