Agent skill

Cx Cases

by coralogix in coralogix/cx-cli

Triage and manage Coralogix Cases with the cx cases CLI — e.g.

Apache-2.0Auto-check passedDevOps & Cloud

Install Cx Cases

skills CLI
$ npx skills add coralogix/cx-cli --skill cx-cases -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install coralogix/cx-cli cx-cases --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/coralogix/cx-cli.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/cx-cases .claude/skills/cx-cases && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
cx-cases
GitHub stars
121
Token cost
~1.5k tokens
SKILL.md length
645 words
Files
3 (incl. references)
Skills in repo
21
Repo updated
First seen
Licence
Apache-2.0

At a glance

Triage and manage Coralogix Cases with the cx cases CLI — e.g.

  • Works in 6 steps: Inspect — cx cases get . The payload… → Investigate — Pull the underlying… → Claim — cx cases assign --user… → …
  • DevOps & Cloud work in your project
  • SKILL.md covers CLI Commands, Case Lifecycle, Triage Workflow and Bulk Operations, plus 3 more sections
  • Calls jq

What it does

Cx Cases is an agent skill from coralogix/cx-cli. Triage and manage Coralogix Cases with the cx cases CLI — e.g. acknowledge, assign, resolve, or re-prioritize a case, or inspect its event timeline or notification deliveries.

Its SKILL.md is about 1.5k tokens, which your agent loads only when the skill is triggered. The skill folder holds 3 other files, including reference files (for example `references/case-analytics.md` and `references/single-case.md`).

It sits in DevOps & Cloud. The repository describes itself as: This is the Coralogix CLI. The licence is Apache-2.0.

When your agent uses it

  • DevOps & Cloud work in your project

Example prompts

  • “/cx-cases”

Workflow steps

6 steps, taken from the first numbered list in SKILL.md.

  1. Inspect — cx cases get . The payload includes groupings,
  2. Investigate — Pull the underlying telemetry by querying the alert's DataPrime / PromQL to find root cause before acting.
  3. Claim — cx cases assign --user you@example.com then
  4. Record findings — cx cases comment --text "" to leave
  5. Resolve or close — see below.
  6. Re-prioritize if impact differs from the computed value —

What it can do on your machine

Read from SKILL.md and the folder at commit c071372. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • jq

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Cx Cases loads about 1.5k tokens when it runs, and up to ~9.5k if it reads all its reference files. Until then it costs about 47 tokens; SKILL.md has 645 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~47
When it runs · the whole SKILL.md, loaded when a task matches
~1.5k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~9.5k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from coralogix/cx-cli at commit c071372, republished under its Apache-2.0 licence (© coralogix). 645 words, ~1,461 tokens.

Download SKILL.mdSave it as .claude/skills/cx-cases/SKILL.md (or your agent's skills folder). This skill also uses 2 other files; get the full folder from GitHub.
name
cx-cases
description
Triage and manage Coralogix Cases with the `cx cases` CLI — e.g. acknowledge, assign, resolve, or re-prioritize a case, or inspect its event timeline or notification deliveries.
metadata.version
0.1.0

Cases Management Skill

A Case groups related alert events into one investigation unit with a status, priority, category, and assignee. Use this skill to inspect cases and drive them through their lifecycle (active → acknowledged → resolved → closed).

CLI Commands

CommandPurpose
cx cases get <id>Get a single case by ID
cx cases update <id> [--title] [--resolution-reason]Update mutable fields
cx cases comment <id> --text <text>Add a comment to the case timeline
cx cases assign <id> --user <email>Assign a case (email, or raw user ID)
cx cases unassign <id>Remove the assignee
cx cases acknowledge <id>Acknowledge (signals you're working it; stops re-notification)
cx cases unacknowledge <id>Remove the acknowledgment
cx cases resolve <id> --reason <text>Resolve a case (irreversible — see below)
cx cases close <id>Close a case (terminal)
cx cases set-priority <id> --priority <P1..P5>Override the computed priority
cx cases clear-priority <id>Remove a priority override
cx cases events list <case-id>Event timeline (status changes, comments, assignments)
cx cases events get <event-id>A single event — drill in, e.g. to expand a comment thread
cx cases notifications <case-id> [<case-id> ...]Notification deliveries (connector, status, time)

Case Lifecycle

PENDING_ACTIVATION ──► ACTIVE ◄────────► ACKNOWLEDGED
                         │ ╲                │ ╲
                         │  ╲               │  ╲
                         ▼   ╲              ▼   ╲
                      CLOSED  ╲──► RESOLVED ◄─── (from ACK)
                                       │
                                       ▼
                                    CLOSED  (terminal)
From stateAllowed transitionsNotes
PENDING_ACTIVATION→ ACTIVESystem-driven activation; not user-controllable
ACTIVE→ ACKNOWLEDGED, RESOLVED, CLOSEDAck is optional; for a false alarm, close directly (skip resolve)
ACKNOWLEDGED→ ACTIVE, RESOLVED, CLOSEDThe only "back" transition: unacknowledge returns it to ACTIVE
RESOLVED→ CLOSED onlyIrreversible — cannot reopen to ACTIVE/ACKNOWLEDGED
CLOSED(none)Terminal

Categories: AVAILABILITY or SECURITY. Priorities: P1 (highest) → P5.

Triage Workflow

  1. Inspect — cx cases get <id>. The payload includes groupings, labels, impactedEntities, kpiBreaches, aiSummary, and both priorityDetails.system (computed) and priorityDetails.override (user-set).
  2. Investigate — Pull the underlying telemetry by querying the alert's DataPrime / PromQL to find root cause before acting. Optionally export the investigation via cx olly or pull the case's impactedEntities / groupings to confirm the impact. See the cx-telemetry-querying skill.
  3. Claim — cx cases assign <id> --user you@example.com then cx cases acknowledge <id>.
  4. Record findings — cx cases comment <id> --text "<note>" to leave investigation notes on the timeline (root cause, links, next steps) as you go. Comments appear as comment events in cx cases events list.
  5. Resolve or close — see below.
  6. Re-prioritize if impact differs from the computed value — cx cases set-priority <id> --priority P1 / clear-priority. Only possible while the case is still open; priority cannot be overridden once a case is RESOLVED or CLOSED.
Show full SKILL.md (249 more words)Show less
Resolving

Resolution is irreversible (a RESOLVED case can only move to CLOSED), so the CLI requires both a reason and a confirmation:

  • Pass --reason "<text>" — a one-line postmortem (root cause, what fixed it, follow-up) visible to teammates in the timeline. Use --no-reason only when a reason genuinely doesn't apply.
  • In agent / non-interactive mode, also pass --yes; without it the command refuses and must be handed to the user to run interactively.

If uncertain, stay in ACKNOWLEDGED (reversible via unacknowledge) until confident. For non-resolution edits (title, post-hoc postmortem link), use cx cases update.

Bulk Operations

There are no bulk endpoints. To act on many cases, pipe IDs through a loop, e.g. ... | jq -r '.[].id' | xargs -I {} cx cases acknowledge {}.

Key Principles

  • Use emails, never user IDs — for assign --user and in all output.
  • resolve is irreversible and close is terminal — confirm before resolving; for false alarms close from ACTIVE directly.
  • Always supply a resolution reason unless --no-reason truly applies.
  • P1-style shorthand is accepted anywhere a priority/status/category is expected.
  • Multi-profile fan-out with -p <profile> (repeatable) for cross-environment triage.
  • Link to a specific case — build <base>/cases?id=<case_id>, where <base> is the console URL already seen in a `View in Coralogix:
    <base>/...` line printed by any `cx cases` command this session — never
    fabricate `<base>` yourself.

References

  • cx-alerts — the alert definitions behind the events grouped into a case.
  • cx-slos — the SLO definitions whose breaches drive reliability cases.
  • cx-telemetry-querying — pivot from a case's impacted entities into logs/spans/metrics.

© coralogix, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 2 other files (references) in skills/cx-cases of coralogix/cx-cli.

  • SKILL.md
  • references/case-analytics.md
  • references/single-case.md

Open the folder on GitHubat commit c071372

Compare with similar skills

Cx Cases next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Cx Cases compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Cx Cases this skillcoralogix/cx-cli121—~1.5kAutomated safety check: PassApache-2.0
Monitor CInrwl/nx29k6 repos~4.7kAutomated safety check: PassMIT
Terraform and OpenTofu Guideagentscope-ai/QwenPaw36k6 repos~4.2kAutomated safety check: PassApache-2.0
Vercel Optimize Auditvercel-labs/agent-skills32k8 repos~4.3kAutomated safety check: PassNone
Analyze GitHub Action Logswithastro/astro63k1 repos~1.3kAutomated safety check: PassCustom licence
Openclaw Live Updateropenclaw/openclaw392k—~3.7kAutomated safety check: PassMIT

Similar skills

  • Monitor CI

    nrwl/nx

    Monitor Nx Cloud CI pipeline and handle self-healing fixes. An agent skill from nrwl/nx.

    29k GitHub starsUsed in 6 repos~4.7k tokens
    DevOps & CloudAuto-check passed
  • Terraform and OpenTofu Guide

    agentscope-ai/QwenPaw

    Guidance for writing and testing Terraform and OpenTofu code: module structure, naming, test approaches, CI/CD workflows, state handling and security scanning.

    36k GitHub starsUsed in 6 repos~4.2k tokens
    DevOps & CloudAuto-check passed
  • Vercel Optimize Audit

    vercel-labs/agent-skills

    Official

    Runs a metrics-first audit of a deployed Vercel project, gating investigations on real signals to produce ranked, citation-backed cost and performance recommendations.

    32k GitHub starsUsed in 8 repos~4.3k tokens
    DevOps & CloudAuto-check passed
  • Official

    Analyze recent GitHub Actions workflow runs to identify patterns, mistakes, and improvements.

    63k GitHub starsUsed in 1 repo~1.3k tokens
    DevOps & CloudAuto-check passed
  • Openclaw Live Updater

    openclaw/openclaw

    Maintain the canonical live OpenClaw main checkout, macOS LaunchAgent-managed Gateway, local macOS app, exact-head main CI, and recurring full release validation.

    392k GitHub stars~3.7k tokensUpdated today
    DevOps & CloudAuto-check passed
  • Docs Learn PR Preview

    netdata/netdata

    Use only when the user explicitly asks to build, run, preview, inspect, or validate learn.netdata.cloud locally using the contents of a PR or documentation branch before merge.

    81k GitHub stars~2k tokensUpdated yesterday
    DevOps & CloudAuto-check passed

More from coralogix/cx-cli

All 21 skills in this repo
  • Cx AI Center

    coralogix/cx-cli

    A skill your agent uses for any question or action about the user's AI/GenAI applications or agents — their behavior, prompts/responses, quality, hallucinations, guardrails, security, cost/tokens…

    121 GitHub stars~2.5k tokensUpdated 3 days ago
    Auto-check passed
  • Cx Alerts

    coralogix/cx-cli

    This skill should be used when the user asks to "manage alerts", "create alert", "list alerts", "delete alert", "check alert status", "enable alert", "disable alert", "investigate firing alerts"…

    121 GitHub stars~2.5k tokensUpdated 3 days ago
    Auto-check passed
  • Cx Coding Agents

    coralogix/cx-cli

    A skill your agent uses when the user asks about AI Center Coding Agents data, wants to reproduce or extend the Coding Agents dashboards, or asks questions about usage, cost, tokens, sessions…

    121 GitHub stars~1.8k tokensUpdated 3 days ago
    Auto-check passed
  • Cx Cost Optimization

    coralogix/cx-cli

    A skill your agent uses when the user asks to "check data usage", "list TCO policies", "reduce Coralogix costs", "optimize observability spend", "lower our logging bill", "data budget exceeded"…

    121 GitHub stars~3.4k tokensUpdated 3 days ago
    Auto-check passed
  • Cx Data Pipeline

    coralogix/cx-cli

    A skill your agent uses when the user asks to "set up parsing", "create parsing rule", "extract fields from logs", "regex extraction", "log parsing", "enrich logs", "add context to logs", "custom…

    121 GitHub stars~3k tokensUpdated 3 days ago
    Auto-check passed
  • Cx Telemetry Querying

    coralogix/cx-cli

    A skill your agent uses for any question involving telemetry data: "investigate an issue", "debug a problem", "find out why something is slow", "check error rates", "analyze user behavior"…

    121 GitHub stars~2.6k tokensUpdated 3 days ago
    Auto-check passed

Categories

Questions about Cx Cases

What does Cx Cases do?

Triage and manage Coralogix Cases with the cx cases CLI — e.g. Cx Cases is an agent skill from coralogix/cx-cli.g.

When should I use Cx Cases?

Cx Cases fits situations like: devOps & Cloud work in your project.

How do I install Cx Cases in Claude Code?

Run `npx skills add coralogix/cx-cli --skill cx-cases -a claude-code`. Or copy the skill folder (skills/cx-cases in coralogix/cx-cli) into .claude/skills/cx-cases in your project. Claude Code loads it when a task matches its description.

How do I install Cx Cases in Codex?

Run `npx skills add coralogix/cx-cli --skill cx-cases -a codex`. Or copy the skill folder (skills/cx-cases in coralogix/cx-cli) into .agents/skills/cx-cases in your project. Codex loads it when a task matches its description.

Can I use Cx Cases in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add coralogix/cx-cli --skill cx-cases -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/cx-cases, .gemini/skills/cx-cases, .github/skills/cx-cases and .opencode/skills/cx-cases in your project.

What does Cx Cases need to run?

Going by SKILL.md and its folder, Cx Cases needs the command-line tools its instructions call (jq).

Does Cx Cases access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Cx Cases safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Cx Cases use?

Cx Cases is published under the Apache-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Cx Cases use?

About 1.5k tokens (SKILL.md is roughly 5.8k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 8.1k tokens, read only when the agent opens those files.

What are the alternatives to Cx Cases?

Skills that share tags, products or a category with Cx Cases: Monitor CI (nrwl/nx, 29k stars), Terraform and OpenTofu Guide (agentscope-ai/QwenPaw, 36k stars), Vercel Optimize Audit (vercel-labs/agent-skills, 32k stars) and Analyze GitHub Action Logs (withastro/astro, 63k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Cx Cases?

coralogix (a GitHub organization) maintains it in coralogix/cx-cli, which has 121 GitHub stars. The repository holds 21 skills in this directory. The repository was last updated on October 7, 2026.

Source: coralogix/cx-cli on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.