skills.rest
EntroVyx
EntroVyxCOMMUNITY
Explore all skills by this author →
GitHub

hunt-metrics-exposure

Identify and analyze publicly exposed observability endpoints for security impact.

3|1|Updated Jul 2, 2026
Search Tags:#security#reconnaissance#metrics#observability#enumeration#actuator
One-click install
npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-metrics-exposure-entrovyx
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-metrics-exposure
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/redteam/hunt-metrics-exposure
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-metrics-exposure-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the security risk of forgotten or misconfigured observability endpoints that leak sensitive operational intelligence, such as AI model usage, database connection states, and internal service health.

Core Features & Use Cases

  • Endpoint Discovery: Automatically scans for common observability paths like /metrics, /health, and /actuator.
  • Intelligence Analysis: Parses Prometheus metrics and JSON health responses to identify leaked AI models, database pool exhaustion, and third-party dependencies.
  • Use Case: Use this skill during a reconnaissance phase to map out a target's infrastructure dependencies and identify potential DoS or prompt injection attack surfaces.

Quick Start

Use the hunt-metrics-exposure skill to scan the target domain example.com for exposed metrics and actuator endpoints.

Frequently Asked Questions about hunt-metrics-exposure

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find exposed actuator and metrics endpoints during reconnaissance?▼

Finding exposed actuator and metrics endpoints involves scanning target domains for common observability paths like /metrics, /health, and /actuator to identify misconfigured web frameworks.

What security risks do leaked observability endpoints cause?▼

Leaked observability endpoints expose sensitive operational intelligence such as AI model usage, database connection states, and third-party dependencies, creating potential DoS or prompt injection attack surfaces.

Can I scan Spring Boot and Node.js applications for exposed health checks?▼

Yes, you can scan Spring Boot, Go, and Node.js applications for exposed health checks and status pages to extract infrastructure metadata and assess security impact.

How do I parse Prometheus metrics to identify leaked database pool states?▼

Parsing Prometheus metrics and JSON health responses identifies leaked database pool exhaustion and third-party dependencies by validating exposure through network requests and JSON parsing.

Do I need python3 and curl to analyze exposed status pages?▼

Yes, analyzing exposed status pages requires curl and python3 for executing network requests and parsing JSON responses to validate endpoint exposure and assess security impact.

Related Skills

Explore More Software Engineering Skills→
LeoWSY-hashblueLeoWSY-hashblue
3

reconnaissance

Aggregate subdomains, ports, endpoints, and APIs into structured inventories.

Community
Intermediate
EntroVyxEntroVyx
3

recon-laundromats

Probe laundromat websites for security misconfigurations and exposed data.

Community
Intermediate
uphiagouphiago
1.1k

hunt-metrics-exposure

Discover and validate unauthenticated observability endpoints exposing operational intelligence.

Community
Intermediate
salmanabdurrahmansalmanabdurrahman

framework-spring

Audit Spring Boot actuator endpoints and configuration for security misconfigurations.

Community
Advanced