Log Tail

Stream recent logs from systemd journal

Security Scan

The skill is internally consistent: it simply relies on journalctl to stream systemd logs and requests no unrelated binaries, installs, or credentials.

Purpose & Capability

Name/description request journalctl and the SKILL.md and metadata explicitly require journalctl. There are no unrelated binaries, environment variables, or install steps; the requested capabilities match the stated purpose.

Instruction Scope

The instructions are limited to viewing/following systemd journal logs (via journalctl). This is within scope, but reading system logs can expose sensitive data (credentials, tokens, PII). The SKILL.md does not instruct accessing unrelated files or env vars, but it assumes journalctl exists and that the agent has permission to read the journal.

Install Mechanism

No install spec and no code files — instruction-only skill. No downloads or archive extraction are requested.

Credentials

No environment variables or credentials are requested. Access to the system journal is the only capability required; needing elevated permissions to read journals is an operational constraint, not an unexplained credential request.

Persistence & Privilege

The skill does not request always:true, does not modify other skills or system settings, and has no install-time persistence. Autonomous invocation is enabled by default but is not combined with other concerning privileges.

Assessment

This skill is coherent for its purpose, but systemd journal logs often contain sensitive data. Before installing or invoking it: (1) confirm that the agent runtime is allowed to read system logs and that you trust the agent not to exfiltrate them; (2) avoid running it on production hosts that contain secrets unless you filter or redact outputs; (3) verify journalctl exists on your platform (not all OSes use systemd); (4) if you do not want automatic reads, keep autonomous invocation disabled or restrict user access; and (5) test the skill on a non-sensitive machine first to confirm behavior.

Stream recent logs from the systemd journal. View logs by service unit, control line count, and optionally follow in real time.

Commands

# Show recent journal logs (default: 50 lines)
log-tail [--unit <service>] [--lines 50]

# Follow logs for a specific service in real time
log-tail --follow <service>

Install

No installation needed. journalctl is always present on systemd-based systems like Bazzite/Fedora.