Kubernetes alert triage — dedup via YT search, deep control plane investigation, auto-escalation for recurring/flapping/control-plane alerts.

No licenceAuto-check: notesDevOps & Cloud

Install K8s Triage

skills CLI
$ npx skills add papadopouloskyriakos/agentic-chatops --skill k8s-triage -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install papadopouloskyriakos/agentic-chatops k8s-triage --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/papadopouloskyriakos/agentic-chatops.git skills-src && mkdir -p .claude/skills && cp -r skills-src/openclaw/skills/k8s-triage .claude/skills/k8s-triage && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
k8s-triage
GitHub stars
107
Token cost
~801 tokens
SKILL.md length
337 words
Files
2
Skills in repo
17
Repo updated
First seen
Licence
None found

At a glance

Kubernetes alert triage — dedup via YT search, deep control plane investigation, auto-escalation for recurring/flapping/control-plane alerts.

  • Works in 3 steps: ALWAYS use the exec tool to run the… → Do NOT make changes. All investigation… → The script handles everything — YT…
  • Tasks that involve Container orchestration
  • SKILL.md covers Usage, Environment Variables, CRITICAL RULES and What's New (v2), plus 1 more section
  • Runs Shell scripts from its folder

What it does

K8s Triage is an agent skill from papadopouloskyriakos/agentic-chatops. Kubernetes alert triage — dedup via YT search, deep control plane investigation, auto-escalation for recurring/flapping/control-plane alerts.

Its SKILL.md is about 800 tokens, which your agent loads only when the skill is triggered. The skill folder holds 1 other file (for example `k8s-triage.sh`).

It sits in DevOps & Cloud, covering Container orchestration and Security operations. It works with Kubernetes and n8n. The repository describes itself as: 3-tier agentic ChatOps (n8n + GPT-4o + Claude Code) implementing all 21 patterns from "Agentic Design Patterns" — solo operator managing 137 devices.

When your agent uses it

  • Tasks that involve Container orchestration
  • Tasks that involve Security operations

Example prompts

  • “Use the k8s-triage skill to kubernete alert triage — dedup via YT search, deep control plane investigation, auto-escalation for…”
  • “/k8s-triage”

Requirements

  • A Bash shell
  • Pre-approved tools (allowed-tools): Bash

Workflow steps

3 steps, taken from the first numbered list in SKILL.md.

  1. ALWAYS use the exec tool to run the script. Do NOT describe what to do.
  2. Do NOT make changes. All investigation is READ-ONLY (kubectl get/describe/logs only).
  3. The script handles everything — YT dedup, issue creation, investigation, findings, escalation.

What it can do on your machine

Read from SKILL.md and the folder at commit 473f057. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves these tools, so the agent can use them without asking each time:

    • Bash

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Ships script files (Shell), which the agent can run.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

K8s Triage loads about 801 tokens when it runs. Until then it costs about 38 tokens; SKILL.md has 337 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~38
When it runs · the whole SKILL.md, loaded when a task matches
~801

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check: notes

The automated check noted patterns worth knowing about, such as sudo or a known installer.

  • NotePre-approves every shell command (allowed-tools: Bash)SKILL.md
    allowed-tools: Bash

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

Without a licence we can't republish the file, so here is its outline and opening line. It has 337 words (~801 tokens).

“When you see a message containing k8s-triage.sh in #infra-nl-prod or #infra-gr-prod, you MUST run it using the exec tool immediately. Do NOT ask questions.”

— opening of SKILL.md by papadopouloskyriakos
name
k8s-triage
allowed-tools
Bash
user-invocable
true

Read the full SKILL.md on GitHub

Files

SKILL.md and 1 other file in openclaw/skills/k8s-triage of papadopouloskyriakos/agentic-chatops.

  • SKILL.md
  • k8s-triage.sh

Open the folder on GitHubat commit 473f057

Compare with similar skills

K8s Triage next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

K8s Triage compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
K8s Triage this skillpapadopouloskyriakos/agentic-chatops107—~801Automated safety check: NotesNone
Detecting Container Escape Attemptsmukul975/Anthropic-Cybersecurity-Skills34k—~2.9kAutomated safety check: PassApache-2.0
Analyzing Kubernetes Audit Logsmukul975/Anthropic-Cybersecurity-Skills34k—~654Automated safety check: PassApache-2.0
Implementing Ebpf Security Monitoringmukul975/Anthropic-Cybersecurity-Skills34k—~2.4kAutomated safety check: NotesApache-2.0
Detecting Container Runtime Threats With Falcomukul975/Anthropic-Cybersecurity-Skills34k—~3kAutomated safety check: WarnApache-2.0
Kubeshark Installerkubeshark/kubeshark12k—~3.6kAutomated safety check: NotesApache-2.0

Similar skills

  • Detecting Container Escape Attempts

    mukul975/Anthropic-Cybersecurity-Skills

    Detects container escape at runtime across tooling - namespace manipulation, capability abuse, kernel exploits, sensitive host mounts, and anomalous syscalls - and explains which signals matter…

    34k GitHub stars~2.9k tokensUpdated 1 mo ago
    DevOps & CloudAuto-check passed
  • Analyzing Kubernetes Audit Logs

    mukul975/Anthropic-Cybersecurity-Skills

    Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymous API access, and builds SIEM detection rules…

    34k GitHub stars~654 tokensUpdated 1 mo ago
    DevOps & CloudAuto-check passed
  • Implementing Ebpf Security Monitoring

    mukul975/Anthropic-Cybersecurity-Skills

    Implements eBPF-based security monitoring using Cilium Tetragon for real-time process execution tracking, network connection observability, file access auditing, and runtime enforcement.

    34k GitHub stars~2.4k tokensUpdated 1 mo ago
    DevOps & CloudAuto-check: notes
  • Detecting Container Runtime Threats With Falco

    mukul975/Anthropic-Cybersecurity-Skills

    Deploys and operates Falco with the modern eBPF driver in Kubernetes and Docker, covering driver selection, Helm installation, output channels, and the built-in ruleset that detects container…

    34k GitHub stars~3k tokensUpdated 1 mo ago
    DevOps & CloudAuto-check: warnings
  • Kubeshark Installer

    kubeshark/kubeshark

    Installs and configures Kubeshark on a Kubernetes cluster, choosing between the quick CLI path and a Helm install with custom values.

    12k GitHub stars~3.6k tokensUpdated yesterday
    DevOps & CloudAuto-check: notes
  • Creates and queries KubeSphere users, workspaces and projects and assigns built-in roles, defaulting to least privilege and never deleting anything.

    17k GitHub stars~3.1k tokensUpdated 2 mo ago
    DevOps & CloudAuto-check passed

More from papadopouloskyriakos/agentic-chatops

All 17 skills in this repo
  • Escalate To Claude

    papadopouloskyriakos/agentic-chatops

    Escalate a YouTrack issue to Claude Code (Tier 2) for CODE IMPLEMENTATION ONLY.

    107 GitHub stars~672 tokensUpdated 4 days ago
    Auto-check: notes
  • Netbox Lookup

    papadopouloskyriakos/agentic-chatops

    Look up infrastructure devices, VMs, IPs, VLANs, and interfaces from NetBox CMDB.

    107 GitHub stars~618 tokensUpdated 4 days ago
    Auto-check: notes
  • Youtrack Lookup

    papadopouloskyriakos/agentic-chatops

    Look up YouTrack issues by ID or list open issues. An agent skill from papadopouloskyriakos/agentic-chatops.

    107 GitHub stars~550 tokensUpdated 4 days ago
    Auto-check: notes
  • Playbook Lookup

    papadopouloskyriakos/agentic-chatops

    Query past incident resolutions from the knowledge base. An agent skill from papadopouloskyriakos/agentic-chatops.

    107 GitHub stars~363 tokensUpdated 4 days ago
    Auto-check: notes
  • Bootstrap

    papadopouloskyriakos/agentic-chatops

    Meta-skill chaining /specify → /constitute → /plan → /tasks → spec-validation → dispatch-ready.

    107 GitHub stars~837 tokensUpdated 4 days ago
    Auto-check: notes
  • Cross Tier Review

    papadopouloskyriakos/agentic-chatops

    Cross-tier review protocol — chain of verification for REVIEW REQUEST messages from Claude Code (Tier 2).

    107 GitHub stars~691 tokensUpdated 4 days ago
    Auto-check: notes

Works with

Categories

Questions about K8s Triage

What does K8s Triage do?

Kubernetes alert triage — dedup via YT search, deep control plane investigation, auto-escalation for recurring/flapping/control-plane alerts. K8s Triage is an agent skill from papadopouloskyriakos/agentic-chatops. Kubernetes alert triage — dedup via YT search, deep control plane investigation, auto-escalation for recurring/flapping/control-plane alerts.

When should I use K8s Triage?

K8s Triage fits situations like: tasks that involve Container orchestration; tasks that involve Security operations.

How do I install K8s Triage in Claude Code?

Run `npx skills add papadopouloskyriakos/agentic-chatops --skill k8s-triage -a claude-code`. Or copy the skill folder (openclaw/skills/k8s-triage in papadopouloskyriakos/agentic-chatops) into .claude/skills/k8s-triage in your project. Claude Code loads it when a task matches its description.

How do I install K8s Triage in Codex?

Run `npx skills add papadopouloskyriakos/agentic-chatops --skill k8s-triage -a codex`. Or copy the skill folder (openclaw/skills/k8s-triage in papadopouloskyriakos/agentic-chatops) into .agents/skills/k8s-triage in your project. Codex loads it when a task matches its description.

Can I use K8s Triage in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add papadopouloskyriakos/agentic-chatops --skill k8s-triage -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/k8s-triage, .gemini/skills/k8s-triage, .github/skills/k8s-triage and .opencode/skills/k8s-triage in your project.

What does K8s Triage need to run?

Going by SKILL.md and its folder, K8s Triage needs a shell for the scripts in its folder. Our summary lists: A Bash shell. Its frontmatter pre-approves these tools: Bash.

Does K8s Triage access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is K8s Triage safe to install?

Our automated static check of SKILL.md found notes only (pre-approves every shell command (allowed-tools: bash)), nothing it rates as a warning. It is not a guarantee. Review the folder before installing.

What licence does K8s Triage use?

No licence was found for K8s Triage or its repository. Without one, default copyright applies: ask the author before reusing or redistributing it.

How many tokens does K8s Triage use?

About 801 tokens (SKILL.md is roughly 3.2k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to K8s Triage?

Skills that share tags, products or a category with K8s Triage: Detecting Container Escape Attempts (mukul975/Anthropic-Cybersecurity-Skills, 34k stars), Analyzing Kubernetes Audit Logs (mukul975/Anthropic-Cybersecurity-Skills, 34k stars), Implementing Ebpf Security Monitoring (mukul975/Anthropic-Cybersecurity-Skills, 34k stars) and Detecting Container Runtime Threats With Falco (mukul975/Anthropic-Cybersecurity-Skills, 34k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains K8s Triage?

papadopouloskyriakos (a GitHub user) maintains it in papadopouloskyriakos/agentic-chatops, which has 107 GitHub stars. The repository holds 17 skills in this directory. The repository was last updated on October 6, 2026.

Source: papadopouloskyriakos/agentic-chatops on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.