Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add magnus919/agent-skills --skill incident-learninggit clone --depth 1 https://github.com/magnus919/agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/magnus919/agent-skills/incident-learning)<a href="https://agentmods.dev/skills/magnus919/agent-skills/incident-learning"><img src="https://agentmods.dev/badge/skills/magnus919/agent-skills/incident-learning/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/magnus919/agent-skills/incident-learning"><img src="https://agentmods.dev/badge/skills/magnus919/agent-skills/incident-learning.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00098 | $0.02805 |
| Opus 5 | $0.00049 | $0.01403 |
| Sonnet 5 | $0.00020 | $0.00561 |
| Haiku 4.5 | $0.00010 | $0.00281 |
Grade A, and why
incident-learning scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 113 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Incident Learning
Convert operational incidents, near misses, and exercise findings into verified, owned improvements across product, engineering, test, evaluation, and governance domains. This skill owns the learning pipeline — the structured method that takes raw incident evidence and produces durable follow-up work with closure evidence. It does not own incident response, postmortem facilitation, or implementation of follow-up work; it owns the conversion from evidence to verified change.
When to use
| Trigger | What it covers |
|---|---|
| "Convert this incident into follow-up work" | Evidence separation, causal ledger, follow-up work map, ownership assignment |
| "What did we learn from this incident?" | Learning record with facts, hypotheses, uncertainty, escaped-from mapping |
| "Track this finding to closure" | Verification record, closure evidence, follow-up work status |
| "Link this incident to a missing requirement" | Escaped-from gap mapping: requirements, monitoring, authority, migration, adoption |
| "Review our incident follow-up closure rate" | Learning pipeline audit, unverified closures, stale follow-up work |
| "Process this near-miss" | Near-miss learning record, contributing conditions, risk reduction follow-up |
| "Build an incident learning record" | Structured record with evidence/inference/uncertainty separation and escaped-from analysis |
When not to use
- Assigning blame or conducting a blame-based review. This skill is explicitly blameless. It converts evidence into improvements, not fault into consequences. It contains no blame-assignment process, no "who to blame" field, and no "blameworthy" classification. If you need a postmortem that identifies responsible individuals, this skill will not serve that purpose.
- Producing a generic postmortem template as the sole output. This skill's artifacts — the incident-learning record, causal/evidence ledger, follow-up work map, and verification and closure record — are the primary deliverables. A postmortem, timeline, or five-whys analysis may inform the learning record but is never the terminal output.
- Live incident command or incident response. Route to site-reliability-engineering for the incident command system, on-call operations, and real-time incident management.
- Facilitating a blameless postmortem session. Route to site-reliability-engineering for postmortem culture, timeline construction, and facilitation methods. This skill consumes postmortem output; it does not produce it.
- Closing learning because tickets were created. Ticket creation is an action, not an outcome. This skill requires verification that the intended change occurred and had the intended effect. A ticket alone is not closure.
- Root-cause debugging of a specific failure. Route to systematic-debugging for failure investigation. This skill consumes debugging findings as input to the learning pipeline.
What ships with it
11 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- evals/evals.json 17 KB
- README.md 4.7 KB
- references/discovery-brief.md 13 KB
- references/escaped-from-analysis.md 6.9 KB
- references/evidence-inference-taxonomy.md 9.0 KB
- references/follow-up-domains.md 7.7 KB
- references/verification-and-closure.md 7.2 KB
- templates/causal-evidence-ledger.md 3.1 KB
- templates/follow-up-work-map.md 4.0 KB
- templates/incident-learning-record.md 4.0 KB
- templates/verification-and-closure-record.md 3.2 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 113 lines · 98 tokens per session scan A 3e1b951dfa90
incident-learning is a skill published in the GitHub repository magnus919/agent-skills (76 stars, last pushed yesterday), licensed MIT. It adds 98 tokens to every session and 2,805 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
incident-triage
Use telemetry, activity, boards, and hierarchy together when debugging live operational issues.
cocoreview
CocoReview — structured code review with six-severity findings vocabulary, progressive disclosure architecture, and universal anti-pattern baseline. Invoked via $review [file] [--complexity] [--security] [--architecture] [--language ].
cocoharvest
Decompose an approved plan into parallel workstreams, assign specialist personas, classify stages as HITL or AFK (CocoLens), generate flow.json stages with checkpoints and dual-file state, and create per-stage prompt files. Includes adaptive parallelism, stall detection, shell identity injection, and consecutive…
plan
Enter the Plan phase of CocoBrew. Runs CocoSpec quality gate pre-flight, reads spec.md and discuss.md (if present), invokes Coco native plan mode as a mandatory gate, captures the approved plan to plan.md, creates initial flow.json template, and commits. Must have $spec completed first.
cocoplus-config
CocoPlus configuration SSOT — $cocoplus sync propagates cocoplus.toml into downstream artifacts; $cocoplus migrate-config converts legacy safety-config.json. Invoked via $cocoplus sync and $cocoplus migrate-config.
ops-demo
CocoOps demo mode activator — populates .cocoplus/ops/demo/ with realistic mock data and sets cocoplus.toml [demo] enabled = true. Invoked via $ops demo.