sw-sre_skill

Overview

This skill is an SRE expert for incident response, production troubleshooting, root cause analysis, post-mortems, and runbooks. It guides real-time outage handling and long-term reliability improvements. Use it to structure incident workflows, document findings, and produce clear mitigation steps.

How this skill works

The agent inspects incident telemetry, logs, alerts, and system architecture descriptions you provide to identify likely causes and remediation paths. It produces prioritized action lists, step-by-step runbooks, and a structured post-mortem covering timeline, impact, root cause, and corrective actions. For very large reports, it generates output incrementally by breaking the work into phases and asking which phase to produce next to avoid overload.

When to use it

• During SEV incidents and active outages to coordinate triage and mitigation
• When investigating performance regressions or repeated errors in production
• After an incident to create a post-mortem and assign preventive actions
• When drafting or validating runbooks for on-call responders
• For capacity planning or reliability risk assessments

Best practices

• Provide structured inputs: timeline, relevant logs, metrics, alert rules, and recent deploys
• Prioritize actions: focus first on user impact and service recovery, then on root cause elimination
• Use incremental generation for long reports: request one phase at a time (triage, RCA, mitigation, prevention, post-mortem)
• Include ownership and deadlines for corrective actions in post-mortems and runbooks
• Validate proposed runbook steps in a staging environment before applying to production

Example use cases

• Create an immediate triage checklist and play-by-play actions during a database outage
• Analyze spikes in error rates, propose quick mitigations, and outline a permanent fix
• Draft a complete post-mortem with timeline, impact assessment, root cause analysis, and action items
• Generate on-call runbooks for common failures with exact rollback and recovery commands
• Convert raw alert and log data into prioritized remediation steps and stakeholder communications