golang-observability

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill recommends several community-standard Go libraries for extending structured logging and tracing, such as samber/slog-multi, samber/oops, and lmittmann/tint. It also references official clients for OpenTelemetry, Prometheus, PostHog, and Pyroscope. These are well-known resources within the Go observability ecosystem used for production monitoring.
  • [INDIRECT_PROMPT_INJECTION]: The skill instruments request metadata by capturing headers (e.g., X-Request-ID, X-Session-ID) and URL paths. While this introduces an entry point for external data, the skill includes explicit guidance to normalize these values (using route patterns instead of raw paths) and strictly avoid logging personal data (PII) like emails or tokens, which mitigates exposure risks.
  • [COMMAND_EXECUTION]: The skill utilizes standard Go development tools such as go and golangci-lint for instrumentation and review tasks. These operations are scoped to the defined Bash(go:*) and Bash(golangci-lint:*) tool permissions and are consistent with the skill's primary purpose of Go development and observability.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 05:09 AM
Security Audit — agent-trust-hub — golang-observability