From routine
Generates PIRs from PagerDuty, Datadog, Cloudflare, and Rollbar incidents. Orchestrates sub-skills, auto-determines severity, outputs completed forms for post-incident documentation.
npx claudepluginhub delexw/claude-code-miscThis skill is limited to using the following tools:
Discover issues from PagerDuty, Datadog, Cloudflare, and Rollbar concurrently, auto-determine severity, and produce completed PIR forms for each issue.
references/pir-form-fields.mdsteps/step1-gather-date-range.mdsteps/step2a-discover-incidents.mdsteps/step2b-discover-datadog.mdsteps/step2c-discover-cloudflare.mdsteps/step2d-discover-rollbar.mdsteps/step2e-discover-slack.mdsteps/step3a-codebase-analysis.mdsteps/step3b-generate-nlm.mdsteps/step4-present-results.mdOrchestrates multi-agent SRE incident response for outages, security breaches, and degradations: triage, observability sweeps, mitigation, and blameless postmortems.
Triages production incidents by severity (P1-P3), contains blast radius via rollback or strategies, root-causes issues, documents timeline, generates postmortems. Triggers on outages, errors, or 'incident' mentions.
Orchestrates multi-agent incident response workflows using SRE practices for detection, triage, observability analysis, mitigation, communication, and postmortems. For outages, security breaches, performance issues.
Share bugs, ideas, or general feedback.
Discover issues from PagerDuty, Datadog, Cloudflare, and Rollbar concurrently, auto-determine severity, and produce completed PIR forms for each issue.
Raw arguments: $ARGUMENTS
Infer from the arguments:
Resolved during Step 1 (not provided directly):
$SLACK_INCIDENT_CHANNEL env var.Each PIR maps to these fields — see PIR Form Fields for format, examples, and output template:
| Field | Required | Source |
|---|---|---|
| Impact Summary | Yes | Synthesised from all skills |
| What | Yes | PagerDuty incident + Datadog + Cloudflare |
| Who | Yes | Datadog (RUM/error tracking) + Cloudflare (user counts) |
| Culprit | Yes | Cloudflare (JA4, traffic sources) + Datadog (error traces) + Rollbar (stack traces, error-deploy correlation) + PagerDuty (trigger details) + Slack (root cause discussion) + Codebase analysis (culprit commits) |
| Incident date | Yes | Earliest detection across all sources (PagerDuty, Datadog, Cloudflare) |
| When | Yes | PagerDuty created/resolved + Datadog timeline |
| Remediation | Optional | PagerDuty notes + Datadog monitors + Slack (actions taken during incident) |
| Incident controller | Optional | PagerDuty escalation policy responders + Slack (active responders in channel) |
Determine severity from the collected data — do NOT ask the user:
| Severity | Criteria |
|---|---|
| SEV1 | Service outage or >50% error rate on critical path; cascading failures; >30 min duration |
| SEV2 | Partial degradation; 10-50% error rate; single service affected; 10-30 min duration |
| SEV3 | Minor impact; <10% error rate; brief spike (<10 min); limited user impact |
Use the highest applicable severity when multiple criteria match.
See step1-gather-date-range.md
Detects the input mode from QUERY and resolves SINCE/UNTIL:
Orchestration depends on whether PD_INCIDENT was resolved in Step 1:
Each sub-skill receives SINCE and UNTIL (UTC ISO8601) when available, ensuring a consistent analysis window across all data sources.
See step2a-discover-incidents.md
— Invokes Skill("pagerduty-oncall"). Skipped if PD_INCIDENT was resolved in Step 1b.
See step2b-discover-datadog.md
— Invokes Skill("datadog-analyser"). Passes SINCE, UNTIL, SERVICE_HINT when available.
See step2c-discover-cloudflare.md
— Invokes Skill("cloudflare-traffic-investigator"). Passes domain and zone ID from CF_DOMAIN_ZONE if provided. Passes SINCE, UNTIL when available.
See step2d-discover-rollbar.md
— Invokes Skill("rollbar-reader"). Passes SINCE, UNTIL, TITLE_HINT when available.
See step2e-discover-slack.md
— Invokes Skill("slack-explorer"). Resolves channel from invoker context or $SLACK_INCIDENT_CHANNEL env var. Skipped gracefully if no channel is found.
See step3a-codebase-analysis.md — Analyses git history across working directories, correlates with incident timeline from discovery reports.
See step3b-generate-nlm.md — Runs after 3a. Creates NotebookLM notebook, uploads all discovery and codebase reports, generates report, infographic, and slide deck. Returns notebook ID.
See step4-present-results.md — Displays PIR summary and provides notebook link for interactive exploration. Preserves the NotebookLM notebook for further queries.