Observability Lgtm

Set up a full local LGTM observability stack (Loki + Grafana + Tempo + Prometheus + Alloy) for FastAPI apps. One Docker Compose, one Python import, unified d...

This skill largely does what it says: it gives you a local Grafana+Prometheus+Loki+Tempo stack and a small Python helper to instrument FastAPI apps. Before installing, check these operational issues: 1) The docker-compose references ./config/alloy/config.alloy but that file is not present in the package — you must supply or remove the Alloy service to avoid startup failure. 2) The SKILL.md claims 'no outbound network calls' but docker compose up will pull container images from registries (ensure your machine can fetch Docker images). 3) The copy example uses SKILL_DIR as a placeholder; adapt it to the actual skill path when copying files. 4) Grafana is configured to allow anonymous Admin access for local dev — this is convenient but exposes an admin UI on the host network port (3000); ensure your machine firewall/networking is configured appropriately if you're on an untrusted network. 5) The register_app.sh writes targets into the local prometheus targets directory (intended behavior) — ensure file permissions allow writing and that the ./config/prometheus/targets directory exists. If you want to proceed: add or provide the missing Alloy config, confirm Docker can pull images, and review the included docker-compose.yml and Python logging paths to ensure they match your desired workspace layout.

Type: OpenClaw Skill Name: observability-lgtm Version: 1.2.0 The skill bundle aims to set up a local observability stack, and its declared intent (`network: outbound: false`) is upheld by the code, with all network calls directed to localhost or host.docker.internal. However, the `assets/scripts/register_app.sh` script and the `assets/lib/observability.py` library both exhibit path traversal vulnerabilities. Specifically, the `service_name` parameter, if user-controlled and unsanitized, could allow an attacker to write Prometheus target configuration files or log directories/files to arbitrary locations on the host filesystem. While the content written is benign (Prometheus config, JSON logs), the ability to write to arbitrary paths is a significant vulnerability, classifying the skill as suspicious rather than benign.