메뉴
Use when the user says "triage this alert", "what's on fire", "incident", or "/triage". Structures an incident triage: severity, blast radius, likely cause, immediate mitigation steps, and who to page.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Use when reviewing a backend HTTP / GraphQL handler for validation, authz, errors, performance, observability, and security, or "/backend-review". Produces a structured review with file:line citations.
Use when running a cloud security posture scan (CSPM) on AWS, Azure, or GCP using prowler, scout-suite, or checkov, or "/cloud-scan". Requires read-only credentials; produces CIS-benchmark-aligned findings with remediation.
Use when scanning a container image or Dockerfile for vulnerabilities, misconfigurations, and best-practice violations using trivy, dockle, or hadolint, or "/image-scan". Flags base-image CVEs, root user, missing healthchecks, and bloat.
Use when running an authorized non-intrusive DAST baseline scan (OWASP ZAP baseline, nuclei, nikto) against a web app or API endpoint you own, or "/dast". Requires explicit authorization; refuses unowned targets.
Use when handed a stack trace, error log, or "this is broken" with a paste of output, and asked to find the root cause across frontend, backend, or DB tiers, or "/debug-trace". Produces a hypothesis tree, the evidence supporting each branch, and the next diagnostic step.
Use when scanning a project's third-party dependencies for known CVEs across npm, pip, Go, Maven, Cargo, etc., or "/dep-scan". Runs trivy, npm audit, pip-audit, govulncheck, or osv-scanner and produces a prioritized fix list.
| name | triage-incident |
| description | Use when the user says "triage this alert", "what's on fire", "incident", or "/triage". Structures an incident triage: severity, blast radius, likely cause, immediate mitigation steps, and who to page. |
Extract signal. From the alert/log, identify:
Assign severity using this scale:
| SEV | Condition |
|---|---|
| 1 | Production down or data loss — page on-call lead immediately |
| 2 | Production degraded, significant user impact |
| 3 | Partial failure, workaround exists |
| 4 | Non-prod, minor impact |
Assess blast radius:
Hypothesize causes (pick top 2-3):
git log --since="2 hours ago" --onelineImmediate mitigation steps (stop the bleeding first):
gh run list --workflow=deploy)Output:
## Incident Triage — <service> — <timestamp>
**Severity:** SEV-X — <one line why>
**Blast radius:** <who/what is affected>
**Duration:** <how long>
### Likely causes
1. <most likely> — evidence: ...
2. <alternative>
### Immediate actions
- [ ] <rollback / disable / scale>
- [ ] Page <team/person> if SEV 1-2
- [ ] Open incident channel #inc-<service>-<date>
### Investigate next
- [ ] Check dashboards: <links if known>
- [ ] Review recent deploys
- [ ] Check upstream dependencies