feat(sec-core): add security observability skill - #2245
Draft
yangdao479 wants to merge 1 commit into
Draft
Conversation
Document read-only security event queries through agent-sec-cli events. Document session reports for agent workflows. Keep the skill in the shared skills bundle. Avoid bundling it in the cosh extension so existing skill install paths distribute it. Signed-off-by: yizheng <YiZheng.Yang@linux.alibaba.com>
github-actions
Bot
added
component:sec-core
RemindD
reviewed
Aug 6, 2026
| 1. 先用 `events --summary` 或 `events --count-by` 获取概览。 | ||
| 2. 根据 `event_type`、`category`、关联 ID 和时间范围缩小查询。 | ||
| 3. 需要程序解析时使用 `--output json` 或 `--output jsonl`，不要解析 table 或 summary 文本。 | ||
| 4. 已知 `session_id` 或需要查看最近会话时，使用 `observability report --format json` 汇总 LLM、工具和安全事件。 |
Collaborator
There was a problem hiding this comment.
还需要添加--last或者--session-id session_id可以获得session级别的统计
| agent-sec-cli events --last-hours 8 --category code_scan --count | ||
| ``` | ||
|
|
||
| `--summary` 在未指定时间范围时默认查询最近 24 小时。它输出人类可读文本，只适合展示，不适合作为稳定的数据接口。 |
Collaborator
There was a problem hiding this comment.
为什么不适合作为稳定的数据接口呢？如果不适合应该要进行改进
| --output json | ||
| ``` | ||
|
|
||
| ### 参数 |
Collaborator
There was a problem hiding this comment.
是否通过agent-sec-cli events --help自动获取，维护两份参数列表可能会导致修改后不一致
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Agent 需要一个明确的 Skill 来理解如何通过
agent-sec-cli查询本地安全事件和会话级安全复盘结果。现有 CLI 已具备events和observability report能力，但缺少面向 Agent 的参数说明、输出结构说明和安全报告规则。What changed
security-observabilitySkill，说明agent-sec-cli events的过滤参数、互斥规则、JSON/JSONL 输出结构、计数输出和事件字段语义。agent-sec-cli observability report --format json的会话报告结构，并提示不要把顶层succeeded/failed误解为扫描器的pass/warn/deny。Related issue
no-issue: 补齐 agent-sec-core 安全可观测查询的 Agent 使用说明。
User / Agent impact
安装 agent-sec-core skills 后，Agent 可以调用
security-observabilitySkill，按结构化方式查询安全事件和会话报告。运行时 CLI、hook 和 extension 行为不变。Risk and compatibility
Low risk。变更只新增 Skill 文档和对应契约测试，不修改 CLI 行为、hook 行为、配置格式或安装布局。
Validation
uv run --project /Users/blank/Workspace/mine_anolisa/mine_anolisa/src/agent-sec-core/agent-sec-cli pytest /Users/blank/Workspace/mine_anolisa/mine_anolisa/src/agent-sec-core/tests/unit-test/cosh_hooks/test_extension_skill.py -v— 4 passedmake -C /Users/blank/Workspace/mine_anolisa/mine_anolisa/src/agent-sec-core stage-skills— passedmake -C /Users/blank/Workspace/mine_anolisa/mine_anolisa/src/agent-sec-core stage-component-manifest— passedgit --no-pager diff --check -- <本次相关文件>— passedDocumentation and rollback
新增的
SKILL.md是面向 Agent 的使用说明。回滚时删除src/agent-sec-core/skills/security-observability/及对应契约测试即可，不影响现有 CLI、hook 或 component manifest。