Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/evolplus/talos/incident-debuggingnpx skills add evolplus/talos --skill incident-debugginggit clone --depth 1 https://github.com/evolplus/talosWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00064 | $0.00719 |
| Opus 5 | $0.00032 | $0.00360 |
| Sonnet 5 | $0.00013 | $0.00144 |
| Haiku 4.5 | $0.00006 | $0.00072 |
Grade C, and why
incident-debugging scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Harvests environment variableshighData exfiltration
Enumerating or grepping the environment for keys collects credentials unrelated to what the mod says it does.
- Never dump secrets or broad environment variables while investigating. How it starts
The opening of the file, as written. The whole thing — 45 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Incident Debugging
When to use
Use this skill when DevOps is asked to diagnose a deployed-environment incident or regression. The default mode is read-only investigation and mitigation planning; mutation requires explicit operator approval and a scoped task/change record.
Inputs and outputs
- Inputs: incident statement, target environment, time window, recent deploy reports, release version, monitoring/log references, rollback readiness, and any approved access method.
- Outputs: incident timeline, impact summary, suspected cause, evidence, immediate mitigation options, rollback recommendation, routing to Dev/SA/QA/PM, and post-incident follow-up tasks.
Procedure
- Declare incident scope. Record environment, service, version, symptoms, affected users/flows, start time, and current severity. If scope is vague, ask for target environment and symptom.
- Stay read-only by default. Inspect deploy reports, health endpoints, logs, metrics, traces, Kubernetes events, Docker status, and remote host state using approved credential references. Do not mutate services unless explicitly approved.
- Build a timeline. Correlate deploy events, config changes, migrations, alerts, traffic changes, dependency incidents, and first user impact.
- Check common failure classes. Recent release, migration lock/data error, config/secret mismatch, resource exhaustion, dependency outage, certificate/DNS issue, queue backlog, bad rollout, or observability gap.
- Assess mitigation. Options include rollback, disable feature flag, scale capacity, pause worker, drain traffic, retry failed jobs, or route to Dev for code fix. Name risk and owner for each option.
- Preserve evidence safely. Capture sanitized log excerpts, metric names, alert names, resource statuses, and timestamps. Do not include PII, tokens, auth headers, secret values, kubeconfig contents, or private keys.
- Route follow-up. If root cause is code, route to BE/FE Dev. If architecture/data contract, route to SA. If missing test, route to QA-Author/QA-Exec. If unclear product impact, route to PM/BA.
- Write incident report content. Use
docs/devops/<task-id>/incident-debugging.mdor task notes, plus open issues for unresolved risks.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 45 lines · 64 tokens per session scan C 11fa5f71651b
incident-debugging is a skill published in the GitHub repository evolplus/talos (8 stars, last pushed 28d ago), licensed Apache-2.0. It adds 64 tokens to every session and 719 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it C with 1 finding (harvests environment variables). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
application-design-center-design-deploy
Processes GCP infrastructure design and deployment workflows within Application Design Center (ADC). Use when: - Designing GCP infrastructure with Terraform. - Validating local HCL. - Performing best-practice plan scans. - Importing templates to Application Design Center (ADC). - Deploying templates. - Troubleshooting…
terraform-skill
Use when working with Terraform or OpenTofu - creating modules, writing tests (native test framework, Terratest), setting up CI/CD pipelines, reviewing configurations, choosing between testing approaches, debugging state issues, implementing security scanning (trivy, checkov), or making infrastructure-as-code…
interactive-login
How to complete browser/interactive logins (aws / gh / glab / gcloud). The platform backgrounds the login poller so it survives the human's browser round-trip — and when that does NOT work.
huggingface-spaces
Build, deploy, and maintain applications on Hugging Face Spaces — Gradio / Docker / Static SDKs, ZeroGPU and dedicated hardware, model loading, debugging, buckets, inference providers, community grants. Use whenever the user asks to create or host an app on Hugging Face, port code onto ZeroGPU, fix a Space that won't…
cloud-architect
Designs cloud architectures, creates migration plans, generates cost optimization recommendations, and produces disaster recovery strategies across AWS, Azure, and GCP. Use when designing cloud architectures, planning migrations, or optimizing multi-cloud deployments. Invoke for Well-Architected Framework, cost…
kagent-dev
Development guide for kagent's v1alpha3 Harness and AgentTemplate CRDs, AgentInstance gRPC control plane, upstream A2A integration, Substrate runtime provisioning, tests, generation, and PR workflow. Use for any implementation, debugging, review, or CI task in the kagent repository.