Nightingale is an open-source monitoring and alerting system that connects to stored metrics and log data, evaluates alert rules, and distributes notifications. Operations teams use it to manage alarms and explore observability data alongside existing data sources and collectors. Catalogue add-ons provide skills for operating Nightingale.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ccfos/nightingale --skill import-prom-rulegit clone --depth 1 https://github.com/ccfos/nightingaleWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ccfos/nightingale/import-prom-rule)<a href="https://agentmods.dev/skills/ccfos/nightingale/import-prom-rule"><img src="https://agentmods.dev/badge/skills/ccfos/nightingale/import-prom-rule/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ccfos/nightingale/import-prom-rule"><img src="https://agentmods.dev/badge/skills/ccfos/nightingale/import-prom-rule.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 76 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00125 | $0.02786 |
| Opus 5 | $0.00063 | $0.01393 |
| Sonnet 5 | $0.00025 | $0.00557 |
| Haiku 4.5 | $0.00013 | $0.00279 |
Grade A, and why
import-prom-rule scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 214 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Skill: Import Prometheus Alert Rules
Overview
Bulk-create Prometheus official rule YAML (in any of the three forms: with groups, a plain rules array, or a single rule) into n9e. Typical sources:
- A remote URL (e.g. awesome-prometheus-alerts on GitHub raw)
- YAML text pasted directly by the user
The workflow is a fixed four steps: fetch YAML to a file → choose business group + datasource → preview → write to DB.
⚠️ Core constraint: the YAML file does not enter the LLM context. http_fetch with save_to_file=true writes the content to a temporary file, and the subsequent preview_prom_rule_yaml and import_prom_rule_yaml both read that path via payload_file. The file size can range from a few KB to a few MB; letting it enter the prompt would significantly slow things down, increase cost, and make it easy for the LLM to truncate or rewrite it.
Available Tools
| Tool | Purpose |
|---|---|
http_fetch |
GET a public URL. When save_to_file=true, writes the body to a temporary file; the return contains only file_path, not the body. Only http/https; automatically rejects intranet/loopback addresses |
preview_prom_rule_yaml |
Parse the YAML without writing to the DB. Prefer the payload_file argument (the file_path returned by http_fetch) to avoid large files entering the context. Returns each rule's name/severity/prom_ql etc. for the user to confirm |
import_prom_rule_yaml |
Parse the YAML and bulk-write to the DB by business group + datasource. Prefer payload_file. Returns each rule's id or error |
list_busi_groups |
List visible business groups so the user can pick a group_id |
list_datasources |
List datasources, filtered by plugin_type=prometheus |
Execution Steps
Step 1: Fetch the YAML to a temporary file
User gave a URL — always include save_to_file=true:
http_fetch(url="https://.../node-exporter.yml", save_to_file=true)
The return is:
{"status_code":200,"content_type":"text/plain","size":8731,"truncated":false,
"file_path":"/var/folders/.../n9e-aiagent-fetch-xxx.yml"}
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 214 lines · 125 tokens per session scan A 3cf87227ee79
import-prom-rule is a skill published in the GitHub repository ccfos/nightingale (13,282 stars, last pushed yesterday), licensed Apache-2.0. It adds 125 tokens to every session and 2,786 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
cis-aws-database-10.8
Ensure Monitoring and Alerting is Enabled.
github-ci-fix-onboarding
Onboards and troubleshoots GitHub PR CI fixing by configuring GitHub CLI authentication, a non-exposed GitHub token, a matching local checkout, and a ready coding agent before running fixgithubprci. Use for first-time setup, failed prerequisites, demos, or action-shaped requests to onboard the user onto the local…
cicd-analytics-demo
CI/CD performance and reliability analytics for one repository over the last 30 days: executions, PR failure rate, CI-caused vs source failures, developer time blocked, default-branch red time, via analyzegithubcireliability; also the first-experience demo that scans the machine and picks a repository first. Use for…
github-ci-fix
Fix failing GitHub CI / Actions checks via fixgithubprci and push to the existing PR head, or fix a branch's failing CI via a linked repair worktree.
github-ci-fix
Use when the user asks OpenSRE to fix failing GitHub CI, GitHub Actions checks, failing pull request checks, a broken PR branch, or CI on a named branch such as main.
github-ci-health
Read-only GitHub CI health report of the checks failing right now for one repository, optionally narrowed to a branch or pull request. Not for CI/CD performance, reliability KPIs, failure rates, or downtime over a period (use cicd-analytics-demo).