Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add controlplane-com/ai-plugin --skill external-logginggit clone --depth 1 https://github.com/controlplane-com/ai-pluginWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/controlplane-com/ai-plugin/external-logging)<a href="https://agentmods.dev/skills/controlplane-com/ai-plugin/external-logging"><img src="https://agentmods.dev/badge/skills/controlplane-com/ai-plugin/external-logging/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/controlplane-com/ai-plugin/external-logging"><img src="https://agentmods.dev/badge/skills/controlplane-com/ai-plugin/external-logging.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00056 | $0.02241 |
| Opus 5.5 | $0.00022 | $0.00896 |
| Sonnet 5.5 | $0.00011 | $0.00448 |
| Haiku 4.5 | $0.00006 | $0.00224 |
Grade A, and why
external-logging scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 17d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 106 lines — stays where its author put it; the contents beside it link to each section on GitHub.
External Logging
Tool availability: the external logging tools need
?toolsets=full.
External logging lives on the org (spec.logging plus spec.extraLogging) and ships every workload log in the org — there is no per-GVC or per-workload filtering. One primary provider plus up to 3 extras (4 total); each logging block holds exactly one provider key. Logs stay queryable in built-in LogQL regardless (separate org retention, spec.observability.logsRetentionDays, default 30 days). The recurring failure is credentials: each provider needs a pre-created secret of the exact type below — a wrong-type secret passes configuration and the log router then silently skips that provider, so logs simply never arrive.
Providers
| Key | Secret | Required fields | Worth knowing |
|---|---|---|---|
s3 |
aws | bucket, region, credentials |
prefix default /; region free-form; the IAM user needs s3:PutObject on the bucket |
cloudWatch |
aws | region, credentials, groupName, streamName |
region is an 18-region allowlist (below); optional retentionDays enum and extractFields map |
coralogix |
opaque | cluster, credentials |
cluster: coralogix.com, coralogix.us, app.coralogix.in, app.eu2.coralogix.com, or app.coralogixsg.com; optional app/subsystem |
datadog |
opaque | host, credentials |
host enum: http-intake.logs.datadoghq.com, http-intake.logs.us3.datadoghq.com, http-intake.logs.us5.datadoghq.com, http-intake.logs.datadoghq.eu (dashboard us3.datadoghq.com pairs with the us3 intake host) |
logzio |
opaque | listenerHost, credentials |
listenerHost: listener.logz.io or listener-nl.logz.io |
stackdriver |
gcp | location, credentials |
location is a 40-region GCP allowlist (a rejection lists it); the service account needs Logging write |
elastic |
aws or userpass | one variant block — see below | |
fluentd |
none | host |
port default 24224; Fluent Bit forward protocol |
syslog |
none | host, port, mode, format, severity |
mode tcp/udp/tls (tls enables TLS); format rfc3164/rfc5424; severity 0-7; the receiver sees gvc as hostname, workload as appname, replica as procid |
opentelemetry |
opaque (optional) | endpoint |
OTLP over HTTP, not gRPC; an https endpoint turns TLS on; optional credentials becomes the Authorization header. Raw header values are intentionally not accepted by the MCP tool. |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 17d ago Changed · -25 lines 9a0afb3ffb7d
- 1mo ago First seen · 131 lines · 56 tokens per session scan A 955b3a127efc
external-logging is a skill published in the GitHub repository controlplane-com/ai-plugin (11 stars, last pushed 3d ago), licensed MIT. It adds 56 tokens to every session and 2,241 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
graphjin-env
Use when setting up a training or evaluation loop against a GraphJin agent environment — running the container, reading /health, driving episodes hosted or step-by-step or with your own agent over MCP, splitting train from eval, exporting trajectories, and deciding whether two rewards can be compared.
senior-java
World-class Java and Spring Boot development skill for enterprise applications, microservices, and cloud-native systems. Expertise in Spring Framework, Spring Boot 3.x, Spring Cloud, JPA/Hibernate, and reactive programming with WebFlux. Includes project scaffolding, dependency management, security implementation, and…
ak-cloud-deploy
Deploy an Agent Kernel project to AWS, Azure, or GCP using Terraform modules, or to any Kubernetes cluster (on-prem, baremetal, EKS) using the official Helm chart. Supports serverless and containerized modes for all three clouds. AWS supports execution modes (restsync, restasync, async, stream), queue-based scalable…
ak-build
Add tools, agents, and handoffs to an existing Agent Kernel project. This skill guides you through reading the current project, understanding its framework and structure, then making context-aware additions — new tools, new agents, agent-to-agent handoffs, and Module wiring. The workhorse skill for iterative agent…
ak-add-integration
Add a messaging platform integration to an existing Agent Kernel project. This skill guides you through adding Slack, WhatsApp, Messenger, Instagram, Telegram, Teams, or Gmail integration by generating configuration, updating dependencies, and setting up webhook handlers. Designed for users extending their agents.
ak-init
Scaffold a new Agent Kernel project from scratch. This skill guides you through choosing an agent framework, defining tools, selecting a deployment target, and generating a complete project with all necessary files. Designed for users who want to build a new AI agent using the Agent Kernel library.