Observability

Provides a complete AI agent observability solution with structured logs, metrics, distributed tracing, alert management, and a real-time monitoring dashboard.

This package appears to implement an observability system and mostly aligns with its description, but review these points before installing: - Source & provenance: the skill has no homepage or repository link. Prefer packages with a known source or inspect the full repository before trusting it in production. - Version/manifest inconsistencies: SKILL.md claims v0.2.0 while package.json is v0.1.1 and package-lock.json v0.1.0; the registry also listed it as "instruction-only" despite code files. These mismatches suggest the package or metadata may be stale or poorly maintained. - Missing/trimmed code or API mismatches: index.js references methods (e.g., createDefaultRules, getStats, getHistory) that were not visible in the provided AlertManager snippet — the repo may be incomplete or truncated in the scanned snapshot. Run the test suite locally and review all source files before use. - Webhook/notifications: AlertManager can POST alert payloads to configured webhook URLs. Only configure webhooks that you trust. Avoid sending logs or tokens to external endpoints you do not control. Treat webhooks as possible exfiltration channels. - Run in isolation first: run npm install and npm test in a sandbox (container or VM). Start the dashboard on a non-production machine and inspect logs and network activity to confirm behaviour. - Inspect logs and default config: default log directory (./logs) may contain sensitive data — rotate and restrict permissions. If you enable auto-reporting or external reporting later, double-check destinations. If you want, I can: (a) scan the omitted files for suspicious network calls or credential reads, (b) list all dependency versions from package-lock.json, or (c) suggest minimal configuration to run safely in a sandbox.

Type: OpenClaw Skill Name: yuyonghao-observability Version: 0.1.1 The skill bundle implements a comprehensive observability system, but it contains a significant security vulnerability in `src/dashboard.js`. The dashboard starts an unauthenticated HTTP server (defaulting to port 3001) that exposes sensitive system information, including full application logs via the `/api/logs` endpoint and detailed LLM/MCP execution metadata via `/api/status`. While these features align with the stated purpose of the tool, the lack of any access control or authentication mechanism creates a high risk of information disclosure and data exfiltration if the agent is running in a non-isolated network environment.