Kubernetes Network Root Cause Analysis
kubeshark/kubeshark
Investigates past Kubernetes incidents from Kubeshark traffic snapshots: takes captures, dissects API calls, extracts PCAPs and compares traffic over time.
Diagnose and respond to production incidents. An agent skill from agulli/atlas-agents.
Install Incident Response
$ npx skills add agulli/atlas-agents --skill incident-response -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install agulli/atlas-agents incident-response --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/agulli/atlas-agents.git skills-src && mkdir -p .claude/skills && cp -r skills-src/ch09_agent_skills/skills/incident-response .claude/skills/incident-response && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "incident-response" agent skill from https://github.com/agulli/atlas-agents/tree/main/ch09_agent_skills/skills/incident-response into .claude/skills/incident-response/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "incident-response", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/agulli/atlas-agents/tree/main/ch09_agent_skills/skills/incident-responseType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add agulli/atlas-agents --skill incident-response -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install agulli/atlas-agents incident-response --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/agulli/atlas-agents.git skills-src && mkdir -p .agents/skills && cp -r skills-src/ch09_agent_skills/skills/incident-response .agents/skills/incident-response && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "incident-response" agent skill from https://github.com/agulli/atlas-agents/tree/main/ch09_agent_skills/skills/incident-response into .agents/skills/incident-response/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "incident-response", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add agulli/atlas-agents --skill incident-response -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install agulli/atlas-agents incident-response --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/agulli/atlas-agents.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/ch09_agent_skills/skills/incident-response .cursor/skills/incident-response && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "incident-response" agent skill from https://github.com/agulli/atlas-agents/tree/main/ch09_agent_skills/skills/incident-response into .cursor/skills/incident-response/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "incident-response", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/agulli/atlas-agents.git --path ch09_agent_skills/skills/incident-response--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add agulli/atlas-agents --skill incident-response -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install agulli/atlas-agents incident-response --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/agulli/atlas-agents.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/ch09_agent_skills/skills/incident-response .gemini/skills/incident-response && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "incident-response" agent skill from https://github.com/agulli/atlas-agents/tree/main/ch09_agent_skills/skills/incident-response into .gemini/skills/incident-response/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "incident-response", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install agulli/atlas-agents incident-responseInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add agulli/atlas-agents --skill incident-response -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/agulli/atlas-agents.git skills-src && mkdir -p .github/skills && cp -r skills-src/ch09_agent_skills/skills/incident-response .github/skills/incident-response && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "incident-response" agent skill from https://github.com/agulli/atlas-agents/tree/main/ch09_agent_skills/skills/incident-response into .github/skills/incident-response/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "incident-response", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add agulli/atlas-agents --skill incident-response -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install agulli/atlas-agents incident-response --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/agulli/atlas-agents.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/ch09_agent_skills/skills/incident-response .opencode/skills/incident-response && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "incident-response" agent skill from https://github.com/agulli/atlas-agents/tree/main/ch09_agent_skills/skills/incident-response into .opencode/skills/incident-response/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "incident-response", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
incident-response- GitHub stars
- 579
- Token cost
- ~587 tokens
- SKILL.md length
- 297 words
- Files
- 1
- Skills in repo
- 12
- Repo updated
- First seen
- Licence
- MIT
At a glance
Diagnose and respond to production incidents. An agent skill from agulli/atlas-agents.
- Works in 7 steps: Assess severity. Ask or determine → Gather signals. Before forming any… → Form ONE hypothesis. Based on the… → …
- A service is down
- SKILL.md covers Overview, Process, Rationalizations and Verification
- Calls git
What it does
Incident Response is an agent skill from agulli/atlas-agents. Diagnose and respond to production incidents. Use when a service is down, errors are spiking, latency is degraded, or the user reports a production issue.
Its SKILL.md is about 590 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in DevOps & Cloud, covering Incident response. The licence is MIT.
When your agent uses it
- A service is down
- Errors are spiking
- Latency is degraded
- The user reports a production issue
Example prompts
- “/incident-response”
Workflow steps
7 steps, taken from the first numbered list in SKILL.md.
- Assess severity. Ask or determine
- Gather signals. Before forming any hypothesis, collect
- Form ONE hypothesis. Based on the signals, state your best guess in one sentence. Do not enumerate multiple possibilities — pick the most…
- Test the hypothesis. Run exactly one diagnostic command or query that would confirm or refute your hypothesis. Read the output.
- If confirmed: Propose a fix. If the fix involves restarting a service or rolling back a deploy, state the exact command. Do not improvise…
- If refuted: Return to step 2 with the new information. Form a new hypothesis.
- Post-mortem. After the incident is resolved, write a brief post-mortem with
What it can do on your machine
Read from SKILL.md and the folder at commit 2b21998. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
git
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md. Its commands use git, which can reach the network depending on how they are called.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Incident Response loads about 587 tokens when it runs. Until then it costs about 43 tokens; SKILL.md has 297 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from agulli/atlas-agents at commit 2b21998, republished under its MIT licence (© agulli). 297 words, ~587 tokens.
Download SKILL.mdSave it as
.claude/skills/incident-response/SKILL.md (or your agent's skills folder).- name
- incident-response
- description
- Diagnose and respond to production incidents. Use when a service is down, errors are spiking, latency is degraded, or the user reports a production issue.
- license
- MIT
Overview
You are an on-call engineer triaging a live incident. Speed matters, but reckless changes make things worse. Follow the process.
Process
Assess severity. Ask or determine:
- Is the service fully down, partially degraded, or experiencing elevated errors?
- How many users are affected?
- Is data being lost or corrupted?
Gather signals. Before forming any hypothesis, collect:
- Recent deployments (
git log --oneline -10) - Error logs (last 100 lines of the relevant log file)
- Resource utilization (CPU, memory, disk, connections)
- Recent configuration changes
- Recent deployments (
Form ONE hypothesis. Based on the signals, state your best guess in one sentence. Do not enumerate multiple possibilities — pick the most likely one.
Test the hypothesis. Run exactly one diagnostic command or query that would confirm or refute your hypothesis. Read the output.
If confirmed: Propose a fix. If the fix involves restarting a service or rolling back a deploy, state the exact command. Do not improvise commands.
If refuted: Return to step 2 with the new information. Form a new hypothesis.
Post-mortem. After the incident is resolved, write a brief post-mortem with:
- Timeline (when it started, when it was detected, when it was resolved)
- Root cause (one sentence)
- Fix applied
- Follow-up actions to prevent recurrence
Rationalizations
| Excuse | Rebuttal |
|---|---|
| "Let me just restart the service first" | Restarting without diagnosis destroys evidence. Gather signals first. |
| "I have three theories" | Pick one. Test it. If wrong, pick another. Parallel investigation wastes time. |
| "It's probably fine now" | Confirm with metrics. "Probably" is not a resolution status. |
| "We can skip the post-mortem, it was minor" | Minor incidents reveal systemic issues. Write the post-mortem. |
Verification
- Signals were gathered before any remediation was attempted
- The root cause was identified (not assumed)
- Service health was confirmed after the fix (not assumed)
- A post-mortem was written
© agulli, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
Just SKILL.md in ch09_agent_skills/skills/incident-response of agulli/atlas-agents.
Open the folder on GitHubat commit 2b21998
Compare with similar skills
Incident Response next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Incident Response this skillagulli/atlas-agents | 579 | — | ~587 | Automated safety check: Pass | MIT | |
| Kubernetes Network Root Cause Analysiskubeshark/kubeshark | 12k | — | ~5.3k | Automated safety check: Pass | Apache-2.0 | |
| Nix Config Debugryan4yin/nix-config | 2.1k | — | ~1.2k | Automated safety check: Pass | MIT | |
| UModel Root Cause Analysisalibaba/UnifiedModel | 415 | — | ~1.9k | Automated safety check: Pass | Custom licence | |
| Learningskortix-ai/suna | 20k | — | ~1.1k | Automated safety check: Pass | Custom licence | |
| Oncallpigweed-project/pigweed | 548 | — | ~963 | Automated safety check: Pass | Apache-2.0 |
Similar skills
Nix Config Debug
ryan4yin/nix-config
A skill your agent uses when something here is broken or stops working: an eval or build error, a failed activation, a dead or restarting unit, a mihomo or DNS outage, an unreachable host or MicroVM…
UModel Root Cause Analysis
alibaba/UnifiedModel
Investigates a service incident to its root cause by querying a UModel object graph alongside metrics, logs, topology and recent deployments.
Learnings
kortix-ai/suna
The project's episodic memory: a timestamped ledger of rules paid for with real outages and near-misses, one entry per incident.
Oncall
pigweed-project/pigweed
Pigweed oncall rotation runbooks and maintenance workflows (such as rolling CIPD client tools for b/315378787).
Loop Triage Report
cobusgreyling/loop-engineering
Turns CI failures, open issues, recent commits and chat threads into a prioritized markdown report that an automation loop can act on without inventing architecture work.
More from agulli/atlas-agents
All 12 skills in this repoAPI Design
agulli/atlas-agents
Design or review REST and GraphQL API interfaces. An agent skill from agulli/atlas-agents.
Data Pipeline
agulli/atlas-agents
Design, build, or debug data processing pipelines. An agent skill from agulli/atlas-agents.
Database Migration
agulli/atlas-agents
Safely run database schema migrations. An agent skill from agulli/atlas-agents.
Deploy Checklist
agulli/atlas-agents
Execute a structured deployment to staging or production. An agent skill from agulli/atlas-agents.
Documentation Writer
agulli/atlas-agents
Write or update technical documentation for code, APIs, or systems.
Git Commit
agulli/atlas-agents
Create well-structured git commits with conventional commit messages.
Related
Categories
Questions about Incident Response
What does Incident Response do?
Diagnose and respond to production incidents. An agent skill from agulli/atlas-agents. Incident Response is an agent skill from agulli/atlas-agents. Diagnose and respond to production incidents.
When should I use Incident Response?
Incident Response fits situations like: A service is down; errors are spiking; latency is degraded; the user reports a production issue.
How do I install Incident Response in Claude Code?
Run `npx skills add agulli/atlas-agents --skill incident-response -a claude-code`. Or copy the skill folder (ch09_agent_skills/skills/incident-response in agulli/atlas-agents) into .claude/skills/incident-response in your project. Claude Code loads it when a task matches its description.
How do I install Incident Response in Codex?
Run `npx skills add agulli/atlas-agents --skill incident-response -a codex`. Or copy the skill folder (ch09_agent_skills/skills/incident-response in agulli/atlas-agents) into .agents/skills/incident-response in your project. Codex loads it when a task matches its description.
Can I use Incident Response in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add agulli/atlas-agents --skill incident-response -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/incident-response, .gemini/skills/incident-response, .github/skills/incident-response and .opencode/skills/incident-response in your project.
What does Incident Response need to run?
Going by SKILL.md and its folder, Incident Response needs the command-line tools its instructions call (git).
Does Incident Response access the network?
SKILL.md contains no URLs. Its commands use git, which can reach the network depending on how they are called. This is read from the text; nothing was executed.
Is Incident Response safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Incident Response use?
Incident Response is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Incident Response use?
About 587 tokens (SKILL.md is roughly 2.3k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Incident Response?
Skills that share tags, products or a category with Incident Response: Kubernetes Network Root Cause Analysis (kubeshark/kubeshark, 12k stars), Nix Config Debug (ryan4yin/nix-config, 2.1k stars), UModel Root Cause Analysis (alibaba/UnifiedModel, 415 stars) and Learnings (kortix-ai/suna, 20k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Incident Response?
agulli (a GitHub user) maintains it in agulli/atlas-agents, which has 579 GitHub stars. The repository holds 12 skills in this directory. The repository was last updated on July 17, 2026.
Source: agulli/atlas-agents on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.