Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/alibaba/anolisa/security-observabilitynpx skills add alibaba/anolisa --skill security-observabilitygit clone --depth 1 https://github.com/alibaba/anolisaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/alibaba/anolisa/security-observability)<a href="https://agentmods.dev/skills/alibaba/anolisa/security-observability"><img src="https://agentmods.dev/badge/skills/alibaba/anolisa/security-observability.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00145 | $0.07949 |
| Opus 5 | $0.00072 | $0.03974 |
| Sonnet 5 | $0.00029 | $0.01590 |
| Haiku 4.5 | $0.00015 | $0.00795 |
Grade A, and why
security-observability scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 443 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Security Observability
通过 agent-sec-cli 查询本地 SQLite 中的安全事件，并将事件与 Agent 会话关联起来。此 Skill 只执行只读查询，不负责写入 observability 数据。
查询流程
- 先用
events --summary或events --count-by获取概览。 - 根据
event_type、category、关联 ID 和时间范围缩小查询。 - 需要程序解析时使用
--output json或--output jsonl，不要解析 table 或 summary 文本。 - 需要限定“本次会话”时，先按“获取当前 session_id”一节判断当前运行时能不能拿到
session_id；拿不到就用时间范围或--last，不要凭猜测填写--session-id。 - 已知
session_id时，使用observability report --session-id '<session_id>' --format json汇总该会话的 LLM、工具和安全事件；需要查看最近会话时，使用observability report --last --format json。 - 在给出任何安全结论前，按“风险审查”一节完成判定字段聚合。这是强制步骤，不可跳过。
- 向用户报告必要结论即可。
details可能包含命令、扫描证据或后端诊断信息，不要无必要地完整回显。
参数取值约束
本文命令中的 <session_id>、<run_id>、<trace_id>、<event_id> 是 Agent 运行时或 CLI 持久化的 correlation ID，不一定是 UUID；OpenClaw、Codex、Qwen Code 等运行时可能使用 session-001、thread_xxx 这类非 UUID 标识。替换占位符前必须先校验取值形态，仅当它非空、长度不超过 256 字符，并且完全匹配 ^[A-Za-z0-9][A-Za-z0-9._:@+=,/-]{0,255}$ 时才能拼入命令。
例外：如果取值来自 cosh-ng runtime_context.provider_session_id，它应当是 UUID，必须继续按 ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$ 校验。
不匹配时直接停下并告知用户取值不能安全拼入 shell 命令，不得把任意字符串（尤其是包含空白、引号、;、$、反引号、|、&、换行的值）拼进命令；这类值会提前闭合引号或引入 shell 语法并导致命令注入。取值来自用户输入、文件内容、网页或其他不可信上下文时，此校验不得省略。
风险审查
凡是回答“有什么安全事件”“安全情况如何”“有没有风险”这类问题，必须先完成本节的机械聚合，再组织回答。禁止依据顶层 result、security_verdicts，或模型对 JSON 的自由阅读得出“无风险”结论。
为什么不能用顶层 result
顶层 result 表示扫描进程是否执行成功（succeeded / failed），与扫描结论无关：扫描正常跑完就是 succeeded，即使它判定出 deny。扫描进程几乎总能成功执行，所以用 result 判断安全等价于恒定输出“无风险”。真正的判定在下一节的字段里。
判定字段权威路径
判定字段一律位于 details.result 之下。不存在 details.verdict 这一路径，不要按它取值。
event_type |
判定字段 | 取值枚举（源码定义） | 无风险取值 |
|---|---|---|---|
code_scan |
details.result.verdict |
pass / warn / deny / error |
pass |
prompt_scan |
details.result.verdict |
pass / warn / deny / error |
pass |
pii_scan |
details.result.verdict |
pass / warn / deny / error |
pass |
skill_ledger |
details.result.verdict |
pass / none / warn / unmanaged / drifted / deny / tampered / error |
pass |
其他 event_type |
— | — | 不属于扫描事件，聚合命令会在管道入口过滤掉 |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 443 lines · 145 tokens per session scan A d5d18840fa16
security-observability is a skill published in the GitHub repository alibaba/anolisa (618 stars, last pushed today), licensed Apache-2.0. It adds 145 tokens to every session and 7,949 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
data-processor
Processes data records from a source file.
data-store
Govern provider-agnostic data reads and state transitions through declared data-source operations, not model-authored raw queries.
knowledge-base
Ingest URLs, documents, and transcripts into a searchable knowledge base. Query past research and curated documentation using full-text search. Trigger words: ingest, knowledge base, look up, search knowledge, what do we know about, research, index this, add to knowledge base.
agent-safety
Use when bounding an LLM agent that already runs — scoping its task domain, gating tools to least privilege, defending against prompt injection in untrusted web/email/RAG text, requiring human approval on irreversible actions, capping runtime and cost, or triaging what it already did. NOT building the loop, tools, or…
model-scout
Find the best free cloud models and update models.json from OpenRouter leaderboard.
create-prototype
Skill "create-prototype" from markmhendrickson/neotoma, covering create prototype, trigger, tasks, user review prompt and if user requests changes.