From 9638160d97c431dbb3cf8e2952925b39ce058ca7 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Mon, 1 Jun 2026 03:24:22 +0000 Subject: [PATCH 1/4] chore(deps): update datadog-labs/agent-skills digest to 9bcb3ce --- skills/dd-apm/spec.yaml | 2 +- skills/dd-docs/spec.yaml | 2 +- skills/dd-llmo-eval-bootstrap/spec.yaml | 2 +- skills/dd-llmo-eval-session-classify/spec.yaml | 2 +- skills/dd-llmo-eval-trace-rca/spec.yaml | 2 +- skills/dd-llmo-experiment-analyzer/spec.yaml | 2 +- skills/dd-logs/spec.yaml | 2 +- skills/dd-monitors/spec.yaml | 2 +- skills/dd-pup/spec.yaml | 2 +- 9 files changed, 9 insertions(+), 9 deletions(-) diff --git a/skills/dd-apm/spec.yaml b/skills/dd-apm/spec.yaml index e763d59..92b2bca 100644 --- a/skills/dd-apm/spec.yaml +++ b/skills/dd-apm/spec.yaml @@ -9,7 +9,7 @@ metadata: spec: repository: "https://github.com/datadog-labs/agent-skills" - ref: "2f664fd5042d6838dfc06b605c6e2619eb8079c5" # main as of 2026-04-15 + ref: "9bcb3ceafacae78dbba76c9459a878fc7d6a0d10" # main as of 2026-04-15 path: "dd-apm" version: "0.2.0" diff --git a/skills/dd-docs/spec.yaml b/skills/dd-docs/spec.yaml index 1e1c216..bc26d30 100644 --- a/skills/dd-docs/spec.yaml +++ b/skills/dd-docs/spec.yaml @@ -9,7 +9,7 @@ metadata: spec: repository: "https://github.com/datadog-labs/agent-skills" - ref: "2f664fd5042d6838dfc06b605c6e2619eb8079c5" + ref: "9bcb3ceafacae78dbba76c9459a878fc7d6a0d10" path: "dd-docs" version: "0.2.0" diff --git a/skills/dd-llmo-eval-bootstrap/spec.yaml b/skills/dd-llmo-eval-bootstrap/spec.yaml index 8811bac..9e2cabd 100644 --- a/skills/dd-llmo-eval-bootstrap/spec.yaml +++ b/skills/dd-llmo-eval-bootstrap/spec.yaml @@ -9,7 +9,7 @@ metadata: spec: repository: "https://github.com/datadog-labs/agent-skills" - ref: "2f664fd5042d6838dfc06b605c6e2619eb8079c5" # main as of 2026-04-15 + ref: "9bcb3ceafacae78dbba76c9459a878fc7d6a0d10" # main as of 2026-04-15 path: "dd-llmo/eval-bootstrap" version: "0.2.0" diff --git a/skills/dd-llmo-eval-session-classify/spec.yaml b/skills/dd-llmo-eval-session-classify/spec.yaml index 67f066e..ebd07bf 100644 --- a/skills/dd-llmo-eval-session-classify/spec.yaml +++ b/skills/dd-llmo-eval-session-classify/spec.yaml @@ -9,7 +9,7 @@ metadata: spec: repository: "https://github.com/datadog-labs/agent-skills" - ref: "2f664fd5042d6838dfc06b605c6e2619eb8079c5" + ref: "9bcb3ceafacae78dbba76c9459a878fc7d6a0d10" path: "dd-llmo/eval-session-classify" version: "0.2.0" diff --git a/skills/dd-llmo-eval-trace-rca/spec.yaml b/skills/dd-llmo-eval-trace-rca/spec.yaml index a9ef196..5378f50 100644 --- a/skills/dd-llmo-eval-trace-rca/spec.yaml +++ b/skills/dd-llmo-eval-trace-rca/spec.yaml @@ -9,7 +9,7 @@ metadata: spec: repository: "https://github.com/datadog-labs/agent-skills" - ref: "2f664fd5042d6838dfc06b605c6e2619eb8079c5" + ref: "9bcb3ceafacae78dbba76c9459a878fc7d6a0d10" path: "dd-llmo/eval-trace-rca" version: "0.2.0" diff --git a/skills/dd-llmo-experiment-analyzer/spec.yaml b/skills/dd-llmo-experiment-analyzer/spec.yaml index 9810b1a..57fc226 100644 --- a/skills/dd-llmo-experiment-analyzer/spec.yaml +++ b/skills/dd-llmo-experiment-analyzer/spec.yaml @@ -9,7 +9,7 @@ metadata: spec: repository: "https://github.com/datadog-labs/agent-skills" - ref: "2f664fd5042d6838dfc06b605c6e2619eb8079c5" + ref: "9bcb3ceafacae78dbba76c9459a878fc7d6a0d10" path: "dd-llmo/experiment-analyzer" version: "0.2.0" diff --git a/skills/dd-logs/spec.yaml b/skills/dd-logs/spec.yaml index c422739..297b491 100644 --- a/skills/dd-logs/spec.yaml +++ b/skills/dd-logs/spec.yaml @@ -9,7 +9,7 @@ metadata: spec: repository: "https://github.com/datadog-labs/agent-skills" - ref: "2f664fd5042d6838dfc06b605c6e2619eb8079c5" + ref: "9bcb3ceafacae78dbba76c9459a878fc7d6a0d10" path: "dd-logs" version: "0.2.0" diff --git a/skills/dd-monitors/spec.yaml b/skills/dd-monitors/spec.yaml index 1c33e4c..075ba67 100644 --- a/skills/dd-monitors/spec.yaml +++ b/skills/dd-monitors/spec.yaml @@ -9,7 +9,7 @@ metadata: spec: repository: "https://github.com/datadog-labs/agent-skills" - ref: "2f664fd5042d6838dfc06b605c6e2619eb8079c5" + ref: "9bcb3ceafacae78dbba76c9459a878fc7d6a0d10" path: "dd-monitors" version: "0.2.0" diff --git a/skills/dd-pup/spec.yaml b/skills/dd-pup/spec.yaml index 4a11568..8b6ade6 100644 --- a/skills/dd-pup/spec.yaml +++ b/skills/dd-pup/spec.yaml @@ -9,7 +9,7 @@ metadata: spec: repository: "https://github.com/datadog-labs/agent-skills" - ref: "2f664fd5042d6838dfc06b605c6e2619eb8079c5" + ref: "9bcb3ceafacae78dbba76c9459a878fc7d6a0d10" path: "dd-pup" version: "0.2.0" From 550edccb0b35a5eb85b8a2a2699f4d0b8fc209b0 Mon Sep 17 00:00:00 2001 From: "toolhive-release-app[bot]" <280093410+toolhive-release-app[bot]@users.noreply.github.com> Date: Mon, 1 Jun 2026 03:25:05 +0000 Subject: [PATCH 2/4] chore(skills): bump spec.version for dd-apm,dd-docs,dd-llmo-eval-bootstrap,dd-llmo-eval-session-classify,dd-llmo-eval-trace-rca,dd-llmo-experiment-analyzer,dd-logs,dd-monitors,dd-pup --- skills/dd-apm/spec.yaml | 2 +- skills/dd-docs/spec.yaml | 2 +- skills/dd-llmo-eval-bootstrap/spec.yaml | 2 +- skills/dd-llmo-eval-session-classify/spec.yaml | 2 +- skills/dd-llmo-eval-trace-rca/spec.yaml | 2 +- skills/dd-llmo-experiment-analyzer/spec.yaml | 2 +- skills/dd-logs/spec.yaml | 2 +- skills/dd-monitors/spec.yaml | 2 +- skills/dd-pup/spec.yaml | 2 +- 9 files changed, 9 insertions(+), 9 deletions(-) diff --git a/skills/dd-apm/spec.yaml b/skills/dd-apm/spec.yaml index 92b2bca..7a167a2 100644 --- a/skills/dd-apm/spec.yaml +++ b/skills/dd-apm/spec.yaml @@ -11,7 +11,7 @@ spec: repository: "https://github.com/datadog-labs/agent-skills" ref: "9bcb3ceafacae78dbba76c9459a878fc7d6a0d10" # main as of 2026-04-15 path: "dd-apm" - version: "0.2.0" + version: "0.3.0" provenance: repository_uri: "https://github.com/datadog-labs/agent-skills" diff --git a/skills/dd-docs/spec.yaml b/skills/dd-docs/spec.yaml index bc26d30..4fbe512 100644 --- a/skills/dd-docs/spec.yaml +++ b/skills/dd-docs/spec.yaml @@ -11,7 +11,7 @@ spec: repository: "https://github.com/datadog-labs/agent-skills" ref: "9bcb3ceafacae78dbba76c9459a878fc7d6a0d10" path: "dd-docs" - version: "0.2.0" + version: "0.3.0" provenance: repository_uri: "https://github.com/datadog-labs/agent-skills" diff --git a/skills/dd-llmo-eval-bootstrap/spec.yaml b/skills/dd-llmo-eval-bootstrap/spec.yaml index 9e2cabd..75c3df1 100644 --- a/skills/dd-llmo-eval-bootstrap/spec.yaml +++ b/skills/dd-llmo-eval-bootstrap/spec.yaml @@ -11,7 +11,7 @@ spec: repository: "https://github.com/datadog-labs/agent-skills" ref: "9bcb3ceafacae78dbba76c9459a878fc7d6a0d10" # main as of 2026-04-15 path: "dd-llmo/eval-bootstrap" - version: "0.2.0" + version: "0.3.0" provenance: repository_uri: "https://github.com/datadog-labs/agent-skills" diff --git a/skills/dd-llmo-eval-session-classify/spec.yaml b/skills/dd-llmo-eval-session-classify/spec.yaml index ebd07bf..6dc9ddc 100644 --- a/skills/dd-llmo-eval-session-classify/spec.yaml +++ b/skills/dd-llmo-eval-session-classify/spec.yaml @@ -11,7 +11,7 @@ spec: repository: "https://github.com/datadog-labs/agent-skills" ref: "9bcb3ceafacae78dbba76c9459a878fc7d6a0d10" path: "dd-llmo/eval-session-classify" - version: "0.2.0" + version: "0.3.0" provenance: repository_uri: "https://github.com/datadog-labs/agent-skills" diff --git a/skills/dd-llmo-eval-trace-rca/spec.yaml b/skills/dd-llmo-eval-trace-rca/spec.yaml index 5378f50..31c651c 100644 --- a/skills/dd-llmo-eval-trace-rca/spec.yaml +++ b/skills/dd-llmo-eval-trace-rca/spec.yaml @@ -11,7 +11,7 @@ spec: repository: "https://github.com/datadog-labs/agent-skills" ref: "9bcb3ceafacae78dbba76c9459a878fc7d6a0d10" path: "dd-llmo/eval-trace-rca" - version: "0.2.0" + version: "0.3.0" provenance: repository_uri: "https://github.com/datadog-labs/agent-skills" diff --git a/skills/dd-llmo-experiment-analyzer/spec.yaml b/skills/dd-llmo-experiment-analyzer/spec.yaml index 57fc226..f621ab9 100644 --- a/skills/dd-llmo-experiment-analyzer/spec.yaml +++ b/skills/dd-llmo-experiment-analyzer/spec.yaml @@ -11,7 +11,7 @@ spec: repository: "https://github.com/datadog-labs/agent-skills" ref: "9bcb3ceafacae78dbba76c9459a878fc7d6a0d10" path: "dd-llmo/experiment-analyzer" - version: "0.2.0" + version: "0.3.0" provenance: repository_uri: "https://github.com/datadog-labs/agent-skills" diff --git a/skills/dd-logs/spec.yaml b/skills/dd-logs/spec.yaml index 297b491..8ad48e6 100644 --- a/skills/dd-logs/spec.yaml +++ b/skills/dd-logs/spec.yaml @@ -11,7 +11,7 @@ spec: repository: "https://github.com/datadog-labs/agent-skills" ref: "9bcb3ceafacae78dbba76c9459a878fc7d6a0d10" path: "dd-logs" - version: "0.2.0" + version: "0.3.0" provenance: repository_uri: "https://github.com/datadog-labs/agent-skills" diff --git a/skills/dd-monitors/spec.yaml b/skills/dd-monitors/spec.yaml index 075ba67..33643af 100644 --- a/skills/dd-monitors/spec.yaml +++ b/skills/dd-monitors/spec.yaml @@ -11,7 +11,7 @@ spec: repository: "https://github.com/datadog-labs/agent-skills" ref: "9bcb3ceafacae78dbba76c9459a878fc7d6a0d10" path: "dd-monitors" - version: "0.2.0" + version: "0.3.0" provenance: repository_uri: "https://github.com/datadog-labs/agent-skills" diff --git a/skills/dd-pup/spec.yaml b/skills/dd-pup/spec.yaml index 8b6ade6..affe4c0 100644 --- a/skills/dd-pup/spec.yaml +++ b/skills/dd-pup/spec.yaml @@ -11,7 +11,7 @@ spec: repository: "https://github.com/datadog-labs/agent-skills" ref: "9bcb3ceafacae78dbba76c9459a878fc7d6a0d10" path: "dd-pup" - version: "0.2.0" + version: "0.3.0" provenance: repository_uri: "https://github.com/datadog-labs/agent-skills" From 673cf023d77260f5ae7974e50f267123baed6297 Mon Sep 17 00:00:00 2001 From: Juan Antonio Osorio Date: Wed, 3 Jun 2026 09:58:18 +0300 Subject: [PATCH 3/4] fix(datadog-skills): allowlist scanner FPs and fix validation for 9bcb3ce MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The datadog-labs/agent-skills digest bump to 9bcb3ce renamed the dd-llmo subdirectories, which broke both validate-skills and skill-security-scan (the scanner could not find the source dir at the old path). validate-skills / scan source-dir fixes (path renames upstream): - dd-llmo-eval-bootstrap: dd-llmo/eval-bootstrap -> dd-llmo/llm-obs-eval-bootstrap - dd-llmo-eval-session-classify: dd-llmo/eval-session-classify -> dd-llmo/llm-obs-session-classify - dd-llmo-eval-trace-rca: dd-llmo/eval-trace-rca -> dd-llmo/llm-obs-trace-rca - dd-llmo-experiment-analyzer: dd-llmo/experiment-analyzer -> dd-llmo/llm-obs-experiment-analyzer Mappings verified against SKILL.md frontmatter name/description at the new ref. Scan FP allowlist: - dd-apm: COMPOUND_EXTRACT_EXECUTE (HIGH) — matches the documented `pup` CLI install snippet (download official datadog-labs/pup release tarball, pipe through `tar xz` into /usr/local/bin). Vendor-published install instruction, not a hidden malicious archive payload. Co-Authored-By: Claude Opus 4.8 (1M context) --- skills/dd-apm/spec.yaml | 12 ++++++++++++ skills/dd-llmo-eval-bootstrap/spec.yaml | 2 +- skills/dd-llmo-eval-session-classify/spec.yaml | 2 +- skills/dd-llmo-eval-trace-rca/spec.yaml | 2 +- skills/dd-llmo-experiment-analyzer/spec.yaml | 2 +- 5 files changed, 16 insertions(+), 4 deletions(-) diff --git a/skills/dd-apm/spec.yaml b/skills/dd-apm/spec.yaml index 7a167a2..6aa567b 100644 --- a/skills/dd-apm/spec.yaml +++ b/skills/dd-apm/spec.yaml @@ -21,3 +21,15 @@ security: allowed_issues: - rule_id: MANIFEST_MISSING_LICENSE reason: "datadog-labs/agent-skills is licensed MIT at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter." + - rule_id: COMPOUND_EXTRACT_EXECUTE + reason: | + FP: cisco-ai-skill-scanner matched the documented `pup` CLI install + snippet in k8s-ssi/agent-install/SKILL.md:67, + k8s-ssi/troubleshoot-ssi/SKILL.md:48 and + linux-ssi/troubleshoot-ssi/SKILL.md:48. The snippet downloads the + official pup release tarball from the same vendor + (github.com/datadog-labs/pup/releases, version pinned via the GitHub + releases API) and pipes it through `tar xz` into /usr/local/bin — the + canonical, vendor-published CLI install instruction shown to the user, + not a hidden/malicious archive payload. No executable threat. + datadog-labs/agent-skills @9bcb3ceafacae78dbba76c9459a878fc7d6a0d10. diff --git a/skills/dd-llmo-eval-bootstrap/spec.yaml b/skills/dd-llmo-eval-bootstrap/spec.yaml index 75c3df1..d00a954 100644 --- a/skills/dd-llmo-eval-bootstrap/spec.yaml +++ b/skills/dd-llmo-eval-bootstrap/spec.yaml @@ -10,7 +10,7 @@ metadata: spec: repository: "https://github.com/datadog-labs/agent-skills" ref: "9bcb3ceafacae78dbba76c9459a878fc7d6a0d10" # main as of 2026-04-15 - path: "dd-llmo/eval-bootstrap" + path: "dd-llmo/llm-obs-eval-bootstrap" version: "0.3.0" provenance: diff --git a/skills/dd-llmo-eval-session-classify/spec.yaml b/skills/dd-llmo-eval-session-classify/spec.yaml index 6dc9ddc..d266073 100644 --- a/skills/dd-llmo-eval-session-classify/spec.yaml +++ b/skills/dd-llmo-eval-session-classify/spec.yaml @@ -10,7 +10,7 @@ metadata: spec: repository: "https://github.com/datadog-labs/agent-skills" ref: "9bcb3ceafacae78dbba76c9459a878fc7d6a0d10" - path: "dd-llmo/eval-session-classify" + path: "dd-llmo/llm-obs-session-classify" version: "0.3.0" provenance: diff --git a/skills/dd-llmo-eval-trace-rca/spec.yaml b/skills/dd-llmo-eval-trace-rca/spec.yaml index 31c651c..33426b6 100644 --- a/skills/dd-llmo-eval-trace-rca/spec.yaml +++ b/skills/dd-llmo-eval-trace-rca/spec.yaml @@ -10,7 +10,7 @@ metadata: spec: repository: "https://github.com/datadog-labs/agent-skills" ref: "9bcb3ceafacae78dbba76c9459a878fc7d6a0d10" - path: "dd-llmo/eval-trace-rca" + path: "dd-llmo/llm-obs-trace-rca" version: "0.3.0" provenance: diff --git a/skills/dd-llmo-experiment-analyzer/spec.yaml b/skills/dd-llmo-experiment-analyzer/spec.yaml index f621ab9..86833c3 100644 --- a/skills/dd-llmo-experiment-analyzer/spec.yaml +++ b/skills/dd-llmo-experiment-analyzer/spec.yaml @@ -10,7 +10,7 @@ metadata: spec: repository: "https://github.com/datadog-labs/agent-skills" ref: "9bcb3ceafacae78dbba76c9459a878fc7d6a0d10" - path: "dd-llmo/experiment-analyzer" + path: "dd-llmo/llm-obs-experiment-analyzer" version: "0.3.0" provenance: From 05f83534e9c2aa2638e89fd53a059241dcac75ce Mon Sep 17 00:00:00 2001 From: Juan Antonio Osorio Date: Wed, 3 Jun 2026 10:06:45 +0300 Subject: [PATCH 4/4] fix(dd-llmo-eval-bootstrap): allowlist new ATR_2026_* scanner FPs at 9bcb3ce MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit After the path was corrected to dd-llmo/llm-obs-eval-bootstrap, the scanner ran against the new SKILL.md, which grew (~681 -> ~1180 lines) at ref 9bcb3ce with the added "publish online LLM-judge evaluators" workflow. That section trips 14 ATR_2026_* rule-pack rules (CRITICAL/HIGH). All confirmed false positives — substring / word-fragment matches on benign documentation prose ("become the", "skip this step", "Extract the rule", "system prompt", "For each", "Deploy") and backtick-wrapped upstream tool/CLI/template names (get_llmobs_* tools, pup llm-obs evals, {{input_data}} prompt placeholders). No executable threat; these are docs/code describing how the agent should operate against the user's own Datadog tenant. Co-Authored-By: Claude Opus 4.8 (1M context) --- skills/dd-llmo-eval-bootstrap/spec.yaml | 34 +++++++++++++++++++++++++ 1 file changed, 34 insertions(+) diff --git a/skills/dd-llmo-eval-bootstrap/spec.yaml b/skills/dd-llmo-eval-bootstrap/spec.yaml index d00a954..8886e4f 100644 --- a/skills/dd-llmo-eval-bootstrap/spec.yaml +++ b/skills/dd-llmo-eval-bootstrap/spec.yaml @@ -60,3 +60,37 @@ security: False positive - matches `run()` on SKILL.md:537 inside example Python code (likely `evaluator.run()` or similar). Not multi-agent attack traffic. Verified at digest 98343f304cbd4439b3d7640cfe64f78070e44d68. + # --- ATR_2026_* rule-pack hits introduced when the eval-bootstrap SKILL.md + # grew (~681 -> ~1180 lines) at ref 9bcb3ce, adding the "publish online + # LLM-judge evaluators" workflow. All are substring / word-fragment matches + # on benign documentation prose and backtick-wrapped upstream tool/CLI/template + # names in a skill whose explicit purpose is bootstrapping LLM evaluators. + # No executable threat. datadog-labs/agent-skills @9bcb3ceafacae78dbba76c9459a878fc7d6a0d10. + - rule_id: ATR_2026_00001 + reason: "FP: matched prose 'these become the domain-specific evaluator category' (SKILL.md:371). Documentation guidance, no executable threat. datadog-labs/agent-skills @9bcb3ce." + - rule_id: ATR_2026_00004 + reason: "FP: matched JSON/code example fragment `{role: \"` in an eval message schema. Documentation/code, no executable threat. datadog-labs/agent-skills @9bcb3ce." + - rule_id: ATR_2026_00010 + reason: "FP: matched backtick-wrapped upstream tool/CLI names — `get_llmobs_evaluator`, `list_llmobs_eval*`, `create_or_update_llmobs_eval*`, `pup llm-obs evals get-eval`, `/eval`. Documentation references to tools the skill instructs the agent to call against the user's own Datadog tenant, not executed payloads. datadog-labs/agent-skills @9bcb3ce." + - rule_id: ATR_2026_00012 + reason: "FP: word-fragment matches — `integration_account_id`, table cells, tool-name fragments like `get_llmobs_span_details(trace_id`. Documentation strings, no executable threat. datadog-labs/agent-skills @9bcb3ce." + - rule_id: ATR_2026_00030 + reason: "FP: matched `run()` (SKILL.md:613) inside an example Python experiment-client snippet. Not an attack vector. datadog-labs/agent-skills @9bcb3ce." + - rule_id: ATR_2026_00032 + reason: "FP: matched prose 'skip this step and proceed directly' (SKILL.md:396). Workflow instruction, no executable threat. datadog-labs/agent-skills @9bcb3ce." + - rule_id: ATR_2026_00040 + reason: "FP: matched the word 'Deploy' in prose 'Deploy to Datadog LLM Experiments' (SKILL.md:729). Documentation step, no executable threat. datadog-labs/agent-skills @9bcb3ce." + - rule_id: ATR_2026_00051 + reason: "FP: matched the prose phrase 'For each' (loop-over-traces guidance). Documentation, no executable threat. datadog-labs/agent-skills @9bcb3ce." + - rule_id: ATR_2026_00066 + reason: "FP: matched Datadog eval-prompt template placeholders — `{{input_data}}`, `{{output_data}}`, `{{span_input}}`, `{{meta.input.messages[*].content}}`. These are the documented templating syntax for LLM-judge prompts, not injected payloads. datadog-labs/agent-skills @9bcb3ce." + - rule_id: ATR_2026_00090 + reason: "FP: matched prose 'Extract the rules implicitly followed across observed outputs' (SKILL.md:375). Analysis guidance, no executable threat. datadog-labs/agent-skills @9bcb3ce." + - rule_id: ATR_2026_00091 + reason: "FP: matched literal `\\n` newline escapes inside JSON/code example blocks. Documentation/code, no executable threat. datadog-labs/agent-skills @9bcb3ce." + - rule_id: ATR_2026_00110 + reason: "FP: matched `eval (` inside an example Python evaluator function signature. Not a code-eval sink. datadog-labs/agent-skills @9bcb3ce." + - rule_id: ATR_2026_00111 + reason: "FP: word-fragment matches — `summarizing a policy` (example intent category), `eval_scope` (identifier). Documentation strings, no executable threat. datadog-labs/agent-skills @9bcb3ce." + - rule_id: ATR_2026_00213 + reason: "FP: matched the literal words 'system prompt' / 'System Prompt' in prose describing Datadog span fields and eval dimensions. Documentation, not a system-prompt-extraction attack. datadog-labs/agent-skills @9bcb3ce."