본문으로 건너뛰기
cccskills
무료GitHub에 공개

incident-triage

Investigate Sentry alerts using Datadog logs and recent GitHub changes, then post an initial diagnosis with a severity assessment. Notify the on-call team when severity reaches the configured threshold or the investigation remains inconclusive, without changing monitored systems.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

원문원문 설명 보기

On-call alert triage runbook for {{sentry_project}}. Pulls the Sentry stack trace, correlates Datadog logs around the spike, checks {{target_repo}} for the deploy that shipped just before, classifies severity against known-noisy patterns, posts a first-pass diagnosis to {{incident_channel}}, and pages a human only when severity is at or above {{page_severity_threshold}} or the alert can't be resolved.

연동 도구SentryDatadog
설치 방법 보기

이럴 때 유용합니다

  • Investigate new and unresolved Sentry alerts
  • Compare failures with logs and recent deployments
  • Notify on-call staff for severe or inconclusive alerts
  • Explain why an alert triggered a notification

포함된 파일(1)

  • SKILL.md5.4 KB

SKILL.md(원문)

설치하기 전에 에이전트에게 전달되는 지시 내용을 확인할 수 있습니다.

<skill name="incident-triage"> <overview> Do the mechanical first minutes of incident response before a human is woken up. A sweep spawns a fresh, read-only session; this skill turns a raw alert into a trace, a suspect deploy, a correlated log window, and a severity call — then decides whether that diagnosis is enough to close the loop or whether it has to page.

Reactive and read-only; covers every new or still-unresolved alert in {{sentry_project}} found in a sweep, nothing carried over between sweeps. Handle each alert as an independent unit: a failure or inconclusive diagnosis on one alert never blocks triage of the others found in the same sweep. </overview>

<when-to-load> - The alert-triage sweep fires on its cadence. - A human asks the agent to re-triage a specific alert or explain why one was paged (or wasn't). </when-to-load> <workflow>

Step 1 — Pull the alert from Sentry (read-only)

Via the Sentry connector, for every alert in {{sentry_project}} that is new or still unresolved since the last sweep:

  • The full stack trace and exception type.
  • Event frequency (spike vs. steady trickle) and the first-seen timestamp.
  • Whether Sentry has already grouped it under an existing, previously-seen issue fingerprint.

Step 2 — Correlate the logs (read-only)

Via the Datadog connector, pull the log lines in a window around the first-seen timestamp (default: 10 minutes before to 5 minutes after), scoped to the service(s) named in the stack trace. Line the log entries up against the trace to confirm the failure mode — a matching upstream timeout, a bad payload, a dependency erroring — rather than trusting the exception message alone.

Step 3 — Check recent deploys on GitHub (read-only)

gh pr list --repo {{target_repo}} --state merged --limit 20 \
  --json number,title,mergedAt,url,author \
  --search "merged:>=<first-seen-minus-2h>"
git log --since="<first-seen-minus-2h>" --until="<first-seen>" --oneline

Rank candidate deploys by how closely they precede the first-seen timestamp and whether the changed files touch the failing service/module. Treat the closest matching deploy as the suspect, not a certainty — say so in the diagnosis.

Step 4 — Classify severity and benign vs. real

SignalClassification
Matches a known flaky/noisy pattern (repeated transient timeout, third-party rate limit, a fingerprint seen before with no user impact)Benign — close with reasoning, no page
New error type, affects one user or a narrow code path, no matching deployReal, low severity — post diagnosis, no page unless it recurs
Spike in frequency, matches a recent deploy, or affects a shared/critical pathReal, elevated severity
Marked fatal/critical in Sentry, or severity at or above {{page_severity_threshold}}Page immediately regardless of diagnosis confidence
Trace, logs, or deploy history are inconclusive after Steps 1–3Unresolved — page, diagnosis attached as partial context

Step 5 — Post the first-pass diagnosis

Post one message per alert to {{incident_channel}}: the error and where it's from, the first-seen time and frequency, the correlated log lines, the suspect deploy (PR/commit + author, or "no matching deploy found"), and the severity classification from Step 4.

Step 6 — Page or close

  • Page — at or above {{page_severity_threshold}}, or unresolved per Step 4: @-mention the on-call rotation in {{incident_channel}} on the same message, with the diagnosis attached as context, not a substitute for looking at it.
  • Close — benign or low severity with a confident diagnosis: mark it resolved in the post with the reasoning, no page.

Nothing else leaves the sandbox — no ticket creation, no deploy, no rollback, no config change.

</workflow> <guardrails> - **Read-only across every connector.** Sentry, Datadog, and GitHub are investigated, never written to — no comments, no resolves-in-Sentry, no commits, no deploys, no rollbacks. - **One diagnosis per alert.** Post exactly one message to {{incident_channel}} per alert per sweep; don't re-post an alert already diagnosed this sweep. - **Independent per alert.** Treat every alert found in a sweep as its own case; a failure or inconclusive result investigating one never stops triage of the others found in the same sweep. - **Page on doubt.** An inconclusive diagnosis pages a human — never guess "probably fine" into silence on anything ambiguous. - **Severity floor is non-negotiable.** Anything at or above {{page_severity_threshold}} pages regardless of how confident the diagnosis is. - **Scoped secrets.** Sentry, Datadog, and GitHub credentials are brokered server-side through connectors and the GitHub token is injected at runtime; scoped to this agent's grant. - **No memory required between sweeps.** Each sweep is a fresh session — the "new or unresolved since last check" filter comes from Sentry's own issue state, not an agent-side ledger. </guardrails> </skill>

리뷰

아직 리뷰가 없습니다. 사용해 본 소감을 남겨 주세요.

댓글

로그인 없이 쓸 수 있습니다. 사용 후기, 질문, 작동하지 않은 환경 등을 편하게 남겨 주세요.

아직 댓글이 없습니다. 첫 댓글을 남겨 보세요.

보내면 바로 공개됩니다. 이메일 주소나 전화번호 같은 개인 정보는 쓰지 마세요. URL은 2개까지입니다.

0 / 1,000자

이 양식은 reCAPTCHA로 보호되며 Google 개인정보처리방침 및 서비스 약관이 적용됩니다.

같은 저장소의 스킬

Review Slack access requests against Okta role and team information, then prepare narrowly scoped GitHub or AWS IAM permissions. Apply changes only after an eligible person's approval and record the grant, reasoning, approver, and timestamp.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

  • Reviewing GitHub repository access requests from Slack
  • Preparing AWS IAM permissions for a specific task
  • Routing sensitive access requests for additional review
kortix-ai/suna2만2026년 10월 22일 업데이트

Research companies and people before outreach or meetings. Combines business profiles, recent news, hiring signals, and key contacts into a sourced brief with talking points and suggested questions, adding relationship history when CRM data is connected.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

  • Research a prospective customer before outreach
  • Prepare background information for meeting attendees
  • Compare a competitor's products and positioning
kortix-ai/suna2만2026년 10월 22일 업데이트

Review daily Google Ads and Meta Ads results for budget pacing, declining performance, and unusual activity. Get prioritized findings with supporting numbers and concrete recommendations for a marketing team to assess and carry out.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

  • Checking whether campaign budgets are being spent on schedule
  • Investigating rising acquisition costs or falling ad returns
  • Finding ads and keywords that spend without converting
kortix-ai/suna2만2026년 10월 22일 업데이트

Automate website tasks such as navigating pages, filling forms, clicking buttons, taking screenshots, and extracting data. The skill also supports web app testing, with specialized guides for Electron desktop apps, Slack, and cloud browsers.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

  • Automate form entry and page navigation
  • Capture screenshots and extract page data
  • Explore web apps for bugs
kortix-ai/suna2만2026년 10월 22일 업데이트

Process emailed vendor invoices by extracting details, comparing them with purchase orders and invoice history, and recording duplicates, overcharges, or missing orders. Summarize results in Slack for human review; payment approval and execution remain with people.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

  • Checking incoming invoices against purchase orders
  • Finding duplicate invoices and likely resends
  • Reviewing unit prices and remaining order balances
kortix-ai/suna2만2026년 10월 22일 업데이트

billing

무료

Guide changes to Kortix billing code, admin controls, and pricing screens. Explain how plans, trials, enterprise contracts, and access exceptions should work, where pricing is defined, and which audited routes must handle account changes.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

  • Update billing logic and its specification together
  • Review how trials and enterprise contracts are handled
  • Find the code that defines prices and allowances
kortix-ai/suna2만2026년 10월 22일 업데이트

kortix-ai의 스킬 모두 보기

이 스킬의 문제 신고