Logging Observability

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:39 PM UTC
• Version: 0.1.0

Overview

The skill content is ordinary observability guidance, but its recommended npx installer fetches mutable remote code that may run with the user's local privileges.

Review the skill as documentation, but avoid the unpinned `npx add` installer unless you can verify the exact package and source. Prefer a pinned commit or manual installation of the reviewed files, and adapt the logging/tracing examples so user identifiers, secrets, request bodies, and business data are redacted before leaving your environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:29
• Finding: Unpinned Third-Party Package Execution During Installation## Vulnerability Details **File Location**: `README.md`, line 29 **Vulnerability Type**: Supply-chain risk caused by unpinned remote package execution **Risk Level**: Medium **Vulnerable Code**: ```bash npx add https://github.com/wpank/ai/tree/main/skills/tools/logging-observability ``` ### Technical Analysis In standard `npx` command syntax, `add` is resolved as the package or executable to download and run. The command does not pin that package to an exact version or verify its integrity. Consequently, the code executed at installation time may differ from the code reviewed in this project. The supplied GitHub URL also references a mutable branch path rather than an immutable commit. Both the executable package resolution and the requested repository content therefore depend on externally controlled, changeable sources. This creates a supply-chain execution risk: if the resolved npm package, its transitive dependencies, its publisher account, or the mutable upstream repository is compromised, following the documented installation command could execute attacker-controlled code. The actual installer implementation is not included in the audited project, so its behavior cannot be verified from the available files. ### Attack Path 1. An attacker compromises or maliciously updates the npm package resolved as `add`, one of its executable dependencies, or the referenced mutable upstream source. 2. A user follows the installation instructions in `README.md`. 3. `npx` resolves and downloads the unpinned package from the configured npm registry. 4. The downloaded package and any applicable lifecycle or command logic execute with the privileges of the user running `npx`. 5. Malicious code can access resources available to that user, modify local files, invoke network services, or install altered Skill content. ### Impact Assessment Successful exploitation permits arbitrary code execution with the privileges of the user perf ...[truncated 576 chars]
• Remediation: ## Remediation Suggestions 1. Replace the ambiguous `npx add ...` command with a documented installer whose package name and purpose are explicit. 2. Pin every executable npm dependency to an exact reviewed version rather than a tag or version range. 3. Commit and enforce package lockfiles and integrity metadata where package installation is required. 4. Pin repository sources to a full immutable commit hash rather than a branch path. 5. Prefer a non-executable installation method, such as cloning a pinned commit and copying the reviewed Skill directory, when no installer logic is necessary. 6. Document the expected package publisher and registry, and verify package provenance or signatures before execution. 7. Run any unavoidable installer in a restricted environment with minimal filesystem access, no unnecessary credentials, and no administrative privileges. 8. Update the installation documentation to show the exact expected artifact and checksum so users can verify it before use.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (8)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The README instructs users to install via `npx add` from a GitHub URL without any pinned version, commit, or integrity control. This creates a supply-chain risk because the referenced content can change over time, causing future installations to fetch different code than was originally reviewed.

Session Persistence

Medium

• Category: Rogue Agent

Content

From your project root:

```bash
mkdir -p .cursor/skills
cp -r ~/.ai-skills/skills/tools/logging-observability .cursor/skills/logging-observability
```

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

From your project root:

```bash
mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/tools/logging-observability .claude/skills/logging-observability
```

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

#### Claude Code (global)

```bash
mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/tools/logging-observability ~/.claude/skills/logging-observability
```

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

External Model or Provider Selection

Medium

• Category: Excessive Agency

Content

---
name: logging-observability
model: standard
description: Structured logging, distributed tracing, and metrics collection patterns for building observable systems. Use when implementing logging infrastructure, setting up distributed tracing with OpenTelemetry, designing metrics collection (RED/USE methods), configuring alerting and dashboards, or reviewing observability practices. Covers structured JSON logging, context propagation, trace sampling, Prometheus/Grafana stack, alert design, and PII/secret scrubbing.
version: 1.0.0
---

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The middleware example places `user_id` into request context that is intended to be inherited by downstream logs, creating a realistic path for persistent logging of user-linked identifiers. While the document later warns against logging PII, it does not explicitly qualify `user_id` as sensitive or instruct minimization, hashing, or policy controls for when identity fields may appear in logs and traces.

Behavior Manipulation

Medium

• Category: Prompt Injection

Content

### OpenTelemetry Setup

Always prefer OpenTelemetry over vendor-specific SDKs:

```typescript
import { NodeSDK } from '@opentelemetry/sdk-node';

• Confidence: 70% confidence
• Finding: Subtle instructions detected that may alter agent decision-making or introduce hidden biases.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The OpenTelemetry example configures export of traces to a collector over HTTP and encourages broad instrumentation, but does not warn that spans and attributes can carry sensitive business or user data into external observability systems. In practice, teams may copy this setup and export request metadata, exception messages, or custom attributes without sanitization or transport hardening.

Static analysis

No suspicious patterns detected.