Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/robofinsystems/robosystems/incidentgit clone --depth 1 https://github.com/RoboFinSystems/robosystemsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00019 | $0.01518 |
| Opus 5 | $0.00010 | $0.00759 |
| Sonnet 5 | $0.00004 | $0.00304 |
| Haiku 4.5 | $0.00002 | $0.00152 |
Grade A, and why
incident scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 69 lines — stays where its author put it; the contents beside it link to each section on GitHub.
A signal says something is wrong — a customer report, an internal user, an alarm email, a spike. This skill gives you a fast, ordered headstart on where to look: triage the signal to a likely subsystem, gather the state that confirms or rules it out, and hand back a crisp picture (impact, likely cause, next action). Pairs with the incident-triage runbook in local/RoboSystems/runbooks/ for the account's known failure classes and exact log groups — read it alongside this file.
Goal
Compress time-to-orientation. You're not expected to fix everything from here — you're expected to answer, quickly and with evidence: what's broken, how bad, since when, and what changed. Breadth before depth: check the obvious surfaces in parallel, then drill into the one that lights up.
Scope & guardrails
- Read-only triage.
describe-*/list-*/get-*, log reads,ghreads. Any remediation — restarting a service, cycling an instance, rolling back, editing data — is a separate, confirmed step, not part of triage. Neverget-secret-value. - Output is sensitive — never commit it. Incident notes name live hostnames, resource IDs, error contents, maybe customer identifiers. Keep them in the scratchpad or a private channel; never in the repo, never in a public Artifact.
- State the confidence. Distinguish confirmed (you saw the error/alarm) from suspected (fits the pattern). A wrong confident diagnosis sends everyone the wrong way.
1. Pin the signal
Get concrete before searching. From whoever/whatever raised it: what is failing (an endpoint? a product surface? everything?), who is affected (one tenant or all?), when it started, and what changed near then. A single-tenant issue and a platform-wide outage need completely different first moves.
Immediately check "what changed". A recent deploy is the highest-prior cause — but it is not the only kind of change, and the other kinds are invisible to gh:
gh run list --workflow=prod.yml --limit 5 # last deploys: when, success/fail, by whom
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 69 lines · 19 tokens per session scan A ce8f81370dd7
incident is a command published in the GitHub repository RoboFinSystems/robosystems (24 stars, last pushed 4d ago), licensed Apache-2.0. It adds 19 tokens to every session and 1,518 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
fill-event-triage
체결(fill) 이벤트, 특히 매도 체결 후 현금 재배치 판단을 read-only 트리아지로 자동 기동해 dry-run 제안을 남긴다. ROB-755.
crypto-alert-triage
Command "crypto-alert-triage" from mgh3326/auto_trader, covering crypto-alert-triage, 입력, 1. 맥락 복원 (반드시 이 순서), 2. 분석 and 3. dryrun 미리보기 (read-only).
akb-production-review
Review AKB production-governance docs and hooks.
os-meeting
快速创建和管理AI团队会议.
archive-ledger
../../../shared/commands/archive-ledger.md.
rclone_config_dump
Dump the config file as JSON.