bytedance/agentkit-samples is a collection of examples and tutorials for Volcengine AgentKit, an AI-agent development platform for building, deploying, and operating agent applications. Developers use the samples to learn agent creation, multi-agent collaboration, memory, retrieval, MCP integrations, media generation, customer service, and other workflows. The catalogue skills provide agent workflows based on these examples.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add bytedance/agentkit-samples --skill byted-volcengine-rootcause-analyzergit clone --depth 1 https://github.com/bytedance/agentkit-samplesWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/bytedance/agentkit-samples/byted-volcengine-rootcause-analyzer)<a href="https://agentmods.dev/skills/bytedance/agentkit-samples/byted-volcengine-rootcause-analyzer"><img src="https://agentmods.dev/badge/skills/bytedance/agentkit-samples/byted-volcengine-rootcause-analyzer.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00098 | $0.04213 |
| Opus 5 | $0.00049 | $0.02107 |
| Sonnet 5 | $0.00020 | $0.00843 |
| Haiku 4.5 | $0.00010 | $0.00421 |
Grade A, and why
byted-volcengine-rootcause-analyzer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 479 lines — stays where its author put it; the contents beside it link to each section on GitHub.
告警根因定位与归并 Skill
能力定位
这个 Skill 是一个面向故障场景的编排层。它不把告警当作一条孤立事件处理，而是把告警、资源拓扑、同时间窗异常和运行时证据拼成一个完整的故障上下文。
它的职责是：
- 从告警文本、现象描述或值班对话中提取实例、域名、IP、产品类型、指标和时间窗
- 围绕目标资源自动展开上下游拓扑，形成当前故障上下文
- 检查同一拓扑内其他资源是否存在关联异常
- 区分根告警、派生告警和噪声告警，避免把一组相关告警分散处理
- 汇总拓扑事实、运行时状态、监控证据和 API 补数结果，给出根因候选排序
- 输出影响范围、优先处理节点、建议修复动作和可升级交接的结构化摘要
这个 Skill 的目标不是“解释某一条告警”，而是把分散异常收敛成一条业务链路问题，尽快逼近真正的故障源头。
当前边界
当前版本重点覆盖以下能力：
- 告警解析
- 资源识别
- 拓扑展开
- 同拓扑异常归并
- 根因候选排序
- 结构化故障摘要输出
以下能力可以作为未来扩展输入，但当前不是必须步骤，也不能假设一定可用：
- 近期变更
- 历史故障案例
- 知识库经验
- 授权执行预案并验证恢复
一句话区分：
byted-volcengine-rootcause-analyzer：负责把“告警 + 拓扑 + 异常归并 + 证据”串成诊断结论- 它不是统一告警平台，不是资源管理中心本体，也不是自动执行平台
依赖 Skill 及关系
这个 Skill 依赖以下四个已有 Skill：
1. byted-volcengine-topology-builder
职责：
- 采集火山引擎账号资产快照
- 构建
topology.json、topology.md、图文件等基础拓扑数据
边界：
- 只负责“把资源关系建出来”
- 不负责解释告警，不负责给出根因结论
适合什么时候调用：
- 当前没有覆盖目标资源的拓扑
- 已有拓扑过旧或缺失关键节点
- 需要从实例、监听器、EIP、VPC、安全组等资源补齐链路
2. byted-volcengine-topology-analyzer
职责：
- 基于已有拓扑定位目标节点
- 展开直接上下游、入口链路和受影响资源
- 给出静态影响面分析
边界：
- 只消费静态拓扑，不等于实时健康状态
- 不负责直接查询监控时序或 API 详情
适合什么时候调用：
- 已识别出主告警资源或候选资源
- 需要判断“这个资源在整条链路里影响谁、被谁依赖”
3. byted-volcengine-cloudmonitor
职责：
- 查询目标资源的监控时序
- 验证异常是否持续、放大或同步传播
边界：
- 只回答“指标怎么变”
- 不能单独替代拓扑归因
适合什么时候调用：
- 需要确认告警是否仍持续
- 需要验证同拓扑内多个资源是否在同时间窗同步异常
- 需要区分瞬时抖动与持续故障
4. byted-volcengine-api-assistant
职责：
- 识别产品
ServiceCode - 搜索可用 OpenAPI
- 查询资源详情、配置和映射关系
边界：
- 它是补数能力，不是拓扑分析引擎
- 只在 OpenAPI 能力范围内工作
适合什么时候调用：
- 从告警文本无法直接判断资源类型
- 拓扑里缺少监听器、后端组、实例、转发规则映射
- 需要补充产品配置、绑定关系、健康检查详情
何时触发
当出现以下场景时，应主动触发这个 Skill：
- 监控平台产生单点告警
- 监控平台出现告警风暴，需要判断是否属于同一条链路问题
- 值班人员在会话中提交“某业务不可用”“某域名报错”“某接口超时”等现象
- 变更后短时间内出现可用性或性能异常
- 用户希望知道一组告警里哪条更接近根因、哪些只是派生结果
即使用户没有明确说“拓扑”或“告警归并”，只要问题本质是围绕一个故障现象收敛上下游异常并定位真正根因，就应该触发。
输入信息
优先从告警文本、日志摘录或自由描述中提取以下字段：
- 账号
- 告警策略
- 地域中文名
- 地域对应 Region ID
- 告警级别
- 项目
- 告警时间
- 时间窗
- 云产品
- 资源 ID
- 实例 ID
- 监听器 ID
- 域名
- IP
- 当前值
- 指标名称
- 业务现象描述
- 同一会话中出现的多条相关告警
如果文本里没有显式字段，也要继续识别：
- 产品别名
- 资源层级关键词
- 健康检查、连接数、状态码、超时、探活失败等指标语义
- 入口层、转发层、计算层、网络层等上下文词
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 479 lines · 98 tokens per session scan A 632d0cf76ee3
byted-volcengine-rootcause-analyzer is a skill published in the GitHub repository bytedance/agentkit-samples (449 stars, last pushed 2d ago), licensed Apache-2.0. It adds 98 tokens to every session and 4,213 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
triage-issues
Triage GitHub issues in the googleapis/mcp-toolbox repo: propose the correct labels (type / priority / product / status), check for duplicates, verify a bug has enough info to act on, and draft a triage comment. Use whenever a maintainer asks you to triage, label, categorize, prioritize, or "look at" an issue (or a…
adk-debug
Diagnoses misbehaving ADK agents by inspecting sessions, events, tool calls, and the exact request that reached the model. Covers the adk run CLI and the adk web dev server with its session, trace, and debug HTTP endpoints. Use when an agent returns the wrong answer, ignores a tool or swallows a tool error, hangs…
claw-admin
Claw system administration: service management, IM connections, logs, cron, and workspace diagnostics. Use when the user asks to manage claw services, connect/disconnect IM platforms, view logs, or perform system-wide operations.
rubber-duck
Adversarial "rubber duck" review that turns explaining-out-loud into a hallucination check. The main session is the PRESENTER (it did the work — a design doc, investigation, or analysis — and holds the real reasoning) and reconstructs the topic to a LISTENER — a spawned subagent pinned to a DIFFERENT-vendor model that…
scanner-overview
Stage 1 broad-spectrum scanner playbook. Sharded sweep over very large codebases producing CANDIDATE nodes for the Detector to reason about. Load at scanner-agent startup.
optimize
Review code for efficiency and performance. Triggered by "/optimize" when user wants to identify bottlenecks or improve performance.