Use when you need to find the root cause of an incident, outage, or regression systematically – reconstruct a timeline, correlate with recent changes, test multiple hypotheses in parallel, and produce an evidence-backed root-cause writeup instead of a guess.
Use when you need to find the root cause of an incident, outage, or regression systematically - reconstruct a timeline, correlate with recent changes, test multiple hypotheses in parallel, and produce an evidence-backed root-cause writeup instead of a guess.This is the skill's description: the text your AI reads to decide when the skill applies.
devops-incident-rca/SKILL.md
---
name: incident-rca
description: Use when you need to find the root cause of an incident, outage, or regression systematically — reconstruct a timeline, correlate with recent changes, test multiple hypotheses in parallel, and produce an evidence-backed root-cause writeup instead of a guess. For methodical RCA and blameless postmortems, not instant symptom lookup.
---
# incident-rca
A discipline for getting from "something broke" to a *named, evidence-backed root
cause* — and a fix that prevents recurrence. The enemy is the plausible-but-wrong
story: the first explanation that fits is often a symptom, a trigger, or a
coincidence, not the cause. This skill forces the rigor that catches that.
## When to use
- An incident/outage/regression needs a real root cause, not "we restarted it and
it went away"
- Writing a blameless postmortem
- "Why did this happen?" where the answer isn't obvious and guessing is expensive
- Multiple competing explanations and you need to decide between them with evidence
**When *not* to use:** a known symptom with a known lookup path (use the relevant
triage skill, e.g. `k8s-triage`); or a one-glance fix. RCA is for when the cause is
genuinely unclear.
## The method… load the full skill through Skill Me