Span-specific concepts, fields, duration handling, and investigation patterns. Load when you need to explore spans in your investigation or to answer a question about spans. For service-level error rate, latency percentiles, throughput, or health, load the `coralogix-service-catalog` skill instead — it is the pre-aggregated path for those; use this skill when you need individual traces, span attributes, or span-level detail the catalog does not expose. Always load the `coralogix-dataprime` skill together with this one before writing any query.
13711d agoReviewMountCreate a free account to mount
Guidelines for investigating production incidents in the CRM application. Use when triaging any alert or incident involving the CRM REST API, SQS queues, Lambda functions, or Aurora DSQL database in this AWS account. Ensures thorough root cause analysis using AWS-native observability tools.
13711d agoReviewMountCreate a free account to mount
Database-level data-plane diagnostics for Aurora MySQL and Aurora PostgreSQL. Executes predefined read-only health check queries via RDS Data API to analyze buffer pool, connections, locks, replication, storage, performance, and index efficiency. Requires the rds-aidba MCP server for database-internal access beyond what CloudWatch and RDS APIs provide.
13711d agoReviewMountCreate a free account to mount
Report what the AWS DevOps Agent itself costs to run, and where that cost comes from, per Agent Space and per role on demand in chat or on a schedule through a custom agent. Use this skill when a user asks to measure, break down, attribute, explain, or forecast DevOps Agent spend, or the cost of the downstream AWS API calls. Covers direct agent time by activity, Support plan credit offset, downstream API cost, and tool usage.
13711d agoReviewMountCreate a free account to mount
Performs a comprehensive Amazon ECS operations review across the 6 review pillars (Resiliency & HA, Observability, Security, Operations, Performance, Additional Analysis) using read-only AWS APIs, with a 7-day CloudWatch metrics baseline, recommended alarm thresholds for IDR onboarding, per-pillar PASS/FAIL/N/A scorecards, and a prioritized, remediation-linked report artifact. Triggers on: "ECS operations review", "ECS assessment", "ECS review", "review my ECS service", "ECS reliability review", "ECS security review", "ECS best practices audit", "review ECS services for a workload".
13711d agoReviewMountCreate a free account to mount
Automatically load this skill when investigating application outages, service degradation, or errors that could have security-related root causes — including unexplained downtime, authentication or authorization failures, injection attacks, data exposure, or suspicious application behavior. Query AWS Security Agent CloudWatch logs to retrieve detailed code review findings with actionable, low-level details (file, line number, vulnerability type) that customers can directly fix.
13711d agoReviewMountCreate a free account to mount
Comprehensive Amazon Data Firehose (formerly Kinesis Data Firehose) review aligned with the AWS Well-Architected Framework and Firehose best practices. Use this skill when a user asks to review, audit, or assess Amazon Data Firehose delivery streams for best-practices compliance, security posture, reliability, delivery health, performance, cost optimization, service quotas, operational excellence, or sustainability. Triggers on requests like "Firehose review", "Kinesis Firehose best practices audit", "review my delivery streams", "Firehose health check", "why is my Firehose lagging", "Firehose delivery failures", "Firehose cost optimization review", or "ORR for Firehose".
13711d agoReviewMountCreate a free account to mount
Use the Grafana Cloud connector to investigate incidents with the customer's Grafana Cloud telemetry. Covers choosing tools, when to use Grafana Assistant, the Read, Query and Write access levels, confirming every write with the operator, keeping results small, and querying Prometheus, Loki and Tempo data. Use when an investigation needs metrics, logs, traces or profiles from Grafana Cloud, when checking Grafana dashboards, alert rules, incidents or on-call schedules, or when the customer asks a question about their Grafana Cloud stack.
13711d agoReviewMountCreate a free account to mount
Load when the operator asks for a Honeycomb board or dashboard: a board for a service, a feature, or an incident, a golden signals dashboard, or a board to visualize service health. Designs the board from SLOs and queries, shows the full plan to the operator, and calls create_board only after the operator approves it.
13711d agoReviewMountCreate a free account to mount
Load before querying a Honeycomb OpenTelemetry metrics dataset (dataset_type=metrics): gauges, counters, histograms and sums, including infrastructure metrics such as CPU, memory, disk I/O and network. Metrics follow different rules from trace datasets: bare COUNT, RATE_SUM, RATE_AVG, RATE_MAX and CONCURRENCY are rejected, temporal aggregation is automatic, and each metric has its own attributes. Not for event datasets that only have metrics in their name.
13711d agoReviewMountCreate a free account to mount
Load when the operator asks a conceptual question about observability or Honeycomb: what observability is, why wide events, what high cardinality or dimensionality means, events vs metrics vs logs, observability vs monitoring, or the core analysis loop. Grounds recommendations in first principles. Not for running queries or investigating a live issue.
13711d agoReviewMountCreate a free account to mount
Load when an investigation needs Honeycomb telemetry to find a root cause: a latency spike, an error surge, a deployment regression, a failing dependency or an SLO burning budget. Gives the order of Honeycomb MCP tool calls (orient, broad query, BubbleUp, trace drill-down, verification) and how to carry each result into the next step.
13711d agoReviewMountCreate a free account to mount
Load before building or reading a Honeycomb run_query on a trace, log or event dataset. Covers which operation to pick (percentiles and HEATMAP over AVG), relational fields (root., parent., any., none.), calculated fields, query math, and how to read results such as P99/P50 ratios, heatmap bands and TOTAL/OTHER rows. For datasets with dataset_type=metrics, use honeycomb-metrics-queries instead.
13711d agoReviewMountCreate a free account to mount
Load before calling Honeycomb get_slos or get_triggers, or when an investigation must judge SLO compliance, error budget burn or trigger status. Explains what the numbers mean, how to spot a misconfigured SLI, when a burn rate justifies paging or freezing deploys, and how to design burn alert thresholds.
13711d agoReviewMountCreate a free account to mount
Load when the operator asks to verify a recent test or deployment in Honeycomb, find the most recent trace, or show the trace a test produced. Finds the traces created since the test started and summarizes the most recent one.
13711d agoReviewMountCreate a free account to mount
A folder with a SKILL.md file: a name, a description of when to use it, and instructions. Claude loads a skill only when the task matches its description.
How do I use one I find here?
Copy the folder into your project's .claude/skills/ directory, or into your own skills folder to use it everywhere.
What do the warnings mean?
We read each file for commands that read secrets, delete things or pipe downloads into a shell, and say so before you copy it. No warning is not a promise that a file is safe.
Which skills worked for people?
Open a skill to see its discussion. Reports from people and their agents are coming.
AWSSkill