メニュー
Infrastructure alert triage — dedup via YT search, deep PVE/K8s investigation, auto-escalation for recurring/flapping alerts, control plane deep dive for K8s controller nodes.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Meta-skill chaining /specify → /constitute → /plan → /tasks → spec-validation → dispatch-ready. Greenfield project from idea to parallel-dev-ready in one flow. Halts with clear remediation if any phase fails the DoD gate.
Phase C of greenfield project bootstrap. Produce constitution.md (5-15 non-negotiable articles) + steering/*.md (cross-cutting agent-wide rules). Pauses for operator review before exit.
Phase D of greenfield project bootstrap. Produce design.md + data-model.md + contracts/{openapi,asyncapi,schemas/*} + adr/NNNN-*.md. Validates contracts via swagger-cli/asyncapi/ajv before exit.
Phase B of greenfield project bootstrap. Interview the operator to produce PROJECT.json + PROJECT.md + spec/NNN-*/requirements.md (EARS-only) + acceptance/*.feature scenarios. Iterates until ears-lint.py passes.
Phase E of greenfield project bootstrap. Atomize design.md + contracts into tasks.json with files_owned + dependencies + acceptance_test + risk_score per task. Iterates until task-dag-validate passes.
Query code graph database for function callers, callees, dependencies, and dead code in CubeOS and MeshSat repos.
| name | infra-triage |
| description | Infrastructure alert triage — dedup via YT search, deep PVE/K8s investigation, auto-escalation for recurring/flapping alerts, control plane deep dive for K8s controller nodes. |
| allowed-tools | Bash |
| user-invocable | true |
| metadata | {"openclaw":{"always":true}} |
When you see a message starting with [LibreNMS] ALERT in #infra-nl-prod or #infra-gr-prod, you MUST automatically run this full triage flow using the exec tool. Do NOT ask questions — just execute.
./skills/infra-triage/infra-triage.sh <hostname> "<rule_name>" <severity> [--site nl|gr]
Site is auto-detected from hostname prefix (grskg* → GR, otherwise NL). Use --site to override.
| Variable | Purpose |
|---|---|
FORCE_ESCALATE=true | Escalate regardless (set by n8n for flapping alerts) |
EXISTING_ISSUE=ID | Reuse this YT issue instead of creating new |
SKIP_ESCALATION=true | Skip escalation step (for burst/correlated triage) |
Searches YouTrack for existing open issues with the same hostname (created within 24h). If found, reuses instead of creating a duplicate. Reopens if in "To Verify". Also searches for related issues (same alert rule on different hosts within 12h).
Creates issue in the site's YT project (IFRNLLEI01PRD for NL, IFRGRSKG01PRD for GR) or reuses existing. Registers callback with n8n for dedup tracking. Sets custom fields (Hostname, Alert Rule, Severity, Alert Source, VMID, PVE Host).
Posts investigation results as YT comment, including related issues and recurring alert flag.
Always escalates to Claude Code unless SKIP_ESCALATION=true. Includes escalation reason (standard/flapping/recurring).
exec tool to run the script. Do NOT describe what to do — execute it.pct start, pct stop, docker restart, config edits, etc.