القائمة
Use when asked to write a runbook, document a procedure, or create an ops playbook for a service or alert. Produces a structured runbook with context, steps, rollback, and escalation.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Use when reviewing a backend HTTP / GraphQL handler for validation, authz, errors, performance, observability, and security, or "/backend-review". Produces a structured review with file:line citations.
Use when running a cloud security posture scan (CSPM) on AWS, Azure, or GCP using prowler, scout-suite, or checkov, or "/cloud-scan". Requires read-only credentials; produces CIS-benchmark-aligned findings with remediation.
Use when scanning a container image or Dockerfile for vulnerabilities, misconfigurations, and best-practice violations using trivy, dockle, or hadolint, or "/image-scan". Flags base-image CVEs, root user, missing healthchecks, and bloat.
Use when running an authorized non-intrusive DAST baseline scan (OWASP ZAP baseline, nuclei, nikto) against a web app or API endpoint you own, or "/dast". Requires explicit authorization; refuses unowned targets.
Use when handed a stack trace, error log, or "this is broken" with a paste of output, and asked to find the root cause across frontend, backend, or DB tiers, or "/debug-trace". Produces a hypothesis tree, the evidence supporting each branch, and the next diagnostic step.
Use when scanning a project's third-party dependencies for known CVEs across npm, pip, Go, Maven, Cargo, etc., or "/dep-scan". Runs trivy, npm audit, pip-audit, govulncheck, or osv-scanner and produces a prioritized fix list.
| name | draft-runbook |
| description | Use when asked to write a runbook, document a procedure, or create an ops playbook for a service or alert. Produces a structured runbook with context, steps, rollback, and escalation. |
Gather context. Ask for (or infer from available files):
Draft the runbook in this structure:
# Runbook: <Title>
**Service:** <name>
**Alert / Trigger:** <alert name or condition>
**Owner:** <team>
**Last updated:** <date>
## Overview
<2-3 sentences: what this service does and why this matters>
## Prerequisites
- Access to <system> (request via <link>)
- Tools: <list>
## Symptoms
- <what the alert / user report looks like>
## Diagnosis
1. <first check — command + expected output>
2. <second check>
...
## Resolution steps
### Option A: <common fix>
1. <step>
2. <step>
### Option B: <fallback>
1. <step>
## Rollback
<how to undo the resolution if it makes things worse>
## Escalation
- If unresolved after 30 min: page <person/team>
- Slack: #<channel>
- PagerDuty: <policy name>
## Post-incident
- [ ] File postmortem if SEV 1-2
- [ ] Update this runbook if steps changed
Fill in real commands wherever possible from the context provided. Prefer copy-pasteable commands over prose descriptions.
Mark gaps with <!-- TODO: confirm with <team> --> rather than guessing.
# verify this if unsure.