Skills

Skills are reasoning frameworks defined as Markdown. Each skill is a directory in skills/ containing a SKILL.md file.

skills/
├── triage/
│   └── SKILL.md
├── deep-dive/
│   └── SKILL.md
└── incident-response/
    └── SKILL.md

SKILL.md Format

Two formats are supported:

Heading-based (recommended)

# Skill: Incident Response
 
Gather context, assess impact, and coordinate response for active incidents.
Trigger: When the user reports an outage, service degradation, or active incident.
 
## Behavior
 
1. Identify the affected service and symptoms
2. Assess blast radius — which systems and users are impacted?
3. Gather context:
   - Recent deployments or config changes
   - Monitoring metrics (error rates, latency)
   - Dependent service health
4. Correlate: what changed right before the incident?
5. Recommend immediate mitigation and investigation path
 
## Constraints
 
- Do not restart services without explicit user confirmation
- Do not dismiss alerts as false positives without evidence

Frontmatter-based

---
name: incident-response
description: Gather context, assess impact, coordinate response
trigger: When the user reports an outage or active incident
---
 
## Methodology
 
...body content...

Parsed Fields

Field	Source	Description
`name`	`# Skill: Name` or frontmatter `name`	Skill identifier
`description`	First paragraph or frontmatter `description`	What the skill does
`trigger`	`Trigger:` line or frontmatter `trigger`	When to activate
`body`	Everything after name/description	The methodology

Skill Activation

The agent sees all installed skill names and triggers. It activates the most relevant skill based on the user's question. Skills chain naturally — the agent transitions between frameworks as findings evolve.

Best Practices

Be specific about reasoning steps. Not "investigate the issue" but "query deployment logs for changes within 30 minutes of the anomaly."
Include decision points. "If no deployments found, check for scaling events."
Specify dispatching. "Dispatch a task agent to query Datadog" uses context isolation.
Define when to stop. "If confidence is below 60%, report as inconclusive."