Logging monitoring

Skill JeremyMorgan/code-review-skills/skills/logging-monitoring

Reviews logging and monitoring for security visibility, sensitive-data leakage, and audit coverage. Use when auditing observability and security logging.From its SKILL.md

Install

npx -y skills add JeremyMorgan/code-review-skills --skill logging-monitoring

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

12 stars12 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as CC0-1.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.0 KB, as published. Nobody here has run it

Target: $ARGUMENTS

If no target path is given above, review the entire codebase.

Logging and Monitoring

Review logging and monitoring implementation in this application.

Verify:

Sensitive data not logged
- Passwords, tokens, PII
- Credit card numbers
- API keys
Security event logging
- Failed login attempts
- Authorization failures
- Input validation failures
- System errors
Log injection prevention
- Input sanitization in logs
- Structured logging
Log storage and retention
- Secure storage
- Rotation policy
- Backup strategy
Monitoring alerts
- Unusual activity detection
- Error rate monitoring
- Performance anomalies

Provide a logging compliance checklist.

Provide:

A structured finding report with the following for each issue:

Title, Severity (Critical/High/Medium/Low), CWE (if applicable), Evidence (file, function, line ranges), and a short Why it matters.

Exploitability notes and, where safe, a minimal PoC or reproduction steps (no real secrets).

Remediation: precise code-level fix or config change (snippets welcome), plus defense-in-depth guidance.

A summary risk score (0–10) and top 3–5 prioritized fixes that reduce risk fastest.

A checklist diff: which items from the “Check for” list are Pass/Fail/Not Applicable.

Constraints & style:

Be concrete and cite exact code locations and identifiers.

Prefer minimal, drop-in fix snippets over prose.

Do not invent files or functions that aren’t present; if context is missing, mark as Unable to verify and say what code would prove it.

Write this into a markdown file and place it in the audits/ folder.