菜单
Use when asked to write a runbook, document a procedure, or create an ops playbook for a service or alert. Produces a structured runbook with context, steps, rollback, and escalation.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | draft-runbook |
| description | Use when asked to write a runbook, document a procedure, or create an ops playbook for a service or alert. Produces a structured runbook with context, steps, rollback, and escalation. |
Gather context. Ask for (or infer from available files):
Draft the runbook in this structure:
# Runbook: <Title>
**Service:** <name>
**Alert / Trigger:** <alert name or condition>
**Owner:** <team>
**Last updated:** <date>
## Overview
<2-3 sentences: what this service does and why this matters>
## Prerequisites
- Access to <system> (request via <link>)
- Tools: <list>
## Symptoms
- <what the alert / user report looks like>
## Diagnosis
1. <first check — command + expected output>
2. <second check>
...
## Resolution steps
### Option A: <common fix>
1. <step>
2. <step>
### Option B: <fallback>
1. <step>
## Rollback
<how to undo the resolution if it makes things worse>
## Escalation
- If unresolved after 30 min: page <person/team>
- Slack: #<channel>
- PagerDuty: <policy name>
## Post-incident
- [ ] File postmortem if SEV 1-2
- [ ] Update this runbook if steps changed
Fill in real commands wherever possible from the context provided. Prefer copy-pasteable commands over prose descriptions.
Mark gaps with <!-- TODO: confirm with <team> --> rather than guessing.
# verify this if unsure.Use when reviewing a backend HTTP / GraphQL handler for validation, authz, errors, performance, observability, and security, or "/backend-review". Produces a structured review with file:line citations.
Use when running a cloud security posture scan (CSPM) on AWS, Azure, or GCP using prowler, scout-suite, or checkov, or "/cloud-scan". Requires read-only credentials; produces CIS-benchmark-aligned findings with remediation.
Use when scanning a container image or Dockerfile for vulnerabilities, misconfigurations, and best-practice violations using trivy, dockle, or hadolint, or "/image-scan". Flags base-image CVEs, root user, missing healthchecks, and bloat.
Use when running an authorized non-intrusive DAST baseline scan (OWASP ZAP baseline, nuclei, nikto) against a web app or API endpoint you own, or "/dast". Requires explicit authorization; refuses unowned targets.
Use when handed a stack trace, error log, or "this is broken" with a paste of output, and asked to find the root cause across frontend, backend, or DB tiers, or "/debug-trace". Produces a hypothesis tree, the evidence supporting each branch, and the next diagnostic step.
Use when scanning a project's third-party dependencies for known CVEs across npm, pip, Go, Maven, Cargo, etc., or "/dep-scan". Runs trivy, npm audit, pip-audit, govulncheck, or osv-scanner and produces a prioritized fix list.