Agent skill

UModel Root Cause Analysis

by alibaba in alibaba/UnifiedModel

Investigates a service incident to its root cause by querying a UModel object graph alongside metrics, logs, topology and recent deployments.

Custom licenceAuto-check passedDevOps & Cloud

Install UModel Root Cause Analysis

skills CLI
$ npx skills add alibaba/UnifiedModel --skill umodel-rca -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install alibaba/UnifiedModel umodel-rca --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/alibaba/UnifiedModel.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/umodel-rca .claude/skills/umodel-rca && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
umodel-rca
GitHub stars
415
Token cost
~1.9k tokens
SKILL.md length
758 words
Files
2 (incl. references)
Skills in repo
2
Repo updated
First seen
Licence
Custom licence

At a glance

Investigates a service incident to its root cause by querying a UModel object graph alongside metrics, logs, topology and recent deployments.

  • Works in 6 steps: Orient → Characterize → Hypothesize → …
  • Investigating why a service is suddenly slow or erroring
  • SKILL.md covers Setup, RCA Loop and Evaluation Discipline
  • Calls go, sh and make

What it does

This skill treats root-cause investigation as a method rather than a fixed script: it lets evidence decide the next query, keeps competing hypotheses alive, and requires every conclusion to cite an object-graph, metric, or log source. It runs on top of a companion query skill, which provides the actual read surfaces - entity lookups, topology, UModel queries, and metric or log calls scoped to a set of entities - reached through the umctl CLI pointed at a UModel server and workspace.

Its loop starts by orienting on the incident: finding the symptomatic service or incident entity, reading its environment, owner, SLO tier, status, recent errors and linked runbook, and discovering neighboring entities before narrowing too early. It then characterizes the symptom by confirming it against real telemetry rather than entity status alone - latency, error rate, timeout rate, QPS, retry rate, saturation and error budget from metrics, plus logs for timeouts, retries, circuit breakers, dependency issues, deploys or config changes.

A bundled reference file of evidence patterns and a provided incident-investigation example wire the same workflow to real Prometheus and Elasticsearch data sources, and the skill is explicitly useful for ruling out a recent but unrelated deployment as a red herring rather than assuming correlation means causation.

When your agent uses it

  • Investigating why a service is suddenly slow or erroring
  • Finding the root cause of an SLO breach or outage
  • Ruling out an unrelated recent deployment during an incident

Example prompts

  • “Why is the checkout service suddenly timing out?”
  • “Investigate this SLO breach and find the root cause.”
  • “Is this incident actually related to yesterday's deploy?”

Requirements

  • umctl CLI
  • A running UModel server
  • Go 1.22+ (to build umctl from source)

Workflow steps

6 steps, taken from the step headings in SKILL.md.

  1. Orient
  2. Characterize
  3. Hypothesize
  4. Gather Cross-Domain Evidence
  5. Correlate And Discriminate
  6. Conclude

What it can do on your machine

Read from SKILL.md and the folder at commit 1b54ddc. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • go
    • sh
    • make

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

UModel Root Cause Analysis loads about 1.9k tokens when it runs, and up to ~2.8k if it reads all its reference files. Until then it costs about 171 tokens; SKILL.md has 758 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~171
When it runs · the whole SKILL.md, loaded when a task matches
~1.9k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~2.8k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

Its licence (Custom licence) doesn't allow us to republish the file, so here is its outline and opening line. It has 758 words (~1,928 tokens).

“Investigate to a root cause over the UModel object graph. Use this as a method, not a script: let evidence decide the next query, keep competing hypotheses alive, and cite every conclusion with an object-graph, metric, or log source.”

— opening of SKILL.md by alibaba, Custom licence
name
umodel-rca

Read the full SKILL.md on GitHub

Files

SKILL.md and 1 other file (references) in skills/umodel-rca of alibaba/UnifiedModel.

  • SKILL.md
  • references/evidence-patterns.md

Open the folder on GitHubat commit 1b54ddc

Compare with similar skills

UModel Root Cause Analysis next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

UModel Root Cause Analysis compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
UModel Root Cause Analysis this skillalibaba/UnifiedModel415—~1.9kAutomated safety check: PassCustom licence
Archestra Dev Observabilityarchestra-ai/archestra4.4k—~1.2kAutomated safety check: PassCustom licence
Frontmcp Observabilityagentfront/frontmcp146—~4.6kAutomated safety check: PassApache-2.0
Kubernetes Network Root Cause Analysiskubeshark/kubeshark12k—~5.3kAutomated safety check: PassApache-2.0
Agentmeasureroy-tong/AgentMeasure219—~753Automated safety check: PassMIT
Axiom SRE Investigatoropenclaw/clawhub9.5k—~7.1kAutomated safety check: PassMIT

Similar skills

  • Archestra Dev Observability

    archestra-ai/archestra

    A skill your agent uses when changing Archestra tracing, metrics, OpenTelemetry, Tempo, Grafana, Prometheus, LLM/MCP spans, observability labels, or local observability setup.

    4.4k GitHub stars~1.2k tokensUpdated today
    DevOps & CloudAuto-check passed
  • Frontmcp Observability

    agentfront/frontmcp

    A skill your agent uses when adding tracing, structured logging, metrics, or monitoring to a FrontMCP server.

    146 GitHub stars~4.6k tokensUpdated today
    DevOps & CloudAuto-check passed
  • Investigates past Kubernetes incidents from Kubeshark traffic snapshots: takes captures, dissects API calls, extracts PCAPs and compares traffic over time.

    12k GitHub stars~5.3k tokensUpdated today
    DevOps & CloudAuto-check passed
  • Agentmeasure

    roy-tong/AgentMeasure

    Check whether agent telemetry preserves measurement semantics.

    219 GitHub stars~753 tokensUpdated today
    DevOps & CloudAuto-check passed
  • Axiom SRE Investigator

    openclaw/clawhub

    Investigates incidents and production problems with hypothesis-driven debugging, queries Axiom observability data when available, and keeps secrets out of commands and output.

    9.5k GitHub stars~7.1k tokensUpdated today
    DevOps & CloudAuto-check passed
  • Exploring Apm Traces

    PostHog/posthog

    Official

    Investigates distributed application performance using PostHog APM (OpenTelemetry span) data via MCP.

    40k GitHub stars~3.5k tokensUpdated today
    DevOps & CloudAuto-check passed

More from alibaba/UnifiedModel

  • UModel Skill Runner

    alibaba/UnifiedModel

    Loads one entity-linked Skill through UModel, follows its inline SKILL.md and applies attached knowledge items under their apply policies.

    415 GitHub stars~1k tokensUpdated 16 days ago
    Auto-check passed

Categories

Questions about UModel Root Cause Analysis

What does UModel Root Cause Analysis do?

Investigates a service incident to its root cause by querying a UModel object graph alongside metrics, logs, topology and recent deployments. This skill treats root-cause investigation as a method rather than a fixed script: it lets evidence decide the next query, keeps competing hypotheses alive, and requires every conclusion to cite an object-graph, metric, or log source. It runs on top of a companion query skill, which provides the actual read surfaces - entity lookups, topology, UModel queries, and metric or log calls scoped to a set of entities - reached through the umctl CLI pointed at a UModel server and workspace.

When should I use UModel Root Cause Analysis?

UModel Root Cause Analysis fits situations like: investigating why a service is suddenly slow or erroring; finding the root cause of an SLO breach or outage; ruling out an unrelated recent deployment during an incident.

How do I install UModel Root Cause Analysis in Claude Code?

Run `npx skills add alibaba/UnifiedModel --skill umodel-rca -a claude-code`. Or copy the skill folder (skills/umodel-rca in alibaba/UnifiedModel) into .claude/skills/umodel-rca in your project. Claude Code loads it when a task matches its description.

How do I install UModel Root Cause Analysis in Codex?

Run `npx skills add alibaba/UnifiedModel --skill umodel-rca -a codex`. Or copy the skill folder (skills/umodel-rca in alibaba/UnifiedModel) into .agents/skills/umodel-rca in your project. Codex loads it when a task matches its description.

Can I use UModel Root Cause Analysis in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add alibaba/UnifiedModel --skill umodel-rca -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/umodel-rca, .gemini/skills/umodel-rca, .github/skills/umodel-rca and .opencode/skills/umodel-rca in your project.

What does UModel Root Cause Analysis need to run?

Going by SKILL.md and its folder, UModel Root Cause Analysis needs the command-line tools its instructions call (go, sh and make). Our summary lists: umctl CLI; A running UModel server; Go 1.22+ (to build umctl from source).

Does UModel Root Cause Analysis access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is UModel Root Cause Analysis safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does UModel Root Cause Analysis use?

UModel Root Cause Analysis has a licence file (the repository's licence) that doesn't match a standard licence. Read it on GitHub before reusing the skill.

How many tokens does UModel Root Cause Analysis use?

About 1.9k tokens (SKILL.md is roughly 7.7k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 861 tokens, read only when the agent opens those files.

What are the alternatives to UModel Root Cause Analysis?

Skills that share tags, products or a category with UModel Root Cause Analysis: Archestra Dev Observability (archestra-ai/archestra, 4.4k stars), Frontmcp Observability (agentfront/frontmcp, 146 stars), Kubernetes Network Root Cause Analysis (kubeshark/kubeshark, 12k stars) and Agentmeasure (roy-tong/AgentMeasure, 219 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains UModel Root Cause Analysis?

alibaba (a GitHub organization) maintains it in alibaba/UnifiedModel, which has 415 GitHub stars. The repository holds 2 skills in this directory. The repository was last updated on September 23, 2026.

Source: alibaba/UnifiedModel on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.