Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add bregman-arie/devops-sre-skills --skill investigate-driftgit clone --depth 1 https://github.com/bregman-arie/devops-sre-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/bregman-arie/devops-sre-skills/investigate-drift)<a href="https://agentmods.dev/skills/bregman-arie/devops-sre-skills/investigate-drift"><img src="https://agentmods.dev/badge/skills/bregman-arie/devops-sre-skills/investigate-drift/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/bregman-arie/devops-sre-skills/investigate-drift"><img src="https://agentmods.dev/badge/skills/bregman-arie/devops-sre-skills/investigate-drift.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00020 | $0.00414 |
| Opus 5 | $0.00010 | $0.00207 |
| Sonnet 5 | $0.00004 | $0.00083 |
| Haiku 4.5 | $0.00002 | $0.00041 |
Grade A, and why
Investigate Terraform Drift scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
When to use
Use when a plan shows unexpected changes or monitoring indicates config drift.
Preconditions
- You can run
terraform planagainst the workspace/backend. - You can inspect change history (VCS and/or cloud audit logs).
Procedure
- Run a plan and classify changes: safe/no-op, risky replacement, access-related.
- Identify when drift started (compare to deploys and change logs).
- Determine the mutator: manual console change, controller, autoscaling, policy.
- Decide the source of truth: Terraform config vs external system.
- Choose reconciliation: update config, import, ignore changes, or revert manual change.
Decision points
- Replacement of critical resources: stop and coordinate; avoid apply during incidents.
- Autoscaled fields: consider lifecycle ignore for managed attributes.
- Manual hotfix required: capture it in code and remove out-of-band changes.
Verification
- A new plan is stable (no unexpected diffs).
- Audit logs align with expected change process.
Rollback / undo
- Revert config commits that introduced unintended drift.
- Restore from snapshots/backups if drift caused breakage.
Escalation
- IaC owners for state manipulation or imports.
- Security team if drift indicates unauthorized access.
Examples
terraform plan
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 67 lines · 20 tokens per session scan A caf80afbeae0
Investigate Terraform Drift is a skill published in the GitHub repository bregman-arie/devops-sre-skills (22 stars, last pushed 5mo ago), licensed Apache-2.0. It adds 20 tokens to every session and 414 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
k8s-incident-triage
Read-only Kubernetes incident triage using kubectl. Accepts natural language or structured input. Produces root-cause hypotheses, evidence, and next-step commands.
huaweicloud-troubleshooting
Troubleshoot Huawei Cloud CLI, API, SDK, deployment, permission, region, quota, endpoint, and resource errors. Use when commands fail, APIs return errors, resources are missing, or the user needs a structured diagnosis.
sre_triage
SRE first-response triage for distributed training incidents. Automates the manual checks from PyTorch/NCCL debugging runbooks.
pager-triage
AI-powered incident triage for PagerDuty. List active incidents, deep-dive with timeline and alert correlation, check on-call schedules, acknowledge, resolve, and annotate — all from your agent. Read-only by default; write operations require explicit --confirm.
gke-node-notready
Diagnoses GKE nodes reporting NotReady or Unknown status by inspecting node conditions, events, kubelet/containerd logs, and node metrics, then proposing safe remediations. Use when nodes show NotReady, when the kubelet stops posting node status, or when workloads are evicted or stuck Pending due to node health. Don't…
gke-ai-troubleshooting-jobset-interruption
Diagnoses GKE JobSet interruptions, restarts, and preemptions for AI/ML training workloads autonomously. Use when troubleshooting JobSet restart loops, spot VM preemptions, node readiness failures, host VM issues, or coordinator worker crashes. Don't use for general GKE cluster creation, basic workload deployment, or…