observability-aiops

• Outcome: Review
• Latest audit: Oct 15, 2026 · 9:52 AM UTC
• Version: 0.12.0

Overview

This is a legitimate observability skill, but it exposes high-impact Grafana, Alertmanager, and Prometheus write actions without an enforced approval or read-only gate.

Install only with least-privilege observability credentials. Start with Grafana Viewer scope and Prometheus/Alertmanager access that cannot write, then explicitly grant write-capable tokens only if you are comfortable with the agent being able to silence alerts, alter or delete dashboards, create annotations, and reload Prometheus. Keep human confirmation around MCP writes, especially delete_dashboard, expire_silence, reload_prometheus_config, and undo_apply.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 86% confidence

Finding

expire_silence performs a direct DELETE against an Alertmanager silence ID, and the documentation does not describe constraints on which silence IDs may be targeted beyond the generic note that it is an inverse of create_silence. If an agent can be induced to pass attacker-chosen or user-supplied IDs without ownership, scope, or confirmation checks, it could prematurely remove production silences and re-enable noisy or harmful alerting.

Content

Scanner excerpt · references/capabilities.md (reported line 100)May include surrounding context.

md

| Tool | Risk | API path | Notes |
|------|------|----------|-------|
| `create_silence` | **med** | AM `POST /api/v2/silences` | **time-boxed** (requires minutes > 0); returns silenceId; undo → `expire_silence` |
| `expire_silence` | **med** | AM `DELETE /api/v2/silence/{id}` | inverse of create_silence |
| `create_annotation` | **medium** | `POST /api/annotations` | Grafana event marker |
| `update_dashboard` | **med** | `POST /api/dashboards/db` | GETs the prior model first → captures it for a restore undo |
| `delete_dashboard` | **HIGH** | `DELETE /api/dashboards/uid/{uid}` | `dry_run`; captures prior model **BEFORE** delete; undo → recreate |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 94% confidence

Finding

delete_dashboard exposes a destructive DELETE operation on a dashboard UID, and although dry_run and undo are mentioned, the capability description does not require confirmation, authorization checks, or restrictions on which dashboards may be deleted. In this observability context, dashboard deletion can disrupt operators during incidents, destroy curated views, and be abused through prompt-injected or attacker-supplied UIDs.

Content

Scanner excerpt · references/capabilities.md (reported line 103)May include surrounding context.

md

| `expire_silence` | **med** | AM `DELETE /api/v2/silence/{id}` | inverse of create_silence |
| `create_annotation` | **medium** | `POST /api/annotations` | Grafana event marker |
| `update_dashboard` | **med** | `POST /api/dashboards/db` | GETs the prior model first → captures it for a restore undo |
| `delete_dashboard` | **HIGH** | `DELETE /api/dashboards/uid/{uid}` | `dry_run`; captures prior model **BEFORE** delete; undo → recreate |
| `reload_prometheus_config` | **med** | `POST /-/reload` | records the pre-reload config hash; no undo (re-apply the prior config file) |
| `undo_apply` | **med** | dispatches the recorded inverse tool | executes a recorded inverse; the inverse runs through its own governed tool (its real risk tier applies); single-use token; supports `dry_run` |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/cli-reference.md (reported line 14)May include surrounding context.

bash

observability-aiops init                      # interactive wizard (asks for the platform: prometheus/grafana/loki)
observability-aiops doctor [--skip-auth]      # config + secret store + connectivity
                                           #   Prometheus: /api/v1/status/buildinfo · Grafana: /api/health
                                           #   Loki: /ready + /loki/api/v1/status/buildinfo
observability-aiops mcp                       # start the MCP server (stdio transport)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/setup-guide.md (reported line 120)May include surrounding context.

bash

observability-aiops init                      # interactive wizard (asks for the platform: prometheus/grafana/loki)
observability-aiops doctor [--skip-auth]      # config + secret store + connectivity
                                           #   Prometheus: /api/v1/status/buildinfo · Grafana: /api/health
                                           #   Loki: /ready + /loki/api/v1/status/buildinfo
observability-aiops mcp                       # start the MCP server (stdio transport)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

md

homepage: https://github.com/AIops-tools/Observability-AIops
tags: [aiops, mcp, governance, observability]
description: >
  Use this skill whenever the user needs to operate a self-hosted observability stack on Prometheus (HTTP API + PromQL), Alertmanager, Grafana, or Grafana Loki (logs) — a one-shot overview, PromQL instant/range queries, label + series metadata, scrape-target health (up/down + why) and dropped targets, recording/alerting rule health, firing/pending alerts, Alertmanager alerts + silences, Grafana dashboards/datasources/folders, bounded Loki LogQL log reads (labels, query, error-tail), five flagship analyses (firing-alert RCA, target-scrape-health, alert-noise/flap, log-error-burst RCA, log-volume/cardinality) plus an alert->log cross-signal, and guarded writes (create/expire silence, create annotation, update/delete dashboard, reload Prometheus config).
  Always use this skill for "Prometheus", "PromQL", "Alertmanager", "Grafana", "Loki", "LogQL", "logs", "which targets are down", "scrape failing", "why is this alert firing", "root cause this alert", "firing alerts", "silence this alert", "noisy alerts", "alert flapping", "recording rule", "alerting rule", "dashboard", "datasource health", "reload prometheus config", "TSDB cardinality", "error burst", "log volume", "log cardinality", "tail errors" when the context is a self-hosted metrics/logs/observability stack.
  Do NOT use when the target is something other than a Prometheus/Grafana observability stack (a hypervisor, storage appliance, backup product, container-orchestrator control plane, network device config, or OT/industrial equipment) — route those to the appropriate other AIops-tools skill. Hosted/SaaS monitoring suites (Datadog, New Relic, enterprise NMS) are out of scope.
  Governed observability operations with a built-in governance harness (audit, policy, token budget, undo, risk-tiers). Beyond the mock suite, the Prometheus/Alertmanager/Grafana surfaces have been exercised against a l
...[truncated 25 chars]

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Describing writes as 'guarded' suggests active permission checks or safety interlocks, yet the skill later says writes are not permission-gated and rely on external account permissions plus audit logging. In an agentic setting, this can lead to unsafe execution of destructive actions like dashboard deletion or config reload because the safety properties are overstated.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill markets a built-in governance and policy harness, but later documentation explicitly states there is no policy file, approval gate, or authorization control. That mismatch can cause operators or upstream agents to overtrust the tool and permit state-changing actions under the false assumption that internal policy enforcement exists.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 216)May include surrounding context.

md

6. **Failure branch**: Loki here is **read-only and bounded** — queries require a
   stream selector and are capped by lookback and line count. A query rejected
   for a missing selector is the guard working, not a bug: narrow it with
   `observability-aiops logs labels` first. There is no write surface for Loki,
   so remediation happens in the emitting service, not through this tool.

### Safely change or retire a Grafana dashboard (reversible)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The capability matrix documents several state-changing operations, including delete and reload actions, but does not state any explicit user-confirmation, approval, or step-up verification requirement at the point of use. In an agent skill, merely labeling actions as governed or assigning a risk tier is not a sufficient safety control if destructive tools can still be invoked from natural-language requests without an explicit confirmation gate.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · references/cli-reference.md (reported line 14)May include surrounding context.

bash

observability-aiops init                      # interactive wizard (asks for the platform: prometheus/grafana/loki)
observability-aiops doctor [--skip-auth]      # config + secret store + connectivity
                                           #   Prometheus: /api/v1/status/buildinfo · Grafana: /api/health
                                           #   Loki: /ready + /loki/api/v1/status/buildinfo
observability-aiops mcp                       # start the MCP server (stdio transport)

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · references/setup-guide.md (reported line 120)May include surrounding context.

bash

observability-aiops init                      # interactive wizard (asks for the platform: prometheus/grafana/loki)
observability-aiops doctor [--skip-auth]      # config + secret store + connectivity
                                           #   Prometheus: /api/v1/status/buildinfo · Grafana: /api/health
                                           #   Loki: /ready + /loki/api/v1/status/buildinfo
observability-aiops mcp                       # start the MCP server (stdio transport)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/setup-guide.md (reported line 80)May include surrounding context.

md

- The token is **never** written to disk in plaintext. It lives only in
  `~/.observability-aiops/secrets.enc`, encrypted with Fernet (AES-128-CBC +
  HMAC), the key derived from your master password via scrypt. Only a per-store
  random salt and the ciphertext are on disk (chmod 600); the master password
  itself is never stored.
- A legacy plaintext env var `OBSERVABILITY_<TARGET_NAME_UPPER>_TOKEN` is still
  honoured as a fallback with a deprecation warning — migrate with

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

L026 states "Loki is read-only here," and the file header at L003-L007 says the Loki surface has not been exercised, but L119-L123 presents doctor as performing live Loki connectivity/buildinfo checks as a normal supported path. This is not a strong security issue, but the documentation mixes a caution about unverified Loki support with operational guidance that implies tested support.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.