Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/conallob/o11y-analysis-toolsnpx agentmods add skills/conallob/o11y-analysis-tools/alert-hysteresisWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/conallob/o11y-analysis-tools/alert-hysteresis)<a href="https://agentmods.dev/skills/conallob/o11y-analysis-tools/alert-hysteresis"><img src="https://agentmods.dev/badge/skills/conallob/o11y-analysis-tools/alert-hysteresis/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/conallob/o11y-analysis-tools/alert-hysteresis"><img src="https://agentmods.dev/badge/skills/conallob/o11y-analysis-tools/alert-hysteresis.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.01373 |
| Opus 5 | $0.00000 | $0.00687 |
| Sonnet 5 | $0.00000 | $0.00275 |
| Haiku 4.5 | $0.00000 | $0.00137 |
Grade A, and why
alert-hysteresis scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 105 lines — stays where its author put it; the contents beside it link to each section on GitHub.
alert-hysteresis
Analyzes how long alerts have actually stayed firing in the past (via
Prometheus's ALERTS{alertname=...} series) and recommends a for:
duration that would filter out short-lived, non-actionable firings while
still catching the ones that matter. This is a judgment-assisted,
interactive tool, not a static analyzer — every run depends on real,
non-reproducible production history.
When to use this skill
- On-call has flagged an alert as noisy/flappy and you want a
data-driven
for:recommendation instead of guessing. - You're auditing a rules file's existing
for:values against how the alert has actually behaved in production. - Do not wire this into CI as a blocking check: its output depends on
live Prometheus data that CI can't reproduce deterministically, and the
right response to a recommendation is a human decision, not an
auto-applied diff (except deliberately, via
--fix, described below).
Prerequisites
- A reachable Prometheus (or Thanos/Cortex/Mimir with a Prometheus-
compatible
/api/v1/query_rangeendpoint) that has been actually evaluating the alerting rules in question, so theALERTSmetric has history to query. - Retention matters: this tool can only see as far back as
--timeframeand as far back as Prometheus has actually retained samples. A--timeframe=30dagainst a Prometheus with 15d retention will silently undercount — always sanity-check retention before trusting a "no data" or thin-sample result.
Setup
go build -o bin/alert-hysteresis ./cmd/alert-hysteresis
# or: go install github.com/conallob/o11y-analysis-tools/cmd/alert-hysteresis@latest
Usage
alert-hysteresis [options]
| Flag | Default | Effect |
|---|---|---|
--prometheus-url |
http://localhost:9090 |
Prometheus API base URL. Required to be reachable — the tool errors out otherwise. |
--alert |
"" |
Restrict analysis to one alert name. Omit to analyze every alert with firing history in the window. |
--timeframe |
168h (7d) |
Lookback window, any Go duration (24h, 72h, …). |
--rules |
"" |
Path to a rules YAML file — lets the tool compare its recommendation against the currently configured for: value and only flag a mismatch beyond --threshold. Without it, every alert's recommendation is just reported, not flagged as a mismatch. |
--threshold |
0.2 |
Fractional mismatch (vs. configured for:) required before flagging a recommendation, e.g. 0.3 = only flag when recommended and configured differ by >30%. |
--target-percentile |
0.3 |
Which percentile of historical firing durations to recommend as the new for: (e.g. 0.5 = median). Higher values are more conservative (fewer alerts prevented, less risk of missing a real incident). |
--fix |
false |
Requires --rules. Writes the recommended for: values directly into the rules file instead of just printing them. |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 105 lines · 0 tokens per session scan A af9ff3153813
alert-hysteresis is a skill published in the GitHub repository conallob/o11y-analysis-tools (4 stars, last pushed 1mo ago), licensed BSD-3-Clause. It costs nothing until one of its globs matches a file; then it loads 1,373 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
Observability with Prometheus & Grafana
Production-grade observability stack with Prometheus metrics, Grafana dashboards, PromQL query language, alerting rules, and AI-powered anomaly detection for modern cloud-native applications.
querying-yandex-cloud
Read Yandex Cloud through its REST API. Applies to any question about VMs, metrics, logs, audit events, Kubernetes, managed databases, serverless, networking or any other Yandex Cloud resource. Never shell out to the yc CLI — it is not how this agent reaches Yandex Cloud and is usually not installed.
i18n-lookup
Look up Zeabur platform UI term translations from the dashboard i18n files. Use when writing or reviewing docs that reference UI elements (button labels, tab names, menu items) to ensure docs match the actual platform translations.
k8s-pod-rightsizer
Analyze Kubernetes workload metrics and produce policy-constrained CPU/memory rightsizing recommendations with optional patch generation and rollback-safe apply.
monitoring-observability
Monitoring and observability patterns for Prometheus metrics, Grafana dashboards, Langfuse v4 LLM tracing (astype, scorecurrentspan, shouldexportspan, LangfuseMedia), and drift detection. Use when adding logging, metrics, distributed tracing, LLM cost tracking, or quality drift monitoring.
gcp-cloud-monitoring
Google Cloud Monitoring — time series metrics, alert policies, active alerts, metric discovery. Use when checking GCP network performance, investigating firing alerts, querying VM CPU or memory metrics, reviewing Cloud VPN tunnel status, or assessing load balancer latency.