Nightingale is an open-source monitoring and alerting system that connects to stored metrics and log data, evaluates alert rules, and distributes notifications. Operations teams use it to manage alarms and explore observability data alongside existing data sources and collectors. Catalogue add-ons provide skills for operating Nightingale.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ccfos/nightingale --skill import-prom-rulegit clone --depth 1 https://github.com/ccfos/nightingaleWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ccfos/nightingale/import-prom-rule)<a href="https://agentmods.dev/skills/ccfos/nightingale/import-prom-rule"><img src="https://agentmods.dev/badge/skills/ccfos/nightingale/import-prom-rule/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ccfos/nightingale/import-prom-rule"><img src="https://agentmods.dev/badge/skills/ccfos/nightingale/import-prom-rule.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 76 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00125 | $0.02786 |
| Opus 5.5 | $0.00050 | $0.01114 |
| Sonnet 5.5 | $0.00025 | $0.00557 |
| Haiku 4.5 | $0.00013 | $0.00279 |
Grade A, and why
import-prom-rule scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 214 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Skill: Import Prometheus Alert Rules
Overview
Bulk-create Prometheus official rule YAML (in any of the three forms: with groups, a plain rules array, or a single rule) into n9e. Typical sources:
- A remote URL (e.g. awesome-prometheus-alerts on GitHub raw)
- YAML text pasted directly by the user
The workflow is a fixed four steps: fetch YAML to a file → choose business group + datasource → preview → write to DB.
⚠️ Core constraint: the YAML file does not enter the LLM context. http_fetch with save_to_file=true writes the content to a temporary file, and the subsequent preview_prom_rule_yaml and import_prom_rule_yaml both read that path via payload_file. The file size can range from a few KB to a few MB; letting it enter the prompt would significantly slow things down, increase cost, and make it easy for the LLM to truncate or rewrite it.
Available Tools
| Tool | Purpose |
|---|---|
http_fetch |
GET a public URL. When save_to_file=true, writes the body to a temporary file; the return contains only file_path, not the body. Only http/https; automatically rejects intranet/loopback addresses |
preview_prom_rule_yaml |
Parse the YAML without writing to the DB. Prefer the payload_file argument (the file_path returned by http_fetch) to avoid large files entering the context. Returns each rule's name/severity/prom_ql etc. for the user to confirm |
import_prom_rule_yaml |
Parse the YAML and bulk-write to the DB by business group + datasource. Prefer payload_file. Returns each rule's id or error |
list_busi_groups |
List visible business groups so the user can pick a group_id |
list_datasources |
List datasources, filtered by plugin_type=prometheus |
Execution Steps
Step 1: Fetch the YAML to a temporary file
User gave a URL — always include save_to_file=true:
http_fetch(url="https://.../node-exporter.yml", save_to_file=true)
The return is:
{"status_code":200,"content_type":"text/plain","size":8731,"truncated":false,
"file_path":"/var/folders/.../n9e-aiagent-fetch-xxx.yml"}
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 214 lines · 125 tokens per session scan A 3cf87227ee79
import-prom-rule is a skill published in the GitHub repository ccfos/nightingale (13,386 stars, last pushed 2d ago), licensed Apache-2.0. It adds 125 tokens to every session and 2,786 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
cis-aws-database-10.8
Ensure Monitoring and Alerting is Enabled.
k8s-monitoring-alerting
A Kubernetes diagnostic and repair method for Prometheus and Grafana monitoring problems, including alerts that do not trigger. Prometheus collects measurements, while Grafana displays them in dashboards.
monitoring-expert
Expert-level monitoring and observability with Prometheus, Grafana, logging, and alerting. Use when the user mentions observability, Prometheus, Grafana, logging, metrics, or alerting, or when the task involves The Three Pillars of Observability, Monitoring Fundamentals, Prometheus Configuration, or Alert Rules.
prometheus-expert
Expert-level Prometheus monitoring, metrics collection, PromQL queries, alerting, and production operations. Use when the user mentions monitoring, metrics, observability, alerting, or PromQL, or when the task involves Prometheus Architecture, Installation on Kubernetes, ServiceMonitor, or PromQL Queries.
datadog
Full-stack observability with Datadog APM, logs, metrics, synthetics, and RUM. Use when implementing monitoring, tracing, alerting, or cost optimization for production systems.
observability-testing-patterns
Observability and monitoring validation patterns for dashboards, alerting, log aggregation, APM traces, and SLA/SLO verification. Use when testing monitoring infrastructure, dashboard accuracy, alert rules, or metric pipelines.