菜单
Phase 2 Deep Scanner — performs deep technical and business scanning on candidate machines approved by the user. One agent per machine, max 8 concurrent. Agent uses whatever tools available (SSH/cloud APIs).
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Phase 6 Delete: Create differentiated backups per resource type before deletion. This runbook implements the forced backup strategy from phase-6-delete.md section 4: - Pre-backup validation (resource exists, isolation intact, cloud API accessible) - Backup strategy dispatch (10+ resource types x environments) - Backup creation with 3-retry + exponential backoff - Backup verification (metadata validation, restore hints) - Backup protection (tagging, lifecycle rules) - Escalation to manual if all retries fail - Report generation per resource
Final phase of the zombie resource cleanup workflow. Presents all Phase 2 findings (deep scan + observation) to the user for final human decision, executes confirmed deletions, and delivers a cost savings report.
Executes batch isolation operations per Phase 3 plan, monitors observation period with 3-dimensional anomaly attribution, triggers auto-rollback on P0/P1 anomalies, and generates structured observation reports (passed/failed/uncertain). Implements "Proof by Silence" principle: if nothing breaks during observation, resource is confirmed as zombie and advances to deletion phase.
Generates human-executable isolation plans for zombie resources identified in Phase 1/2. Creates per-resource isolation strategies with pre-checklists, rollback procedures, and observation configurations, plus a global batch plan sorted by dependency safety. Never auto-executes isolation; all decisions remain with humans.
Phase 1 Suspect: Discover cloud resources and apply idle detection signals to identify zombie candidates. Prefer cloud monitoring API (CloudWatch/Prometheus/Datadog) for historical metrics. SSH fallback: see prompts/signals-compute.md for in-VM collection rules.
Cloud infrastructure cost optimization lifecycle -- identifies idle and underutilized resources, orchestrates safe isolation and observation, and manages the approve-decommission workflow to reduce cloud spend. Trigger phrases: "cost optimization", "infra cost", "zombie resources", "idle resources", "reduce cloud cost", "cloud waste".
| name | deep-scanner |
| description | Phase 2 Deep Scanner — performs deep technical and business scanning on candidate machines approved by the user. One agent per machine, max 8 concurrent. Agent uses whatever tools available (SSH/cloud APIs). |
| user-invocable | true |
| Name | Type | Required | Description |
|---|---|---|---|
| run_dir | string | Yes | Workspace root directory |
| resource_id | string | Yes | Single resource ID to scan |
| ssh_key_path | string | No | SSH key path for remote access |
Before starting execution, initialize task_context.json:
{
"task_id": "<task_id from input>",
"current_step": 0,
"current_step_id": null,
"status": "running",
"steps": {
"deep_scan": "pending",
"review_deep_scan": "pending"
},
"updated_at": "<ISO timestamp>"
}
Update this file after each step completes. On error, set step status to "failed" and overall status to "failed".
Type: agent Description: Execute deep scan on target machine
Launch an independent agent with the following prompt file:
Prompt file: $PLUGINS/ico/skills/deep-scanner/prompts/deep-scan.agent.md
Agent workflow:
Prepare the execution environment
Execute the agent with the prompt
Write results to:
analysis/deep_scan_{resource_id}.jsonAfter completing this step, update task_context.json:
current_step_id to "deep_scan"steps.deep_scan to "completed"Type: inline Description: Validate deep scan output before completing (BLOCKING)
Follow these instructions:
Read all deep_scan output files and validate them before completing:
Each deep_scan_*.json MUST have:
Do NOT include ssh_key_path or any credential paths in output. Fix any issues before completing. BLOCKING.
After completing this step, update task_context.json:
current_step_id to "review_deep_scan"steps.review_deep_scan to "completed"