A workflow for writing a Root Cause Analysis, or RCA, after an incident, outage, data problem, security breach, or repeated non-obvious test failure. An RCA explains what happened, why it happened, and what will change.

Use it to document timelines, alerts, logs, user reports, relevant changes, and corrective actions in a post-incident report.

It turns technical evidence into a clear record that helps teams understand failures and prevent them from happening again.

How friedbotstudio/baseline configures Claude Code

Reuse

Borrowing it

Nothing to install: this file belongs to friedbotstudio/baseline. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/friedbotstudio/baseline/main/.claude/skills/rca/SKILL.md

Clone the repo

git clone --depth 1 https://github.com/friedbotstudio/baseline

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/friedbotstudio/baseline/rca/github.svg)](https://agentmods.dev/skills/friedbotstudio/baseline/rca)

Your own site

<a href="https://agentmods.dev/skills/friedbotstudio/baseline/rca"><img src="https://agentmods.dev/badge/skills/friedbotstudio/baseline/rca/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/friedbotstudio/baseline/rca"><img src="https://agentmods.dev/badge/skills/friedbotstudio/baseline/rca.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 61 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 810 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00061	$0.00810
Opus 5.5	$0.00024	$0.00324
Sonnet 5.5	$0.00012	$0.00162
Haiku 4.5	$0.00006	$0.00081

Measured 1mo ago against content hash e5d1285df6d6, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

rca scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/skills/rca/SKILL.md · 43 lines

How it starts

The opening of the file, as written. The whole thing — 43 lines — stays where its author put it; the contents beside it link to each section on GitHub.

RCA — Root Cause Analysis

You are drafting an RCA. It is a narrative of what went wrong, why, and what will change so it doesn't recur. Unlike the other artifact skills in this workflow, RCA is not part of the linear phase chain — it's a separate document that often feeds into a bugfix intake (/triage → /intake → …).

Use an RCA when:

A production incident occurred (outage, data corruption, security breach).
A test that previously passed now fails intermittently and the cause is non-obvious.
A verify skill verdict has been FAIL across multiple attempts and the team needs a blameless record.
The user explicitly says "postmortem", "RCA", "incident review", or equivalent.

Don't use an RCA for: a bug reported in a ticket, a missing feature, or a normal TDD failure. Those belong in intake/spec/tdd.

Inputs

The incident's observable facts: timeline, alerts, logs, user reports, metrics screenshots (paths or URLs).
The commits, deploys, or config changes in the suspect window.
template.md in this skill directory.

Steps

Read template.md. Every heading must appear in the output.
Assemble the Timeline from raw evidence (logs, alert history, chat transcripts, deploy log). Wall-clock times in a single timezone. Do NOT paraphrase events — record what happened.
State the Root cause as a single sentence. If you have multiple candidate causes and cannot distinguish them from the evidence, list them under Contributing factors and put "not conclusively identified" as the Root cause. Do not guess.
Impact must be quantified. Users affected: count or estimate with method. Duration: precise. Business impact: dollars, SLA minutes, or "none measurable" — never a vague "significant".
Action items have owners and due dates. Unassigned action items are placeholder; delete them or assign.
Write to docs/rca/<slug>.md. Slug: YYYY-MM-DD-<short-name> so the file sorts chronologically in the directory.
Tell the user: "RCA drafted at docs/rca/<slug>.md. Action items: N, owners assigned: M. If this warrants a fix, run /triage with a bugfix description referencing this RCA."

Read the full file on GitHub · 43 lines

Files

What ships with it

1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

template.md 2.2 KB

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

1mo ago First seen · 43 lines · 61 tokens per session scan A e5d1285df6d6

Subscribe to this mod's changes

rca is a skill published in the GitHub repository friedbotstudio/baseline (14 stars, last pushed 13d ago), licensed Apache-2.0. It adds 61 tokens to every session and 810 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

AI Safety Debugging ai ai-coding ai-governance ai-security ai-tools

monitoring-observability

OpenTelemetry, structured logging, distributed tracing, alerting, and dashboards. Use when instrumenting services, designing logs/traces/metrics, defining SLOs and alerts, or debugging production behavior from telemetry.

travisjneuman/.claude · 48 tokens

debug-systematic

Systematic 4-phase debugging methodology for complex, intermittent, or mysterious issues. Use when investigating bugs, race conditions, or unexplained failures.

travisjneuman/.claude · 33 tokens

diagnose-windows-sandbox-acl

Use on Windows for unexpected ALEGO sandbox access denials: workspace writes or listing fail, or an ordinarily readable path cannot be read. One bundled command inspects the path and every ancestor and repairs the ACL problems it proves in that same run. Expected confinement denials need no ACL repair.

singula-ai/alego · 67 tokens

baseline: Skill for Claude Code