backend-observability — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited backend-observability (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The build-time counterpart to your monitoring stack. The Sentry plugin installs the SDK;debug-sentry-monitortriages after the fact;audit-langfuse-llmaudits LLM traces. about instrumenting correctly while you build so those tools have signal to work with — and so a 3am incident is debuggable.
Adding logging / tracing / metrics to new code, reviewing instrumentation, or fixing "we can't tell what happened in prod." Not for installing an SDK (use the Sentry/Langfuse plugins) or post-hoc triage (use the monitor/audit skills).
A prod incident is only debuggable if you can pivot error ↔ trace ↔ log ↔ user from any one of them. Make every layer share an id.
trace_id) at the entry point (HTTP middleware, edge function, job start). Put it in async context (AsyncLocalStorage / context var), not a parameter threaded everywhere.setTag("request_id", id) / setContext, and the Langfuse trace (trace.id or metadata). On an LLM error, attach the Langfuse trace URL to the Sentry event so you jump straight from the exception to the prompt/response.Sentry.setUser, Langfuse userId/sessionId) — scrubbed (see redaction).level, msg, request_id, event, domain ids). One event per line. Use the platform logger (pino / structlog / slog), not bare console.log.error = needs a human; warn = degraded but handled; info = state transitions / business events; debug = dev-only, off in prod. Don't log error for handled flow.beforeSend / data-scrubbing and Langfuse masking to strip PII from events/traces. Assume anything you put in a span/breadcrumb may be retained.http.server, db.query, llm.generate), add attributes (route, status, row count, model) — follow OTel semantic conventions, including the GenAI conventions for LLM spans (model, tokens in/out, cost, latency, temperature).trace_id into the surrounding request id and into Sentry on failure — so an LLM error in Sentry is one click from the full trace.userId / sessionId / release so audit-langfuse-llm can slice quality by cohort.sentry-create-alert / your channel.console.log shipped to prod.beforeSend + Langfuse masking.sentry-sdk-setup, sentry-setup-ai-monitoring, sentry-create-alert, sentry-otel-exporter-setup) — SDK + alert wiring.langfuse) + audit-langfuse-llm — LLM trace capture + quality audit.debug-sentry-monitor / debug-error — post-hoc triage of what this instrumentation surfaces.data-pipeline — per-run pipeline metrics use these same correlation + logging rules.workflow-spec-workflow-spec-tdd — make "observable" part of the spec's "done when", not an afterthought.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.