The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill recommends the installation of various profiling and monitoring tools.
In references/application-profiling.md, it provides instructions for installing clinic globally via NPM.
It also incorporates numerous Node.js and Python packages for telemetry collection (OpenTelemetry, Prometheus, DataDog, New Relic) and performance testing (k6, Artillery, Locust).
[COMMAND_EXECUTION]: The skill relies on significant CLI capabilities to fulfill its stated purpose.
Templates include commands for system profiling (clinic, py-spy, go tool pprof, jvisualvm), memory snapshotting (v8.writeHeapSnapshot), and load testing execution.
It suggests fetching profiling data from local network endpoints using curl (e.g., curl http://localhost:6060/debug/pprof/heap > heap.prof).
[INDIRECT_PROMPT_INJECTION]: The skill creates a surface for indirect prompt injection by design, as it instruments applications to capture and process external data flows.
Ingestion points: Monitoring endpoints, log streams (Pino/structlog), and tracing spans that capture user-controlled data such as HTTP paths, headers, and request bodies (e.g., references/opentelemetry.md).
Boundary markers: The provided templates do not include specific boundary markers or instructions for the agent to ignore potentially malicious content embedded within the logs or metrics it analyzes.
Capability inventory: The agent is granted shell execution capabilities for profiling and network access for testing tools, which could be abused if an injection occurs.
Sanitization: There is a lack of guidance on escaping or sanitizing external inputs before they are interpolated into the structured logging and metric systems.
[METADATA_POISONING]: Automated security scanners identified issues with the skill's metadata and distribution files.
The documentation URL https://jeffallan.github.io/claude-skills/skills/devops/monitoring-expert/ was flagged on a URL blacklist.
SKILL.md was flagged by reputation scanners for containing content that mimics malware signatures, likely due to the inclusion of system-level profiling and debugging commands.

monitoring-expert