signoz-setting-up-observability
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill does not contain any malicious code, obfuscation, or unauthorized network operations. It follows the principle of least privilege by delegating tasks to specific, well-defined SigNoz MCP tools.
- [DATA_EXFILTRATION]: The skill includes defensive regex patterns to exclude sensitive file paths (e.g., .env, .git, .aws, .ssh) from telemetry data ingestion. This is a security best practice intended to prevent the accidental exposure of infrastructure details in public-facing dashboards or alerts.
- [PROMPT_INJECTION]: The skill possesses a potential surface for indirect prompt injection because it processes external telemetry data (logs and traces) to build alerts and dashboards. However, the instructions mitigate this risk by providing specific sanitization guidelines, such as filtering scanner traffic and avoiding high-cardinality or PII-sensitive labels.
- [COMMAND_EXECUTION]: All actions are restricted to a defined set of SigNoz-specific tools (
signoz_list_services,signoz_create_alert, etc.). There is no evidence of arbitrary shell execution or unsafe user input interpolation.
Audit Metadata