Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add rpraharaj/forward-deployed-engineer --skill incident-triagegit clone --depth 1 https://github.com/rpraharaj/forward-deployed-engineerWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/rpraharaj/forward-deployed-engineer/incident-triage)<a href="https://agentmods.dev/skills/rpraharaj/forward-deployed-engineer/incident-triage"><img src="https://agentmods.dev/badge/skills/rpraharaj/forward-deployed-engineer/incident-triage/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/rpraharaj/forward-deployed-engineer/incident-triage"><img src="https://agentmods.dev/badge/skills/rpraharaj/forward-deployed-engineer/incident-triage.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00105 | $0.02209 |
| Opus 5 | $0.00053 | $0.01104 |
| Sonnet 5 | $0.00021 | $0.00442 |
| Haiku 4.5 | $0.00011 | $0.00221 |
Grade A, and why
incident-triage scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 190 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Incident triage
Finding the cause fast, in a system you don't know.
Why this exists
An FDE gets pulled into incidents on systems they've known for days. That's genuinely harder than it is for the permanent team — you don't know what normal looks like, where the logs are, or which of the four services named payments-* is involved.
But you have two real advantages, and they're worth naming. You have no assumptions about where the problem is, which is exactly the bias that keeps experienced engineers looking in the wrong place for an hour. And you're comfortable saying "I don't know this system, walk me through it" — which under pressure, when everyone else is performing competence, is often what unblocks the room.
The main discipline: mitigation and diagnosis are different jobs. Doing them in the wrong order, or blurring them, extends outages. Stop the bleeding first, understand it after, and be explicit about which you're doing at any moment.
When this applies
- Production is broken, degraded, or alerting
- Customers are reporting errors
- A batch job failed or produced wrong output
- The start of a rescue engagement — usually the first task
When it doesn't
- A bug found in development — that's ordinary debugging, no urgency framing needed
- A performance concern that is not an active incident — measure it with
nfr-validationif NFRs exist, otherwise ordinary debugging. Do not page this skill for "it has been getting slower." - Post-incident improvement work — that's
observability-gap(fde-operate)
Prerequisites
None — incidents don't wait for artifacts. Where they exist, 02-system-map.md and any traces are valuable. Where they don't, this skill degrades to careful work with a stranger's system, which is the normal FDE condition anyway.
Procedure
1. Establish impact before cause
The first question is never "why." It's what is broken, for whom, since when, and is it getting worse.
- What's the observable symptom?
- Which users, how many, which regions or tenants?
- When did it start? Be precise — this is the single most useful fact you'll get.
- Is it ongoing, intermittent, or resolved?
- Is it worsening?
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 190 lines · 105 tokens per session scan A 559ea88f6fa5
incident-triage is a skill published in the GitHub repository rpraharaj/forward-deployed-engineer (6 stars, last pushed 23d ago), licensed MIT. It adds 105 tokens to every session and 2,209 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
cli-e2e
Write, modify, or debug Docker-based Composio CLI end-to-end tests under ts/e2e-tests/cli, including binary invocation, fixture isolation, output assertions, and package manifests. Use for CLI E2E test suites only; use cli-command for CLI source implementation.
openlore-analyze-codebase
Run a full static OpenLore analysis and summarize architecture, call graph, refactoring issues, and duplicate code. Use when asked to analyze, map, or assess a codebase without LLM inference.
codex-agent
Use when you want a second-opinion review via Codex CLI, cross-verification after another agent implements changes, debugging help, or alternative implementation proposals. Requires Codex CLI to be installed and authenticated.
css-debug
Use this skill to diagnose CSS and frontend layout issues such as positioning, overflow clipping, Tailwind class conflicts, z-index stacking, and React rendering visibility problems.
ln-22-codebase-auditor
Audits cross-cutting code health, security, delivery, and maintainability when no specialist audit is primary. Not for a single delivery review.
lsp-local-symbols
Fast file-scoped symbol analysis — find all usages of a symbol within the current file, list all symbols defined in the file, and get type info at a position. Use when you need local-scope analysis without a workspace-wide search.