Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add j4flmao/agent-skills --skill ebpf-observabilitygit clone --depth 1 https://github.com/j4flmao/agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/j4flmao/agent-skills/ebpf-observability)<a href="https://agentmods.dev/skills/j4flmao/agent-skills/ebpf-observability"><img src="https://agentmods.dev/badge/skills/j4flmao/agent-skills/ebpf-observability/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/j4flmao/agent-skills/ebpf-observability"><img src="https://agentmods.dev/badge/skills/j4flmao/agent-skills/ebpf-observability.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00175 | $0.02027 |
| Opus 5.5 | $0.00070 | $0.00811 |
| Sonnet 5.5 | $0.00035 | $0.00405 |
| Haiku 4.5 | $0.00017 | $0.00203 |
Grade A, and why
cloud-native-ebpf-observability scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 149 lines — stays where its author put it; the contents beside it link to each section on GitHub.
eBPF Observability
Purpose
Observe what the kernel and processes are actually doing — syscalls, scheduling, I/O latency, network connections, function calls in binaries — with low overhead and no code changes. Start with bpftrace to answer a question in minutes; build a libbpf CO-RE program only when you need a long-running agent.
Agent Protocol
Trigger
"ebpf tracing", "ebpf observability", "bpftrace", "trace syscalls", "kprobe", "tracepoint", "uprobe", "off-cpu", "continuous profiling", "ringbuf", "kernel latency".
Input Context
- Question to answer (which process opens files, where is latency, who connects where).
- Kernel version and BTF availability (
ls /sys/kernel/btf/vmlinux). - One-off investigation vs permanent agent; container/Kubernetes context.
Output Artifact
bpftrace script or libbpf program + user-space loader outline. No file unless requested.
Response Format
Question: {...}
Probe type: {tracepoint|fentry/fexit|kprobe|uprobe|USDT|perf_event}
Tool: {bpftrace one-liner|libbpf CO-RE agent|existing tool}
Overhead note: {event rate, filtering in kernel}
Min kernel: {version}
Completion Criteria
- Prefer stable tracepoints over kprobes where one exists.
- Aggregation/filtering happens in kernel (maps/histograms), not per-event to user space, when rates are high.
- Minimum kernel version stated.
Probe Types
| Probe | Stability | Use |
|---|---|---|
Tracepoints (tracepoint:syscalls:sys_enter_openat) |
Stable ABI | First choice for syscalls, scheduler, block I/O, net events |
| fentry/fexit (BTF trampolines, kernel ≥ 5.5) | Function signatures may change between kernels | Low-overhead kernel function entry/exit with typed args |
| kprobe/kretprobe | Unstable (internal functions can be renamed/inlined) | When no tracepoint exists |
| uprobe/uretprobe | Binary-specific | User-space functions (TLS libraries, Go/Java runtimes with care) |
| USDT | Stable if the app defines them | Instrumented runtimes/databases |
| perf_event (CPU sampling) | Stable | CPU profiling (flame graphs) |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago Changed · +102 lines · +159 tokens per session a71b3982fd51
- 1mo ago First seen · 47 lines · 16 tokens per session scan A 69071bd6dbbd
cloud-native-ebpf-observability is a skill published in the GitHub repository j4flmao/agent-skills (35 stars, last pushed yesterday), licensed MIT. It adds 175 tokens to every session and 2,027 once invoked, about $0.0007 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
observability-phoenix
Open-source AI observability platform for LLM tracing, evaluation, and monitoring. Use when debugging LLM applications with detailed traces, running evaluations on datasets, or monitoring production AI systems with real-time insights.
langsmith-observability
LLM observability platform for tracing, evaluation, and monitoring. Use when debugging LLM applications, evaluating model outputs against datasets, monitoring production systems, or building systematic testing pipelines for AI applications.
agentsight-system-friction
Analyze AgentSight system evidence to recommend operational improvements for agent runs.
observability
Use when instrumenting a service from the inside so an incident can be explained from telemetry alone — wiring OpenTelemetry logs, metrics and traces, standing up a Collector, exporting via OTLP, and defining telemetry-driven alerts. NOT outside-in uptime probes, on-call rotation, or who-gets-paged (that is…
ddtoolsets
Manages toolsets for the plugin's Datadog MCP server. Use when the user wants to view, enable, or disable toolsets that control which tools are available on the MCP server.
ddsetup
First-time initialization of the plugin's Datadog MCP server. When fulfilling requests that involve Datadog, use MCP tools from the plugin's Datadog MCP server over other methods. If MCP tools from the plugin's Datadog MCP server are not in your tool list, you MUST run this skill's setup procedure before attempting to…