技能 golang-observability
📦
golang-observability
v1.3.2 內容修訂 r1 高風險 ⚙️ 外部命令🌐 網路存取📁 檔案系統存取🔑 環境變數⚡ 包含腳本
Instrument Go Services for Production Observability
Missing telemetry makes production failures difficult to diagnose. This skill guides Go instrumentation with structured logs, metrics, traces, profiling, and analytics privacy considerations.
支援: Codex Code(CC)
安裝前請停止並請求確認。
請審查安裝計畫，並在變更檔案前取得使用者明確同意。
使用我的智慧代理安裝
將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。
智能體請求
Review the Skillstore skill "golang-observability" from https://skillstore.io/skills/samber-golang-observability.md and its manifest at https://skillstore.io/api/skills/samber-golang-observability/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。
Agent 可讀資源
當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。
測試它
正在使用「golang-observability」。 Review request metrics that label every request with its full path and user ID.
預期結果:
- Both labels can create unbounded time series and increase monitoring memory use.
- Replace raw paths with route templates and remove user IDs from metric labels.
- Use access-controlled traces for necessary user-level correlation.
正在使用「golang-observability」。 Our 99.9% availability alert produces noise during short error spikes.
預期結果:
- Review the availability definition and error-budget calculation.
- Pair short and long burn-rate windows to distinguish sustained degradation from brief spikes.
- Validate thresholds and persistence durations against historical traffic before enabling paging.
正在使用「golang-observability」。 Review a proposed production profiling integration.
預期結果:
- Keep pprof on a protected internal listener.
- Use encrypted collector transport and redact credentials from startup logs.
- Start with selected profile types and measure overhead on a limited replica set.
安全審計
高風險v1 • 2026/10/18 開啟版本化報告
Most static findings are false positives involving Markdown, Go syntax, PromQL expressions, and evaluation fixtures; one profiling URL example encourages credentials over plaintext HTTP. Five additional findings cover credential logging, missing authorization in privacy examples, incomplete erasure reporting, unbounded metric labels, and misleading identifier privacy claims. No evidence found of malicious execution, unauthorized exfiltration intent, or audit-directed prompt injection.
9
已掃描檔案
2,288
分析行數
1
複核項目
0
已忽略的誤報
已確認的安全問題 (5)
高
Profiling Startup Log Can Expose Collector Credentials
The success log emits the entire PYROSCOPE_URL. The same example permits embedded credentials, exposing them to log storage and downstream collectors.
The log directly reads the same environment variable illustrated with URL credentials. Exposure occurs when users adopt that documented credential format.
高
Privacy Handler Examples Omit Subject Authorization
Export and deletion handlers use chi.URLParam(r, "id") without checking caller ownership. Without external authorization, callers could export or delete another user's data.
Both handlers pass caller-selected IDs directly to sensitive repository operations. No authorization middleware is shown, so deployment exploitability depends on integration.
中
Erasure Handler Reports Success After Vendor Failures
Vendor deletion errors are logged without retry or failure propagation. The handler still reports completion and HTTP 204, potentially retaining analytics data after apparent erasure.
Both vendor error branches continue to an unconditional completion log and success response. No durable retry or pending deletion state appears.
中
Latency Middleware Creates Unbounded Metric Labels
The latency middleware uses r.URL.Path directly as a histogram label. Attacker-controlled paths can create excessive time series and exhaust monitoring resources.
The example records raw paths instead of route templates. Later cardinality warnings do not change this copyable middleware example.
中
Analytics Guidance Misclassifies Linkable User Identifiers
The guide calls internal user_id values "not PII" and repeats this in its privacy checklist. Linkable identifiers remain personal data despite replacing email.
The examples link identifiers to specific users and business events. Calling them non-personal can incorrectly exempt analytics data from privacy safeguards.
能力複核項目 (1)
這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。
中
Hardcoded URL
ServerAddress: os.Getenv("PYROSCOPE_URL"), // e.g., http://user:pass@pyroscope:4040
The example puts username and password credentials in a plaintext HTTP collector URL. Copying this configuration can expose authentication and profile data in transit.
風險因素
⚙️ 外部命令 (38)
evals/evals.json:360 SKILL.md:3 SKILL.md:24 SKILL.md:32 SKILL.md:42 SKILL.md:44 SKILL.md:47 SKILL.md:58 SKILL.md:59 SKILL.md:60 SKILL.md:61 SKILL.md:62 SKILL.md:66 SKILL.md:68-73 SKILL.md:73-81 SKILL.md:81-91 SKILL.md:91 SKILL.md:93-95 SKILL.md:95 SKILL.md:101 SKILL.md:109-111 SKILL.md:111-121 SKILL.md:121-125 SKILL.md:125-134 SKILL.md:134-138 SKILL.md:138 SKILL.md:142 SKILL.md:144 SKILL.md:152 SKILL.md:153-155 SKILL.md:155-159 SKILL.md:159-170 SKILL.md:170-172 SKILL.md:172-178 SKILL.md:178-180 SKILL.md:180-186 SKILL.md:186-188 SKILL.md:188-200
🌐 網路存取 (8)
📁 檔案系統存取 (5)
🔑 環境變數 (1)
審計單位: codex
分享與引用此報告
分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。
複製報告連結
https://skillstore.io/skills/samber-golang-observability/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/samber-golang-observability?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/samber-golang-observability?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/samber-golang-observability/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/samber-golang-observability.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>學術引用 (APA · BibTeX · CFF)
APA 引用
samber. (2026). golang-observability security audit report (audit version 1) [Author version 1.3.2]. Skillstore. https://skillstore.io/skills/samber-golang-observability/audits/1BibTeX 引用
@techreport{samber-samber-golang-observability-2026,
author = {samber},
title = {golang-observability security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/samber-golang-observability/audits/1},
note = {Author version 1.3.2}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "golang-observability security audit report (audit version 1)"
version: "1.3.2"
type: report
authors:
- name: "samber"
date-released: "2026-10-18"
url: "https://skillstore.io/skills/samber-golang-observability/audits/1"
identifiers:
- type: other
value: "skillstore:samber-golang-observability:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore 評分
評分依據 證據置信度: 中 45
架構
100
可維護性
87
內容
65
社群
100
規範符合度
你可以打造什麼
Instrument a New Go API
Add request metrics, structured logs, and trace spans before releasing a new service.
Improve Production Alerting
Review metric labels, latency histograms, and error-budget alerts to reduce monitoring noise and identify coverage gaps.
Review Analytics Data Flows
Evaluate server-side event tracking, consent handling, identifiers, and deletion workflows with engineering and privacy stakeholders.
試試這些提示
Review Basic Logging
Review this Go handler for structured slog fields, context propagation, log levels, and sensitive data. Explain the smallest useful changes.
Add Request Metrics
Instrument this Go router with request counters and latency histograms. Use route templates, bounded labels, suitable buckets, and PromQL comments.
Connect Logs and Traces
Review this Go service's OpenTelemetry setup. Preserve context across database and HTTP calls, correlate slog records, and propose sampling and exemplar settings.
Audit Production Coverage
Audit this Go repository across logs, metrics, traces, profiles, and analytics. Report evidence, security gaps, and prioritized fixes without changing production settings.
最佳實務
- Validate library APIs and telemetry examples against the versions installed in your project.
- Use bounded metric labels, intentional sampling, and tested alert thresholds before production rollout.
- Protect profiling endpoints, redact secrets, and verify authorization and consent before processing user telemetry.
避免
- Copying examples into production without security review or integration tests.
- Using raw paths, user IDs, or request IDs as metric labels.
- Treating pseudonymous identifiers as anonymous data or assuming analytics examples guarantee compliance.
常見問題
Which assistants can use this skill?
The skill declares compatibility with Codex and Claude Code.
Does it install monitoring infrastructure?
No. It provides guidance and examples; you configure collectors, storage, dashboards, credentials, and deployment separately.
Which telemetry signals does it cover?
It covers structured logs, Prometheus metrics, OpenTelemetry traces, profiling, and server-side analytics.
Can it help migrate existing Go loggers?
Yes. It describes incremental migration from zap, logrus, and zerolog to slog through bridge handlers and call-site changes.
Does its analytics guidance guarantee GDPR or CCPA compliance?
No. Obtain privacy review, treat linkable user identifiers as personal data, and validate consent, authorization, retention, and deletion behavior.
Are the examples ready for production without changes?
No. Review credentials, transport encryption, endpoint authorization, metric labels, and failure handling before adapting them.