Agent skill

Ramp Incident Runbook

by jeremylongshore in jeremylongshore/tons-of-skills-marketplace

Analyze, contain, reconcile, and recover a Ramp integration incident involving authentication, webhooks, sync workers, financial writes, or card workflows.

MITAuto-check passedDevOps & Cloud

Install Ramp Incident Runbook

skills CLI
$ npx skills add jeremylongshore/tons-of-skills-marketplace --skill ramp-incident-runbook -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install jeremylongshore/tons-of-skills-marketplace ramp-incident-runbook --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/jeremylongshore/tons-of-skills-marketplace.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/.curated/ramp-incident-runbook .claude/skills/ramp-incident-runbook && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
ramp-incident-runbook
GitHub stars
2.8k
Token cost
~1.3k tokens
SKILL.md length
550 words
Files
2 (incl. references)
Skills in repo
3,342
Repo updated
First seen
Licence
MIT

At a glance

Analyze, contain, reconcile, and recover a Ramp integration incident involving authentication, webhooks, sync workers, financial writes, or card workflows.

  • Works in 5 steps: Declare severity and owners; freeze… → Bound impact by environment, entity,… → Classify vendor, auth, permission,… → …
  • Responding to an active production degradation
  • SKILL.md covers Overview, Prerequisites, Current Contract and Instructions, plus 7 more sections
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Ramp Incident Runbook is an agent skill from jeremylongshore/tons-of-skills-marketplace. Analyze, contain, reconcile, and recover a Ramp integration incident involving authentication, webhooks, sync workers, financial writes, or card workflows. Use when responding to an active production degradation. Trigger with "Ramp incident" or "Ramp sync outage".

Its SKILL.md is about 1.3k tokens, which your agent loads only when the skill is triggered. The skill folder holds 2 other files, including reference files (for example `references/official-docs.md`). Compatibility notes: Requires current Ramp Developer API documentation and approved access for any live financial, card, identity, accounting, application, or configuration change

It sits in DevOps & Cloud, covering Runbooks and postmortems, Webhooks and Incident response. The repository describes itself as: Model-agnostic agent-skills platform with a harness-free canonical layer, verified adapters, and the ccpi package manager. Explore at tonsofskills.com. The licence is MIT.

When your agent uses it

  • Responding to an active production degradation
  • With Ramp incident
  • Ramp sync outage

Example prompts

  • “Ramp incident”
  • “Ramp sync outage”
  • “/ramp-incident-runbook”

Requirements

  • Compatibility (from SKILL.md): Requires current Ramp Developer API documentation and approved access for any live financial, card, identity, accounting, application, or configuration change
  • Pre-approved tools (allowed-tools): Read, Glob, Grep, Write, Edit

Workflow steps

5 steps, taken from the first numbered list in SKILL.md.

  1. Declare severity and owners; freeze deploys, credential changes, cursor advancement, and affected writes while leaving safe reads and…
  2. Bound impact by environment, entity, endpoint/event, release, time window, object IDs, amounts, queue depth, webhook lag, and downstream…
  3. Classify vendor, auth, permission, schema, rate, timeout, data, or deployment cause using sanitized trace IDs and exact artifact/config…
  4. Contain by disabling only the unsafe writer or subscription path; reconcile ambiguous writes and deferred tasks before retries.
  5. Recover a bounded cohort with original idempotency keys, compare source and destination totals, then expand gradually and complete…

What it can do on your machine

Read from SKILL.md and the folder at commit cfae287. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves these tools, so the agent can use them without asking each time:

    • Read
    • Glob
    • Grep
    • Write
    • Edit

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

  • Compatibility

    Requires current Ramp Developer API documentation and approved access for any live financial, card, identity, accounting, application, or configuration change

    From compatibility in the SKILL.md frontmatter.

Context cost

Ramp Incident Runbook loads about 1.3k tokens when it runs, and up to ~1.5k if it reads all its reference files. Until then it costs about 72 tokens; SKILL.md has 550 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~72
When it runs · the whole SKILL.md, loaded when a task matches
~1.3k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~1.5k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from jeremylongshore/tons-of-skills-marketplace at commit cfae287, republished under its MIT licence (© jeremylongshore). 550 words, ~1,259 tokens.

Download SKILL.mdSave it as .claude/skills/ramp-incident-runbook/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.
name
ramp-incident-runbook
description
Analyze, contain, reconcile, and recover a Ramp integration incident involving authentication, webhooks, sync workers, financial writes, or card workflows. Use when responding to an active production degradation. Trigger with "Ramp incident" or "Ramp sync outage".
allowed-tools
Read, Glob, Grep, Write, Edit
compatibility
Requires current Ramp Developer API documentation and approved access for any live financial, card, identity, accounting, application, or configuration change
version
2.0.0
argument-hint
[integration-or-environment]
model
inherit
effort
high
author
Jeremy Longshore <jeremy@intentsolutions.io>
license
MIT
tags
saas, ramp, incident-response, reliability, reconciliation

Ramp Integration Incident Runbook

Overview

Protect financial correctness before throughput. Stop unsafe writes, preserve cursors and idempotency state, determine the blast radius by entity and object, and recover through controlled reconciliation.

Prerequisites

  • Identify the Ramp application, environment, business entities, affected data and workflows, accountable owner, and rollback boundary.
  • Read references/official-docs.md and re-check endpoint schemas, scopes, limits, and support status before a live operation.
  • Use synthetic fixtures or Ramp sandbox until production access and business effects are explicitly approved.
  • Prepare approved secret storage and a sanitized evidence location.

Current Contract

  • Ramp errors expose status, structured error information, and x-trace-id for correlation.
  • Webhook delivery and polling can overlap, so recovery must be idempotent and reconcile objects rather than replay blindly.
  • 429 and 5xx may be transient; 504 crosses Ramp's 60-second request timeout and leaves write outcomes potentially ambiguous.
  • Accounting success is not complete until the downstream ERP receipt and Ramp sync receipt agree.

Instructions

  1. Declare severity and owners; freeze deploys, credential changes, cursor advancement, and affected writes while leaving safe reads and evidence capture available.

  2. Bound impact by environment, entity, endpoint/event, release, time window, object IDs, amounts, queue depth, webhook lag, and downstream system.

  3. Classify vendor, auth, permission, schema, rate, timeout, data, or deployment cause using sanitized trace IDs and exact artifact/config changes.

  4. Contain by disabling only the unsafe writer or subscription path; reconcile ambiguous writes and deferred tasks before retries.

  5. Recover a bounded cohort with original idempotency keys, compare source and destination totals, then expand gradually and complete post-incident credential/evidence cleanup.

Tool Discipline

  • Use Glob to locate candidate code, manifests, fixtures, and evidence without widening scope.
  • Use Grep to find relevant endpoints, fields, permissions, identifiers, errors, and stale assumptions.
  • Use Read to inspect the smallest required local files and authoritative evidence.
  • Use Write only for a new approved local draft, test, configuration, or evidence artifact.
  • Use Edit only for a bounded approved change with a known rollback.
  • Local file tools do not authorize a Ramp operation or replace owner approval.
Show full SKILL.md (216 more words)Show less

Approval Boundaries

The incident commander controls containment and recovery. Finance approves financial replay or reversal; security controls credential action; data owners approve production evidence handling.

Output

A timestamped incident record, blast-radius ledger, containment state, trace IDs, object reconciliation, replay/reversal decisions, recovery gates, and follow-up owners.

Error Handling

ConditionResponse
Pressure rises to replay the whole queueKeep the freeze and reconcile a bounded window first; throughput does not override duplicate-risk controls.
A token may be compromisedRevoke or rotate through security, inventory affected clients, and prove old credentials fail.
Ramp and ERP totals disagreeQuarantine the cohort and resolve per-object references before resuming sync marking.

Examples

Example 1

Contain a webhook consumer that duplicated ERP posts, reconcile by Ramp transaction ID, reverse duplicates, and replay one canary window.

Example 2

Handle widespread 429s by pausing workers, preserving checkpoints, lowering concurrency, and proving complete catch-up.

Validation

  • Unsafe writes are stopped without destroying queues, cursors, or idempotency evidence.
  • Blast radius is quantified by object and amount, not only request count.
  • Recovery proves no loss or duplicate financial effect.
  • Timeline, decisions, approvals, trace IDs, and corrective actions are durable.

Resources

  • Official documentation and contract notes
  • Re-check the dated contract and current OpenAPI schema before any live request.
  • Treat unresolved vendor behavior, authority, or financial state as a stop condition.

© jeremylongshore, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 1 other file (references) in skills/.curated/ramp-incident-runbook of jeremylongshore/tons-of-skills-marketplace.

  • SKILL.md
  • references/official-docs.md

Open the folder on GitHubat commit cfae287

Compare with similar skills

Ramp Incident Runbook next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Ramp Incident Runbook compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Ramp Incident Runbook this skilljeremylongshore/tons-of-skills-marketplace2.8k—~1.3kAutomated safety check: PassMIT
Oncallpigweed-project/pigweed548—~963Automated safety check: PassApache-2.0
Activation Governance Chaos RolloutAli-Marandi/DataSense107—~1.9kAutomated safety check: PassMIT
Incident Response686f6c61/alfred-dev117—~1.1kAutomated safety check: PassMIT
Superset Incident Triagesuperset-sh/superset15k—~1kAutomated safety check: PassCustom licence
Post-Incident DebriefVeryGoodOpenSource/vgv-wingspan109—~1.9kAutomated safety check: PassMIT

Similar skills

  • Oncall

    pigweed-project/pigweed

    Pigweed oncall rotation runbooks and maintenance workflows (such as rolling CIPD client tools for b/315378787).

    548 GitHub stars~963 tokensUpdated today
    DevOps & CloudAuto-check passed
  • Design, validate, and govern fail-closed customer-activation automations that use an Outbox/worker pattern.

    107 GitHub stars~1.9k tokensUpdated 1 mo ago
    DevOps & CloudAuto-check passed
  • Incident Response

    686f6c61/alfred-dev

    Protocolo de respuesta ante incidentes en produccion: triaje, mitigacion, causa raiz y postmortem.

    117 GitHub stars~1.1k tokensUpdated 1 mo ago
    DevOps & CloudAuto-check passed
  • Superset Incident Triage

    superset-sh/superset

    Does a read-only first pass on a possible production incident: gathers deploy, Sentry and health-check signals, proposes a severity and status message, then stops for human approval.

    15k GitHub stars~1k tokensUpdated today
    DevOps & CloudAuto-check passed
  • Post-Incident Debrief

    VeryGoodOpenSource/vgv-wingspan

    Produces a blameless post-incident debrief with timeline, root cause and follow-up actions after an outage, failed release or significant bug, while details are fresh.

    109 GitHub stars~1.9k tokensUpdated 4 days ago
    DevOps & CloudAuto-check passed
  • SRE Engineer

    Jeffallan/claude-skills

    Defines SLIs, SLOs and error budgets, and sets up golden-signal monitoring, blameless postmortems, toil automation and chaos experiments for production systems.

    12k GitHub stars~1.7k tokensUpdated 7 days ago
    DevOps & CloudAuto-check passed

More from jeremylongshore/tons-of-skills-marketplace

All 3,342 skills in this repo
  • Performing Security Code Review

    jeremylongshore/tons-of-skills-marketplace

    Execute this skill enables AI assistant to conduct a security-focused code review using the security-agent plugin.

    2.8k GitHub starsUsed in 2 repos~1.3k tokens
    Auto-check: notes
  • Adapting Transfer Learning Models

    jeremylongshore/tons-of-skills-marketplace

    Build this skill automates the adaptation of pre-trained machine learning models using transfer learning techniques.

    2.8k GitHub stars~1.1k tokensUpdated today
    Auto-check passed
  • Agent Context Loader

    jeremylongshore/tons-of-skills-marketplace

    Execute proactive auto-loading: automatically detects and loads agents.md files.

    2.8k GitHub stars~1.1k tokensUpdated today
    Auto-check passed
  • Aggregating Performance Metrics

    jeremylongshore/tons-of-skills-marketplace

    Aggregate and centralize performance metrics from applications, systems, databases, caches, and services.

    2.8k GitHub stars~1.2k tokensUpdated today
    Auto-check passed
  • Analyzing Capacity Planning

    jeremylongshore/tons-of-skills-marketplace

    Execute this skill enables AI assistant to analyze capacity requirements and plan for future growth.

    2.8k GitHub stars~947 tokensUpdated today
    Auto-check passed
  • Analyzing Database Indexes

    jeremylongshore/tons-of-skills-marketplace

    Process use when you need to work with database indexing. An agent skill from jeremylongshore/tons-of-skills-marketplace.

    2.8k GitHub stars~2k tokensUpdated today
    Auto-check passed

Questions about Ramp Incident Runbook

What does Ramp Incident Runbook do?

Analyze, contain, reconcile, and recover a Ramp integration incident involving authentication, webhooks, sync workers, financial writes, or card workflows. Ramp Incident Runbook is an agent skill from jeremylongshore/tons-of-skills-marketplace. Analyze, contain, reconcile, and recover a Ramp integration incident involving authentication, webhooks, sync workers, financial writes, or card workflows.

When should I use Ramp Incident Runbook?

Ramp Incident Runbook fits situations like: responding to an active production degradation; with Ramp incident; ramp sync outage.

How do I install Ramp Incident Runbook in Claude Code?

Run `npx skills add jeremylongshore/tons-of-skills-marketplace --skill ramp-incident-runbook -a claude-code`. Or copy the skill folder (skills/.curated/ramp-incident-runbook in jeremylongshore/tons-of-skills-marketplace) into .claude/skills/ramp-incident-runbook in your project. Claude Code loads it when a task matches its description.

How do I install Ramp Incident Runbook in Codex?

Run `npx skills add jeremylongshore/tons-of-skills-marketplace --skill ramp-incident-runbook -a codex`. Or copy the skill folder (skills/.curated/ramp-incident-runbook in jeremylongshore/tons-of-skills-marketplace) into .agents/skills/ramp-incident-runbook in your project. Codex loads it when a task matches its description.

Can I use Ramp Incident Runbook in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add jeremylongshore/tons-of-skills-marketplace --skill ramp-incident-runbook -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/ramp-incident-runbook, .gemini/skills/ramp-incident-runbook, .github/skills/ramp-incident-runbook and .opencode/skills/ramp-incident-runbook in your project.

What does Ramp Incident Runbook need to run?

SKILL.md names no scripts, command-line tools or credentials: Ramp Incident Runbook is instructions for the agent only. Its frontmatter pre-approves these tools: Read, Glob, Grep, Write, Edit. Compatibility (from SKILL.md): Requires current Ramp Developer API documentation and approved access for any live financial, card, identity, accounting, application, or configuration change.

Does Ramp Incident Runbook access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Ramp Incident Runbook safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Ramp Incident Runbook use?

Ramp Incident Runbook is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Ramp Incident Runbook use?

About 1.3k tokens (SKILL.md is roughly 5k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 202 tokens, read only when the agent opens those files.

What are the alternatives to Ramp Incident Runbook?

Skills that share tags, products or a category with Ramp Incident Runbook: Oncall (pigweed-project/pigweed, 548 stars), Activation Governance Chaos Rollout (Ali-Marandi/DataSense, 107 stars), Incident Response (686f6c61/alfred-dev, 117 stars) and Superset Incident Triage (superset-sh/superset, 15k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Ramp Incident Runbook?

jeremylongshore (a GitHub user) maintains it in jeremylongshore/tons-of-skills-marketplace, which has 2,827 GitHub stars. The repository holds 3,342 skills in this directory. The repository was last updated on October 10, 2026.

Source: jeremylongshore/tons-of-skills-marketplace on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.