evaluate-ai-observability — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited evaluate-ai-observability (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
| Metric | Target | How to Measure |
|---|---|---|
| Telemetry coverage | 100% of pipeline stages | Trace completeness check |
| Alert coverage | All critical scenarios | Alert rule inventory vs failure modes |
| PII in logs | 0 instances | Automated PII scan on log samples |
| Dashboard latency | < 30s refresh | Dashboard load timing |
| Data retention | Compliant with policy | Retention config vs requirement |
| False alert rate | < 5% | Alerts fired vs actual incidents |
| Mean time to detect (MTTD) | < 5 minutes | Incident detection timing |
| Metric cardinality | < 10K unique series | Metrics Explorer check |
// Check which pipeline stages have traces (last 24h)
traces
| where timestamp > ago(24h)
| distinct operation_Name
| sort by operation_NameExpected stages: retrieval, generation, safety-check, response, caching. Missing stage = blind spot in observability.
| Failure Mode | Alert Exists? | Threshold | Action |
|---|---|---|---|
| Service down | ✅ / ❌ | Availability < 99% | PagerDuty |
| High latency | ✅ / ❌ | p95 > 5s | Teams |
| Error spike | ✅ / ❌ | >5% error rate | PagerDuty |
| Cost overrun | ✅ / ❌ | Daily >2× baseline | |
| Quality drop | ✅ / ❌ | Groundedness <0.7 | PagerDuty |
| Security block spike | ✅ / ❌ | >10% blocked | Teams |
Every ❌ is a gap — create the alert.
// Search for potential PII in traces (last 7 days)
traces
| where timestamp > ago(7d)
| where message matches regex @"\b\d{3}-\d{2}-\d{4}\b" // SSN pattern
or message matches regex @"\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b" // Email
or message matches regex @"\b\d{16}\b" // Credit card
| project timestamp, operation_Name, message
| take 100| Data Type | Requirement | Configured | Compliant? |
|---|---|---|---|
| Application logs | 90 days | Check LA workspace | ✅ / ❌ |
| Custom metrics | 90 days | Check retention setting | ✅ / ❌ |
| Distributed traces | 90 days | Check sampling settings | ✅ / ❌ |
| Security logs | 1 year | Check archive policy | ✅ / ❌ |
| PII-containing data | 30 days max | Check scrubbing + TTL | ✅ / ❌ |
python evaluation/eval.py --all --output evaluation/observability-report.json| Result | Action |
|---|---|
| All PASS | Observability stack production-ready |
| Missing stages in traces | Instrument missing pipeline components |
| Alert gaps found | Create missing alert rules |
| PII detected | Add telemetry processor, re-scan |
| Retention non-compliant | Adjust workspace retention settings |
| Symptom | Root Cause | Fix |
|---|---|---|
| Traces missing spans | Context not propagated | Pass trace context headers |
| Metrics cardinality explosion | High-cardinality dimension | Remove user_id from custom dimensions |
| Dashboard shows wrong numbers | Aggregation mismatch | Verify KQL aggregation logic |
| Alerts too noisy | Threshold too sensitive | Increase threshold, add over-time condition |
| Log Analytics expensive | Verbose logging | Set min log level to Warning |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.