菜单
Use when responding to a production incident, running a post-incident review, or designing an on-call runbook. Triggers on 'incident', 'outage', 'postmortem', 'runbook', 'page', 'sev1', 'sev2'.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
"Use when validating requirements against EARS notation patterns. Triggers on "EARS", "requirement review", "requirement quality", "shall statement", "REQ-ID"."
"Use when mapping business capabilities, identifying overlap or gaps across the enterprise, or aligning IT investments to business outcomes. Triggers on "capability map", "business capability", "domain map", "enterprise architecture"."
"Use when drafting Architecture Decision Records, evaluating alternatives, or documenting technical trade-offs. Triggers on "ADR", "architecture decision", "trade-off", "pick between", "why did we choose"."
"Use when a new engineer joins the team, when onboarding to an unfamiliar codebase, or when auditing whether the team has shared understanding. Triggers on "onboard", "context", "knowledge gap", "bus factor", "team understanding"."
Use when refactoring legacy code, extracting a service, or making behavior-preserving changes. Triggers on 'refactor', 'legacy code', 'strangler fig', 'characterization test', 'mikado method'.
Use when practicing test-driven development, writing a failing test first, or coaching red-green-refactor. Triggers on 'TDD', 'red-green-refactor', 'test first', 'failing test', 'write a test'.
| name | Incident Response |
| description | Use when responding to a production incident, running a post-incident review, or designing an on-call runbook. Triggers on 'incident', 'outage', 'postmortem', 'runbook', 'page', 'sev1', 'sev2'. |
| Sev | Impact | Response target |
|---|---|---|
| Sev1 | Full outage or data loss risk | Page immediately, 15-min ack |
| Sev2 | Major feature degraded | Page during business hours |
| Sev3 | Minor feature or single-tenant issue | Ticket, next business day |
Write within 5 business days. Required sections:
Every alert must link to a runbook with: symptom, dashboard links, likely causes, verification steps, mitigations (ranked by reversibility), escalation path.
