The Agent Skills Directory

[SAFE]: The skill incorporates security best practices by explicitly instructing the agent to never log raw prompts, responses, or secret values into telemetry fields, mandating the use of hashes or counts instead to preserve privacy.
[COMMAND_EXECUTION]: The skill utilizes a platform-native shell command omh runtime record to track the status of the observability card workflow. This command is restricted to logging execution status and does not involve arbitrary command execution or external data piping.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data (metrics from providers like Prometheus or Grafana), creating a potential surface for indirect prompt injection. This is mitigated through structured data contracts (external_metric_provider/v1), explicit validation requirements (executable_validated), and the separation of 'prepared' guidance from 'observed' evidence.
Ingestion points: Metric payloads and adapter contracts referenced in SKILL.md.
Boundary markers: Includes 'prepared-vs-observed' evidence boundaries and status expectations.
Capability inventory: Limited to status recording via omh CLI and formatting data for user-visible cards.
Sanitization: Explicitly requires masking sensitive data and secret values before logging.

omh-ops-observability-card