Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add derisk-ai/OpenDerisk --skill open_rca_diagnosisgit clone --depth 1 https://github.com/derisk-ai/OpenDeriskWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/derisk-ai/openderisk/open_rca_diagnosis)<a href="https://agentmods.dev/skills/derisk-ai/openderisk/open_rca_diagnosis"><img src="https://agentmods.dev/badge/skills/derisk-ai/openderisk/open_rca_diagnosis/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/derisk-ai/openderisk/open_rca_diagnosis"><img src="https://agentmods.dev/badge/skills/derisk-ai/openderisk/open_rca_diagnosis.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00036 | $0.02464 |
| Opus 5 | $0.00018 | $0.01232 |
| Sonnet 5 | $0.00007 | $0.00493 |
| Haiku 4.5 | $0.00004 | $0.00246 |
Grade A, and why
open_rca_diagnosis scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 282 lines — stays where its author put it; the contents beside it link to each section on GitHub.
故障根因分析技能 (Open RCA Diagnosis)
技能概述
本技能是一个系统化的故障根因诊断框架，通过分析微服务系统的遥测数据（指标、链路追踪、日志），遵循科学的方法论定位故障根本原因。
分析方法论
本技能基于以下核心分析方法论：
- 数据驱动 - 所有诊断结论必须有遥测数据支撑
- 层次化分析 - 从业务层到基础设施层逐层下钻
- 阈值判定 - 基于统计阈值识别异常
- 因果链追踪 - 通过调用链路追踪故障传播路径
- 交叉验证 - 多维度数据交叉验证根因
诊断工作流程
Phase 1: 数据预处理 (Preprocessing)
目标：建立分析基础，了解数据全貌
步骤 1.1：数据探索
- 探测遥测数据目录结构
- 识别可用的数据类型（metric/trace/log）
- 确定数据时间范围和文件列表
步骤 1.2：组件识别
- 提取所有组件标识（cmdb_id）
- 按层级分类组件
- 映射组件与服务的对应关系
步骤 1.3：阈值计算
- 关键原则：必须使用完整历史数据计算全局阈值
- 聚合每个组件的每个 KPI 形成时间序列
- 计算全局百分位阈值（P95/P90/P75/P50/P25/P10/P5）
- 禁止使用过滤后的数据计算阈值
步骤 1.4：时间窗口过滤
- 根据问题描述确定故障时间范围
- 将时间戳转换为统一格式
- 过滤出故障时间窗口内的数据
Phase 2: 异常检测
目标：识别偏离正常范围的异常数据点
步骤 2.1：业务指标异常
- 检查
rr（请求成功率）异常下降 - 检查
sr（服务成功率）异常下降 - 检查
mrt（平均响应时间）异常上升 - 注意：业务指标下降可能低于阈值而非高于
步骤 2.2：资源指标异常
- CPU 使用率异常（高于 P95）
- 内存使用率异常（高于 P95）
- 网络 I/O 异常
- 磁盘 I/O 异常
步骤 2.3：阈值调整策略
- 若无异常发现，逐步放宽阈值
- 调整顺序：P95 → P90 → P75
- 对于下降型指标：P95 → P15 → P5
Phase 3: 故障识别
目标：将离散异常点聚合为连续故障事件
步骤 3.1：连续异常检测
- 将时间连续的异常数据点聚合成故障子序列
- 记录故障开始时间、结束时间、持续时间
步骤 3.2：噪声过滤
- 过滤孤立的尖峰（单点异常）
- 计算阈值突破幅度（极值偏离阈值百分比）
- 排除突破幅度过小的误报（< 50%）
步骤 3.3：故障组件标注
- 标注每个故障涉及的组件
- 标注每个故障涉及的资源 KPI
- 记录故障的严重程度
Phase 4: 根因定位
目标：从多个故障事件中确定根本原因
步骤 4.1：故障层级判定
场景 A：不同层级存在故障
- 比较各层级故障的阈值突破幅度
- 突破幅度最大的层级为根因层级（需 >> 50%）
- 此规则仅用于确定层级，不用于确定具体组件
场景 B：同层级多个故障组件
- 使用链路追踪分析调用链
- 识别调用链中最下游的故障组件
- 最下游故障组件为根因候选
场景 C：单组件单 KPI 故障
- 该故障即为根因
- 结合日志确认具体原因
步骤 4.2：链路追踪分析
调用链解析规则：
- 构建 trace 的父子调用关系树
- 从根节点向叶节点遍历
- 识别调用链中的故障节点
根因判定规则：
- 根因 = 调用链中最下游的【故障】组件
- 注意：最下游不一定是根因，必须先是故障组件
- 健康组件在故障下游不作为根因
步骤 4.3：日志分析
日志分析要点：
- 不仅关注 ERROR/WARNING 日志
- INFO 日志可能包含关键操作信息
- 寻找与故障时间点匹配的日志
- 提取错误详情和堆栈信息
日志关联规则：
- 时间戳关联：日志时间与故障时间匹配
- 组件关联：日志来源与故障组件匹配
- 内容关联：日志内容与故障类型相关
关键规则
必须遵守
| 规则 | 说明 |
|---|---|
| 全局阈值计算 | 使用完整历史数据计算阈值，禁止使用过滤后数据 |
| 时区统一 | 所有时间处理使用 UTC+8 时区 |
| 指标优先 | 首先使用指标缩小搜索范围，再分析 trace 和 log |
| 链路定向 | 同层级多故障使用链路追踪定位最下游故障组件 |
| 交叉验证 | 使用 trace 和 log 交叉验证根因推断 |
| 数据溯源 | 所有结论必须有数据支撑，禁止臆测 |
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 282 lines · 36 tokens per session scan A f58d1c36fb98
open_rca_diagnosis is a skill published in the GitHub repository derisk-ai/OpenDerisk (971 stars, last pushed 7d ago), licensed MIT. It adds 36 tokens to every session and 2,464 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
langsmith-observability
LLM observability platform for tracing, evaluation, and monitoring. Use when debugging LLM applications, evaluating model outputs against datasets, monitoring production systems, or building systematic testing pipelines for AI applications.
operating-github-ci-fixer
Use when the user asks OpenSRE to fix failing GitHub CI, GitHub Actions checks, failing pull request checks, a broken PR branch, or CI on a named branch such as main.
agentsight-system-friction
Analyze AgentSight system evidence to recommend operational improvements for agent runs.
k8s-incident-triage
Read-only Kubernetes incident triage using kubectl. Accepts natural language or structured input. Produces root-cause hypotheses, evidence, and next-step commands.
phoenix-observability
Open-source AI observability platform for LLM tracing, evaluation, and monitoring. Use when debugging LLM applications with detailed traces, running evaluations on datasets, or monitoring production AI systems with real-time insights.
five-whys
Five Whys (Toyota): iterate "why?" until you reach a systemic/actionable root cause.