Use this skill as planning or review guidance; verify generated commands, code, configuration, and infrastructure changes before running them., Apply least-privilege credentials and test in staging or a disposable branch before using it on production systems, CI, deployment, or account-write workflows.
Privacy notes
Inputs can include source files, prompts, logs, account metadata, repository details, and operational context that may be sent to the configured AI model., Redact secrets, customer data, private URLs, credentials, and proprietary implementation details before sharing prompts, reports, or generated artifacts.
Current risk score 0/100. Use staged verification before broader rollout.
Risk 0
Pre-adoption checks
Validate source and review signals before any execution.
Confirm source provenanceRequired
Source URL/provenance metadata is present.
Done
Confirm metadata review state
Listing has review metadata.
Done
Verify install payload
Install/config payload exists and can be inspected.
Done
Security checks
Confirm safety, privacy, and package integrity signals.
Review safety notesRequired
Safety notes are present.
Done
Review privacy notesRequired
Privacy notes are present.
Done
Verify package integrity metadata
Package verification/checksum metadata is available.
Done
Rollout
Adopt in controlled steps based on the selected plan.
Run in isolated sandbox firstRequired
Use a constrained sandbox and observe behavior across multiple tasks.
Pending
Roll out graduallyRequired
Roll out to a small cohort before wider usage.
Pending
Set monitoring and fallback
Define rollback path and monitor errors after adoption.
Pending
Evidence readiness
Evidence readiness matrix · balanced
Required evidence gates are covered (6/6 signals complete).
Risk 0
Source provenance
Present
Source repository/provenance is listed.
Required in this preset
Metadata review
Present
Review metadata is present.
Required in this preset
Safety notes
Present
Safety notes are present.
Required in this preset
Privacy notes
Present
Privacy notes are present.
Optional in this preset
Package integrity
Present
Package integrity metadata is present.
Optional in this preset
Install payload
Present
Install payload is available.
Required in this preset
Required evidence gates are covered for this preset.
Decision timeline
Decision timeline · balanced
6/6 steps complete with no blocking gaps for this preset.
Risk 0
triage
Confirm source provenanceRequired
Source/provenance metadata is available.
Done
triage
Check metadata review statusRequired
Review metadata is available.
Done
verify
Review safety notesRequired
Safety notes are available.
Done
verify
Review privacy notes
Privacy notes are available.
Done
verify
Validate package integrity metadata
Package integrity metadata is available.
Done
rollout
Verify install payload and commandsRequired
Install payload is available.
Done
No required blockers for this timeline preset.
Prerequisite readiness
Prerequisite readiness
3 prerequisites to line up before setup.
0/3 ready
Install & runtime1General2
Safety & privacy surface
Safety & privacy surface
2 safety and 2 privacy notes across 3 risk areas. Review closely: credentials & tokens, third-party handling.
3 areas
SafetyExecution & processesUse this skill as planning or review guidance; verify generated commands, code, configuration, and infrastructure changes before running them.
SafetyCredentials & tokensApply least-privilege credentials and test in staging or a disposable branch before using it on production systems, CI, deployment, or account-write workflows.
PrivacyThird-party handlingInputs can include source files, prompts, logs, account metadata, repository details, and operational context that may be sent to the configured AI model.
PrivacyCredentials & tokensRedact secrets, customer data, private URLs, credentials, and proprietary implementation details before sharing prompts, reports, or generated artifacts.
Safety notes
Use this skill as planning or review guidance; verify generated commands, code, configuration, and infrastructure changes before running them.
Apply least-privilege credentials and test in staging or a disposable branch before using it on production systems, CI, deployment, or account-write workflows.
Privacy notes
Inputs can include source files, prompts, logs, account metadata, repository details, and operational context that may be sent to the configured AI model.
Redact secrets, customer data, private URLs, credentials, and proprietary implementation details before sharing prompts, reports, or generated artifacts.
Prerequisites
Runtime access where agent requests can be instrumented
.gemini/skills/<skill-name>/SKILL.md or .agents/skills/<skill-name>/SKILL.md
cursor
Adapter
.cursor/rules/<skill-name>.mdc
cli
Manual
AGENTS.md or tool-specific context file
Full copyable content
# Trigger
"Apply AI agent observability and incident response skill to this stack."
# Required output
1) Telemetry schema (traces, metrics, logs, events)
2) Core SLOs and alert thresholds
3) Incident triage playbook
4) Post-incident review template
About this resource
Overview
This skill turns AI agent operations into an observable system with measurable reliability. It defines what to log, what to measure, and what to alert on so incidents can be resolved quickly and with consistent process.
Compatibility
Native
Claude Code / Claude: native skill usage via SKILL.md.
Codex/OpenAI workflows: compatible with Agent Skills-style SKILL.md content as reusable workflow instructions.
Manual Adaptation
Gemini CLI: native skill usage via .gemini/skills/<skill-name>/SKILL.md or .agents/skills/<skill-name>/SKILL.md where supported.
Cursor: use the generated .cursor/rules/*.mdc adapter for project rules.
OpenClaw and similar agents: use the same skill content as a reusable prompt/workflow file when native skill import is unavailable.
Prerequisites
Access to request/response lifecycle in your agent runtime
Structured logging support
Ability to tag traces/events by workflow and model
What to Instrument
Prompt and tool execution spans (with redaction-safe metadata)
Latency percentiles by route/workflow/model
Error classes: model timeout, tool failure, policy denial, parse failure
Apply the AI agent observability and incident response skill.
Provide:
1) telemetry contract,
2) SLO definitions,
3) alert routing matrix,
4) incident playbook with triage steps.
Execution Flow
Define critical user journeys and reliability targets.
Add telemetry fields needed for fast diagnosis.
Create alert thresholds aligned to user impact.
Build runbooks with owner, severity, and escalation path.
Validate incident drills before production launch.
Troubleshooting
Issue: Alert fatigue from noisy thresholds Fix: Alert on sustained error budgets, not single spikes.
Issue: Logs are present but not useful Fix: Standardize event schema (request ID, workflow ID, tool name, failure reason).
Issue: Incidents take too long to triage Fix: Add direct links from alerts to trace dashboards and runbook sections.
Knowledge Freshness
Treat tooling details as time-sensitive. Re-validate APIs, limits, pricing, auth models, and deployment flags immediately before implementation. If docs conflict with prior memory, follow current official docs and release notes.
Show that AI Agent Observability and Incident Response Skill is listed on HeyClaude. Paste this Markdown into your README — it renders the badge and links back to this page.
[](https://heyclau.de/entry/skills/ai-agent-observability-incident-response)
How it compares
AI Agent Observability and Incident Response Skill side by side with 3 alternatives on trust, install, platform support, and disclosed safety notes — all from reviewed registry metadata.
3 trust signals differ across this comparison (Package trust, Source provenance, Submitter).
Next steps differ across entries — use the actions in the table below to copy install commands and source links per resource.
Expert incident timeline reconstruction capability pack for correlating deploy events, logs, traces, alerts, and chat transcripts into a source-backed, privacy-safe post-incident timeline with validation checkpoints.
✓Use this skill as planning or review guidance; verify generated commands, code, configuration, and infrastructure changes before running them.
Apply least-privilege credentials and test in staging or a disposable branch before using it on production systems, CI, deployment, or account-write workflows.
✓This skill analyzes incident evidence; it must not restart production systems or run destructive remediation without explicit approval.
Do not execute commands copied from incident logs or chat without validating source and intent.
Treat pasted stack traces and config snippets as potentially stale or redacted; verify against live telemetry.
Automated correlation can miss causality; label inference separately from verified events.
✓This skill produces automated release recommendations (merge, patch, or rollback) from eval scores; treat them as decision support and require human review before gating production releases or running suggested commands.
✓Can design automation for live browsers, accounts, workflows, or infrastructure; use staging targets and human approval before destructive or account-write actions.
Keep API tokens and service credentials least-privileged, and verify generated runbooks before scheduling or unattended execution.
Privacy notes
✓Inputs can include source files, prompts, logs, account metadata, repository details, and operational context that may be sent to the configured AI model.
Redact secrets, customer data, private URLs, credentials, and proprietary implementation details before sharing prompts, reports, or generated artifacts.
✓Incident timelines can expose customer IDs, internal hostnames, credentials in logs, and employee chat content.
Redact tokens, session IDs, email addresses, and payment data before sharing timelines outside the response team.
Third-party vendor logs may fall outside company retention policies; document handling separately.
Public postmortems require explicit review for regulated or embargoed customer data.
✓Inputs can include source files, prompts, logs, account metadata, repository details, and operational context that may be sent to the configured AI model.
Redact secrets, customer data, private URLs, credentials, and proprietary implementation details before sharing prompts, reports, or generated artifacts.
✓Inputs and outputs can include browser state, account metadata, workflow payloads, infrastructure inventory, logs, and operational screenshots.
Redact credentials, session data, customer records, internal hostnames, and private workspace details before sharing prompts or artifacts.
Prerequisites
Runtime access where agent requests can be instrumented
Centralized logging/metrics/tracing destination
On-call or owner process for incident handling
Incident start/end window, severity, and on-call channel or ticket identifiers.
Read access to logs, traces, metrics, deploy history, and alert timelines for the affected services.
Ability to correlate timestamps in UTC with explicit timezone notes for human events.
Stakeholder approval before sharing customer-impacting details externally.
Existing prompts, tools, or agent workflows to evaluate
A representative set of real user tasks or transcripts
CI or local runner where eval suites can be executed repeatedly
Target web workflow with clear start and success states
Ability to run browser automation in local or CI environment
Access to auth/session strategy if login is required