skills.rest
blamejs
blamejsOFFICIAL
Explore all skills by this author →
WebsiteGitHub

log-injection-telemetry

Sanitize CR/LF injection and redact secrets across telemetry pipelines.

Updated May 11, 2026
Search Tags:#log-injection#secret-redaction#telemetry-security#crlf-neutralization#exporter-ssrf#compliance-gaps#metrics-endpoint-security
One-click install
npx skills add https://github.com/blamejs/exceptd-skills --skill log-injection-telemetry
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: log-injection-telemetry
Source: https://github.com/blamejs/exceptd-skills/tree/main/skills/log-injection-telemetry
Command: npx skills add https://github.com/blamejs/exceptd-skills --skill log-injection-telemetry

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Legacy security and compliance frameworks fail to address critical telemetry-pipeline vulnerabilities common in mid-2026 environments, including CR/LF log injection that forges audit records, unredacted secrets and PII leaking across log sinks, unauthenticated metrics endpoints exposing internal topology, and exporter/webhook configurations that enable SSRF and data exfiltration. This skill closes these gaps to ensure observability data remains intact, confidential, and secure.

Core Features & Use Cases

  • Log Injection Neutralization: Sanitizes CR/LF and control characters in all interpolated log values to prevent log forging and audit record corruption across every sink.
  • Sensitive Data Redaction: Automatically strips secrets and PII from logs before they are shipped to downstream systems like SIEMs or cloud log services to prevent data leaks.
  • Exporter & Endpoint Hardening: Audits and secures metrics endpoints, OTLP/CloudWatch exporters, and webhook sinks against unauthenticated access, unallowlisted destinations, credential exposure, and SSRF attacks.
  • Use Case: A cloud-native team using Prometheus, CloudWatch, and webhook-based alerting can use this skill to validate that no log injection can hide attacker activity, no credentials are exposed in centralized logs, and no exporter can be abused to reach internal cloud metadata services.

Quick Start

Use the log-injection-telemetry skill to audit your full observability pipeline for log injection risks, unredacted sensitive data in logs, and exposed or misconfigured metrics and exporter endpoints.

Frequently Asked Questions about log-injection-telemetry

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent CR/LF log injection from forging audit records in cloud-native environments?▼

To prevent CR/LF log injection and audit record forging, you must sanitize carriage return, line feed, and control characters in all interpolated log values before they reach any structured or unstructured log sink.

What is the best way to redact secrets and PII from telemetry pipelines before shipping to a SIEM?▼

The best way to redact secrets and PII from telemetry pipelines is to enforce automated stripping of sensitive data from logs before they are exported to downstream systems like SIEMs or cloud log services.

How do I secure OTLP and CloudWatch exporters against SSRF and data exfiltration?▼

To secure OTLP and CloudWatch exporters against SSRF, you must enforce exporter destination allowlisting, use secret-store credential management, verify TLS for exports, and block webhook sinks from reaching internal cloud metadata services.

Does this telemetry security approach work with unauthenticated metrics endpoints exposing internal topology?▼

Yes, this approach works by auditing and enforcing authenticated access for metrics endpoints to prevent unauthenticated exposure of internal topology across cloud-native and hybrid environments.

Why do legacy compliance frameworks fail to address telemetry-pipeline vulnerabilities in mid-2026 threat landscapes?▼

Legacy compliance frameworks fail because they do not address mid-2026 telemetry vulnerabilities like CR/LF log injection, unredacted secrets in log sinks, exposed metrics endpoints, and SSRF-prone exporter and webhook configurations.

Related Skills

Explore More Legal & Compliance Skills→
Mesh-LLMMesh-LLM
3.1k

telemetry-privacy-review

Audits OTLP metrics and telemetry attributes for privacy risks before changes.

Official
Intermediate
manastalukdarmanastalukdar
1

canary

Poll logs, error rates, and endpoints to verify post-deployment health.

Community
Advanced
BagelHoleBagelHole
46

gcp-secret-manager

Manage Google Cloud Secret Manager secrets with IAM and GKE integration.

Community
Intermediate
interflownexinterflownex
2

gcs-security-assessment

Correlate Google Cloud Storage telemetry to detect toxic vulnerability combinations and SAIF compliance gaps.

Community
Advanced