Menu
Use during validator incidents for slashing-risk assessment, forensics, recovery, and external verification.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Use when changing or deploying a public blockchain node-guides service, its source data, UI, contribution content, or cache.
Audit servers to identify blockchain nodes, listening ports, and effective network exposure.
Use when exiting, retiring, or decommissioning a validator with transaction, unbonding, key-retention, and shutdown gates.
Use when migrating validator workloads with freeze, key uniqueness, cutover, rollback, and downstream verification.
Use when onboarding or registering a validator with readiness, key-custody, parameter, transaction, and monitoring gates.
Use when recovering validator or full nodes from snapshots with integrity, state, rollback, and sync verification.
| name | validator-incident-response |
| description | Use during validator incidents for slashing-risk assessment, forensics, recovery, and external verification. |
Use for validator outages, missed blocks, jailing or slashing risk, crash loops, sync stalls, resource exhaustion, database faults, and suspected duplicate signing.
This public skill is environment-neutral. Resolve the authorized target_ref, network_ref, signer role, expected service, monitors, and escalation path through private knowledge and live state. Never embed or guess inventory.
Classify severity by signing risk, data/key risk, duration, missed blocks, validator state, and customer/network impact.
Before recovery, answer:
If duplicate signing or key compromise is plausible, contain signing before ordinary uptime recovery. Do not copy or display key contents.
Prefer read-only checks:
Avoid full environment dumps, secret-bearing configuration, large log dumps, broad filesystem searches, and destructive diagnostics.
Separate confirmed facts, likely cause, alternatives, and unknowns. Prefer the lowest-risk check that can distinguish them.
Common classes include:
Do not repeatedly restart a crash loop without learning from its failure.
Choose the smallest reversible action that restores safe signing:
Preserve logs and rollback evidence. Ask before destructive data replacement, key movement, transaction broadcast, or materially broader changes unless the active request explicitly includes them.
A service marked active is not recovery proof. Require applicable evidence:
Continue a bounded watch after apparent recovery.
Send a concise operator update: impact, slashing/data risk, cause confidence, actions, proof of recovery, and remaining watch items.
For meaningful incidents, record a timeline, root cause, contributing factors, recovery, validation, and follow-up in the private incident/decision knowledge layer. Generalize the reusable lesson into a guide, script, monitor, or skill update without copying private infrastructure into this package.