Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-style observability and SRE skill with no executable payload, hidden persistence, or credential handling; its production chaos examples require operator caution.
Install is reasonable for observability/SRE planning. Treat rollback, Kubernetes, feature-flag automation, and chaos engineering snippets as examples only: use them in production only with explicit authorization, scoped targets, rollback plans, and monitoring in place.
The skill explicitly endorses chaos experiments in production and includes manual disruption actions like deleting pods without strong gating, approvals, rollback prerequisites, or explicit disruption warnings. In an agent setting, this can normalize or generate operationally dangerous guidance that degrades availability or triggers incidents if followed without experienced oversight.
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
---
name: afrexai-observability-engine
model: standard
description: Complete observability & reliability engineering system. Use when designing monitoring, implementing structured logging, setting up distributed tracing, building alerting systems, creating SLO/SLI frameworks, running incident response, conducting post-mortems, or auditing system reliability. Covers all three pillars (logs/metrics/traces), alert design, dashboard architecture, on-call operations, chaos engineering, and cost optimization.
version: 1.0.0
tags: observability, monitoring, logging, tracing, alerting, SRE, incident-response, SLO, metrics, devops, reliability, on-call, post-mortem, dashboards
The manifest says to use the skill for a very wide range of activities, including broad phrases like "running incident response" and "auditing system reliability," without defining clear boundaries for when this skill should or should not be invoked. Because this is a manifest file, broad invocation language can cause unintended activation overlap with other DevOps, debugging, or architecture skills.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
type: api
frequency: 1m
endpoints:
- url: "https://api.example.com/health"
expected_status: 200
max_latency_ms: 500
- url: "https://api.example.com/v1/products?limit=1"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
type: api
frequency: 1m
endpoints:
- url: "https://api.example.com/health"
expected_status: 200
max_latency_ms: 500
- url: "https://api.example.com/v1/products?limit=1"
This command is plausible as everyday engineering language and does not specify scope such as service, environment, or expected output boundaries. Without qualifiers or negative examples, it may overlap with generic system-audit or architecture-review requests.
No suspicious patterns detected.