菜单
Investigate an unexpected cloud cost spike across AWS, Azure, and GCP — pinpoint the driving account, service, and resource, then produce a cost breakdown with concrete remediation options. Use when someone reports a budget overrun, a sudden bill increase, or asks why costs went up.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
Triage and diagnose an Icinga2 monitoring alert by correlating live host/service state with the check-script source and Icinga GitOps config from GitHub, then produce a root cause and an action plan. Use when someone reports a monitoring alert, a host or service is DOWN / CRITICAL / WARNING / UNKNOWN, or asks why an Icinga check is failing.
Triage a failed Ansible Automation Platform 2 (AAP2) controller job — find the failing task, extract the error from the job output and Splunk logs, and identify the root cause with a recommended fix. Use when an AAP2 job, workflow, or Babylon deployment fails and someone needs to know why.
Detect abusive or compromised sandbox accounts using Parsec's abuse indicators — GPU and oversized instances, suspicious instance names, high-volume external users, and disposable-email signups. Use when triaging a suspected crypto-mining, compromised-credential, or quota-abuse case.
This one has malformed YAML in the frontmatter.
A skill with an unknown key under the parsec block — should warn, not fail.
A minimal valid skill that does the bare minimum to load successfully.
| name | cost-spike-investigation |
| description | Investigate an unexpected cloud cost spike across AWS, Azure, and GCP — pinpoint the driving account, service, and resource, then produce a cost breakdown with concrete remediation options. Use when someone reports a budget overrun, a sudden bill increase, or asks why costs went up. |
| license | MIT |
| allowed-tools | ["mcp__reporting__*"] |
| metadata | {"author":"parsec-team","maturity":"sample"} |
| parsec | {"version":"1.0.0","domain":"cost","requires_mcp":["reporting"],"cost_estimate_per_call_usd":0.05} |
Investigate a sudden increase in cloud spend and explain it in business terms.
*.metal / oversized instances, "Web-Created-VM" names). If the
spike looks like abuse, hand off to the abuse-account-detection skill.A short written brief: what spiked, by how much, who or what drove it, and the recommended action — with the supporting cost breakdown.