agent-skills

Savant verdict: Unsafe

Savant's security policy blocks importing this skill.

Live evaluation

Not evaluated yet. Workspaces can request a live evaluation.

Security assessment

100 patterns found

• YARA Match: git reset --hard; git reset --hard; without asking; without asking; Do not ask; silently; silently; silently; silently; silently; silently; silently; silently; silently; silently; silently; silently;high · agent-observability/agent-observability-auto-experiment/SKILL.md:60 · YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
• Tool Misuse: git reset --hardhigh · agent-observability/agent-observability-auto-experiment/SKILL.md:842 · Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
• Tool Misuse: git reset --hardhigh · agent-observability/agent-observability-auto-experiment/SKILL.md:1160 · Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
• Tool Misuse: git reset --hardhigh · agent-observability/agent-observability-auto-experiment/references/rubrics.md:130 · Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
• YARA Match: LLM; ignore previous instructionshigh · agent-observability/agent-observability-auto-experiment/references/eval_harness_template.py:4 · YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
• YARA Match: LLM; ignore previous instructionshigh · agent-observability/agent-observability-auto-experiment/references/rubrics.md:18 · YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
• Prompt Injection: ignore previous instructionshigh · agent-observability/agent-observability-auto-experiment/references/eval_harness_template.py:150 · This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
• Prompt Injection: ignore previous instructionshigh · agent-observability/agent-observability-auto-experiment/references/rubrics.md:339 · This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
• Excessive Agency: --runs 3 --split train --model claude-opus-5high · agent-observability/agent-observability-build-eval-from-annotations/references/judge_runner.py:8 · Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
• Privilege Escalation: .envhigh · agent-observability/agent-observability-eval-pipeline/SKILL.md:155 · Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Structure

• Ships 14 executable scriptsagent-observability/agent-observability-auto-experiment/references/eval_harness_template.mjs, agent-observability/agent-observability-auto-experiment/references/eval_harness_template.py, agent-observability/agent-observability-build-eval-from-annotations/references/judge_runner.py, agent-observability/agent-observability-build-eval-from-annotations/references/scoring.py, agent-observability/agent-observability-eval-pipeline/scripts/load_env.py, …. Review what they do before enabling the skill for agents with tool access.
• The source hub's security checks flagged this skillSocket: warn (5 alerts: gptAnomaly, gptSecurity); Snyk: warn (Risk: MEDIUM · 1 issue); Runlayer: warn (8/10 files flagged); ZeroLeaks: warn (Scan incomplete)

SKILL.md

---
name: agent-skills
description: Datadog skills for AI agents. Essential monitoring, logging, tracing and observability.
metadata:
  version: "1.0.3"
---

# Datadog Skills

Essential Datadog skills for AI agents.

## Core Skills

| Skill | Description |
|-------|-------------|
| **dd-account-setup** | Ensure an authenticated Datadog account with a valid API key on the right region; validates keys, fixes wrong-region 403s, signs in or creates an account |
| **dd-apm** | Traces, services, performance analysis |
| **dd-apps**              | Build Datadog Apps — scaffold, run, upload, publish, CI/CD |
| **dd-aws-integration** | Connect an AWS account to Datadog with Terraform - cross-account IAM role, metrics and resource collection |
| **dd-azure-integration** | Connect Azure subscriptions or management groups to Datadog with Terraform - Entra app registration, Monitoring Reader |
| **dd-browser-sdk** | Browser SDK setup, RUM, Logs, Session Replay, version migration |
| **dd-docs** | Search Datadog documentation |
| **dd-gcp-integration** | Connect GCP projects or folders to Datadog with Terraform - keyless service-account impersonation |
| **dd-llmo** | LLM Observability traces, experiments, evals |
| **dd-logs** | Search logs, pipelines, archives |
| **dd-monitors** | Create, manage, mute monitors and alerts |
| **dd-oci-integration** | Connect an Oracle Cloud tenancy to Datadog with Terraform - Datadog's official OCI module |
| **dd-product-recommender** | Recommend the right Datadog products for a codebase and/or goal (recommendation only) |
| **dd-pup** | Primary CLI - all pup commands, auth, PATH setup |
| **dd-software-delivery** | CI/CD workflow skills — unblock PR, triage flaky tests |
| **dd-instrument-llmo** | Instrument Python & Node.js/Next.js AI backends with Datadog LLM Observability — SDK init, agent/workflow spans, RUM↔LLMO session linking |
| **dd-instrument-rum** | Instrument browser apps with Datadog Browser RUM — React, Next.js, Angular, Vue, Nuxt, Svelte, vanilla |

## Install

```bash
# Install core skills
npx skills add datadog-labs/agent-skills \
  --skill dd-pup \
  --skill dd-monitors \
  --skill dd-logs \
  --skill dd-apm \
  --skill dd-docs \
  --full-depth -y

# Install CI/CD workflow skills
npx skills add datadog-labs/agent-skills \
  --skill dd-software-delivery/unblock-pr \
  --skill dd-software-delivery/triage-flaky-test \
  --full-depth -y
```

## Prerequisites

See [Setup Pup](https://github.com/datadog-labs/agent-skills/tree/main?tab=readme-ov-file#setup-pup) for installation and authentication.

## Command Execution Policy

Use this order for scoped commands:

1. Check context first (conversation, prior outputs, known values).
2. Run discovery commands when required values are missing.
3. Ask the user only when values remain ambiguous.
4. Run the target command after required inputs are known.
5. Avoid speculative commands likely to fail.

## Quick Reference

| Task | Command |
|------|---------|
| Search error logs | `pup logs search --query "status:error" --from 1h` |
| List monitors | `pup monitors list` |
| Schedule monitor downtime | `pup downtime create --file downtime.json` |
| Find slow traces | `pup traces search --query "service:api @duration:>500ms" --from 1h` |
| Query metrics | `pup metrics query --query "avg:system.cpu.user{*}"` |
| Check auth | `pup auth status` |
| Refresh token | `pup auth refresh` |

## Auth

```bash
pup auth login          # OAuth2 (recommended)
pup auth status         # Check token
pup auth refresh        # Refresh expired token
```

**Token Expiry**: OAuth tokens expire (~1 hour). Run `pup auth refresh` if commands fail with 401/403.

## More Skills

Additional skills available shortly.

```bash
npx skills add datadog-labs/agent-skills --list --full-depth
```