Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add sky-cloak/skycloak-mcp --skill auth-incident-triagegit clone --depth 1 https://github.com/sky-cloak/skycloak-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sky-cloak/skycloak-mcp/auth-incident-triage)<a href="https://agentmods.dev/skills/sky-cloak/skycloak-mcp/auth-incident-triage"><img src="https://agentmods.dev/badge/skills/sky-cloak/skycloak-mcp/auth-incident-triage/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/sky-cloak/skycloak-mcp/auth-incident-triage"><img src="https://agentmods.dev/badge/skills/sky-cloak/skycloak-mcp/auth-incident-triage.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00062 | $0.01168 |
| Opus 5 | $0.00031 | $0.00584 |
| Sonnet 5 | $0.00012 | $0.00234 |
| Haiku 4.5 | $0.00006 | $0.00117 |
Grade A, and why
auth-incident-triage scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 101 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Authentication incident triage
"Users cannot log in" has three root-cause families: the platform is unhealthy, someone is attacking, or someone changed something. The fastest triage decides between those families first and only then digs. This workflow is strictly read-only: gather, correlate, conclude, recommend. Take no corrective action from inside it.
Step 1: scope the blast radius
Before any tool call, pin down from the reporter: all users or a subset? One application or all of them? Interactive logins, token refreshes, or both? Since exactly when? The answers pick the branch below, and "since exactly when" is the single most valuable fact you can get.
Step 2: rule the platform in or out
- skycloak_get_cluster: if status is not
available, this is a platform incident. Note the status, stop configuration hunting, and escalate to Skycloak support; nothing in realm config fixes an unavailable cluster. - skycloak_get_logs: restarts, database errors, or out-of-memory kills near the onset time mean platform first, config second.
- skycloak_get_cluster_insights with type=authentication: a cliff in the success rate at a precise timestamp corroborates the reported onset and often dates it better than the reporter can.
Step 3: read the failures themselves
Call skycloak_query_events with category=user for the affected realm, with types=["LOGIN_ERROR"] to cut the health-check noise and start_time set to before the onset: without it the query only reaches back 24 hours, and a quiet result then means nothing. limit is capped at 100 per call, so page with offset rather than asking for more. Group failures by error, ip_address, username and client_id. The shape of the grouping is the diagnosis:
- One IP, many usernames: password spraying. Check skycloak_get_security_logs to see whether the WAF is already blocking the source; if the noise is getting through, that is the finding.
- Many IPs, one or few usernames: credential stuffing against specific accounts. The account owners need a reset; the edge needs rate limiting.
- One client_id failing with invalid client credentials: a service is using a rotated or expired secret. This is a deployment problem, not an attack. skycloak_list_application_sessions shows how much live traffic the client still carries.
- A spike of user-not-found: usually an identity-provider or username format change upstream, not users forgetting who they are.
- Errors naming an identity provider: move to Step 5.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago Changed · +8 lines 794bb1f82cad
- 11d ago First seen · 93 lines · 62 tokens per session scan A e6d8276c9276
auth-incident-triage is a skill published in the GitHub repository sky-cloak/skycloak-mcp (0 stars, last pushed 5d ago), licensed Apache-2.0. It adds 62 tokens to every session and 1,168 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
zeroid
MANUAL TRIGGER ONLY: invoke only when user types /zeroid. Identity infrastructure for AI agents — register identities, issue tokens, delegate to sub-agents, revoke credentials, and manage credential policies via the Zeroid REST API.
zeroid
Identity infrastructure for AI agents — register identities, issue tokens, delegate to sub-agents, revoke credentials, manage policies.
code-review
Structured code review prompt with language and focus area.
explain-error
Explain an error message with optional context.
speak
Provides concise spoken alerts and digests through the mcp-tts MCP server. It should be selected proactively for significant AI and DevOps transitions: a substantial plan is ready, a long build/test/deploy/release/monitoring phase changes state, a major task completes, a terminal blocker or exhausted retry budget…
configuring-multi-factor-authentication-with-duo
Deploy Cisco Duo multi-factor authentication across enterprise applications, VPN, RDP, and SSH access points. This skill covers Duo integration methods, adaptive authentication policies, device trust.