Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/greglas75/zuvonpx agentmods add skills/greglas75/zuvo/incidentWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/greglas75/zuvo/incident)<a href="https://agentmods.dev/skills/greglas75/zuvo/incident"><img src="https://agentmods.dev/badge/skills/greglas75/zuvo/incident/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/greglas75/zuvo/incident"><img src="https://agentmods.dev/badge/skills/greglas75/zuvo/incident.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00064 | $0.06605 |
| Opus 5.5 | $0.00026 | $0.02642 |
| Sonnet 5.5 | $0.00013 | $0.01321 |
| Haiku 4.5 | $0.00006 | $0.00660 |
Grade A, and why
incident scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 667 lines — stays where its author put it; the contents beside it link to each section on GitHub.
zuvo:incident — Incident Response & Postmortem
A structured framework for production incident investigation. Builds a timeline from git history, CI/CD deploys, and error tracking, identifies suspect commits, assesses impact, recommends remediation, and generates a blameless postmortem document.
Scope: Production incidents where something is broken, degraded, or behaving unexpectedly. Investigation, root cause analysis, and postmortem generation.
Out of scope: Actually applying fixes (use zuvo:debug or zuvo:build), code quality sweeps (zuvo:code-audit), performance investigation without an active incident (zuvo:performance-audit).
Argument Parsing
Parse $ARGUMENTS for these flags:
| Flag | Effect |
|---|---|
[description] |
What happened (free text) |
--since [time] |
When the incident started (ISO-8601, relative like 2h, or natural language like yesterday 3pm). Default: 24h ago |
--service [name] |
Affected service, endpoint, or component |
--sev [1-4] |
Override auto-detected severity (1=critical, 4=low) |
--revert |
Include revert recommendation with exact command |
--comms |
Generate communication templates (internal + customer-facing) |
--dry-run |
Analyze only, do not create postmortem file |
Flags can be combined: zuvo:incident payments returning 500 --since 2h --service /api/payments --sev 1 --revert --comms
Environment Compatibility
Dispatch follows ../../shared/includes/execution-policy.md through env-compat. Reuse existing
authorization within that policy; session restrictions take precedence. Run each required gate
and report its actual independence or an unmet requirement.
Read ../../shared/includes/env-compat.md for agent dispatch patterns, path resolution, and progress tracking across all supported platforms.
CodeSift Integration
Read ../../shared/includes/codesift-setup.md for the full initialization sequence.
Key tools for incident response:
| Phase | Task | CodeSift tool | Fallback |
|---|---|---|---|
| 2 | Blast radius of suspect commits | impact_analysis(repo, since="[suspect]") |
Grep for imports of changed files |
| 2 | Callers of changed code | trace_call_chain(repo, symbol, direction="callers") |
Repeated Grep for function name |
| 2 | Symbol-level changes | search_symbols(repo, "<symbol>", include_source=true, file_pattern="<changed files>") |
git diff --stat |
| 2 | Compact change summary | codebase_retrieval(repo, queries=[{type:"text", query:"<term>"}]) |
git log --oneline |
| 3 | Understand affected function | get_context_bundle(repo, symbol_name) |
Read the entire file |
| Any | Batch 3+ lookups | codebase_retrieval(repo, queries=[...]) |
Sequential Grep/Read |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · -2 lines 1fdd8543c393
- 1mo ago First seen · 669 lines · 64 tokens per session scan A 6e4dbccc2acf
incident is a skill published in the GitHub repository greglas75/zuvo (8 stars, last pushed yesterday), licensed MIT. It adds 64 tokens to every session and 6,605 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
changelog
Add CHANGELOG.md entries, derive them from commits, or cut a Keep a Changelog and SemVer release.
wrap-up-branch
Finish a feature branch: add missing tests, review and fix the code, align docs, then merge only after explicit confirmation.
resolve-merge
Resolve an active merge or rebase conflict, including safe renumbering of colliding plans and chronicles.
commit
Create a user-requested Conventional Commit from the staged changes.
kanso-pr
Use when the user asks to write a pull request description, open a PR, draft PR notes, or summarise a branch for review.
release
Cut a brooks-lint release: set the version in package.json, propagate it across all four plugin manifests and every version-bearing text file (README badges, docs site metadata), write the CHANGELOG entry, validate, then commit, push, tag, and publish the GitHub release. Triggers when the maintainer asks to "release"…