·
Last changedVersion:
This version passed the hardening gate. Hardening updated the skill content and independently checked the resulting changes. Classified findings before hardening: 17. Classified findings closed: 3. Classified findings remaining: 14. Unclassified scanner findings remaining: 0. Review findings closed: 0. Review findings remaining: 25.
1
9
7
9
5
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
references/frontend-observability.md | Prompt Injection | Direct prompt injection | High | Closed | |
references/apm-setup.md | Supply Chain & Install-Time Trust | Install-time download and execute | Medium | Open | |
references/apm-setup.md | Sensitive Data & Secret Exposure | Hardcoded secret | Medium | Open | |
SKILL.md | Sensitive Data & Secret Exposure | Hardcoded secret | Medium | Open | |
references/apm-setup.md | Supply Chain & Install-Time Trust | — | Medium | Open | |
references/apm-setup.md | Privilege Escalation & Host / Cloud Compromise | Privilege escalation | Medium | Open | |
references/frontend-observability.md | Sensitive Data & Secret Exposure | Hardcoded secret | Medium | Open | |
references/apm-setup.md | Malicious Code & Command Execution | — | Medium | Open |
17 findings
Three products that share the same OTLP + Mimir / Loki / Tempo / Pyroscope plumbing:
MetricsPublisher + LogsPublisher + TracesPublisherFull Alloy block + required resource attributes + spanmetric names + correlation links: references/apm.md.
Full React example, CDN setup, session config: references/faro.md.
Full OpenLIT install, evals/guards, GenAI metric list, dashboard names: references/ai-observability.md.
| Signal | Product | Storage | Query |
|---|---|---|---|
RED metrics | App Observability | Mimir | PromQL |
Traces | Tempo | Tempo | TraceQL |
Logs | Loki | Loki | LogQL |
Profiles | Pyroscope | Pyroscope | ProfileQL |
Browser RUM | Frontend Observability | Loki + Tempo | LogQL / TraceQL |
LLM metrics | AI Observability | Mimir | PromQL |
Correlation keys: service.name joins all signals; trace exemplars embed trace IDs in metric points; traceID in logs and traceparent injected by Faro for FE → BE linking.
service.namespace (job label) or deployment.environment resource attributespan.kind not set on outbound calls (must be CLIENT) or inbound (SERVER)/collect returns 401 → wrong app key; 404 → region in URL doesn't match the Faro appreferences/apm.md — APM essentials: how RED metrics are generated, required OTel resource attributes, Alloy config, correlation linksreferences/apm-setup.md — deep dive: full per-language OTel SDK setup (Node / Python / Java / Go), span-metrics options, complete Alloy configreferences/faro.md — Faro essentials: SDK init, instrumentations, session replayreferences/frontend-observability.md — deep dive: full Faro SDK reference, React/Vue/Angular integration, custom events, source mapsreferences/ai-observability.md — OpenLIT auto-instrumentation for OpenAI / Anthropic / Bedrock / Vertex AIGet started with chainctlchainctl skill install public/grafana/app-observability:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/grafana/skills/grafana-cloud/app-observability:latest
Apache-2.0
HARDENING.md
LICENSE
SKILL.md
references/ai-observability.md
references/apm-setup.md
references/apm.md
references/faro.md
references/frontend-observability.md