Install
$ agentstack add skill-hetcreep-coalmine-telemetry-canary ✓ scanned · ✓ verified — works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
About
Telemetry Canary (Observability & Logging Audit)
Audit code for proper telemetry instrumentation — ensure the app is not a black box in production.
Auditing Categories
- Empty / Silent Catch — catch blocks that swallow exceptions without logging a stack trace or forwarding the error.
- Unstructured Logs — plain-string logging in server code (prefer JSON / structured key-value for cloud queries).
- No Correlation ID — operations crossing boundaries (HTTP/gRPC/threads) without propagating a trace/correlation ID.
- Missing Metrics — critical transactions (checkout, auth, errors) lacking counter/histogram instrumentation.
- No Stack Traces — errors logged without stack context (
logger.error(e.message)instead oflogger.error(e)).
Per-stack grep patterns and right/wrong shapes per category: read references/checks.md before scanning.
Fix mode (choice-gated)
In Agent Context, after the report, present via ask_question:
- Apply safe logs: insert error logging into empty catch blocks (standard logger template) + stack-trace mapping. Each fix: checkpoint (git stash/commit in a git repo; else copy the file aside — never assume git) → apply → build + tests → auto-revert if newly red.
- Let me pick: user selects which telemetry gaps to resolve.
- Report only: exit unchanged.
Output
| file:line | category | severity | finding | recommendation |
Severity: CRITICAL (swallowed error with state mutation) · HIGH (missing stack trace in error logs) · MEDIUM (unstructured log in API boundary) · LOW (minor trace gaps)
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: HetCreep
- Source: HetCreep/CoalMine
- License: MIT
- Homepage: https://github.com/TheColliery
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet — be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.