How do I install the Root Cause Alert skill?

Run npx skillmds@latest add kinarasystems/root-cause-alert in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Root Cause Alert safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Root Cause Alert?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Root Cause Alert free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Root Cause Alert?

kinarasystems (@kinarasystems) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Root Cause Alert by kinarasystems — Agent Skill

Name: Root Cause Alert
Author: kinarasystems

Root Cause Alert

Root-cause a specific incident/alert in a Sauble-curated environment (device/site/client symptoms). Sauble-curated environments only — for playground / bring-your-own-source environments where you connected your own MCP sources, use the correlate skill instead.

kinarasystems Updated Sep 22, 2026

File contents

Root-cause an alert in a Sauble-curated environment

When to use

A specific incident or alert in a Sauble-curated environment — a device, site, or client symptom to diagnose. For open-ended "how healthy is my network?" questions in such an environment, use investigate instead.

Not for playground / bring-your-own-source environments. If you connected your own MCP data sources, run_rca returns no data — use the correlate skill instead. Run connect-and-verify if you're unsure which kind of environment you have.

How to run

Call run_rca. Compose the arguments from what the user gives you:

incident_summary (required) — a specific, concrete symptom, not a vague phrase.
Optional: severity (Critical/Major/Minor), serial (device/AP), site_id (venue/site), client (MAC), start_time/end_time (ISO; defaults to the last 15 minutes).
Leave transformer_type = KIC and environment_id defaulted unless the user specifies otherwise.
wait defaults to true (blocks and returns the analysis). Tell the user it runs ~2–3 min.

The returned session_id can be re-fetched later with get_rca_session.

If a tool name or argument here differs from the server's live tool list, trust the live definitions (you can see them) and run /plugin marketplace update to refresh this pack.

How to present results

Use a clean structure — Root cause → Key findings → Recommended actions → session id. Do not dump raw JSON. On error, surface it plainly:

402 → out of Sauble credits.
403 → the token lacks analysis:create (run connect-and-verify to confirm).

Example prompts

"Root-cause: AP 903cb32d33f0 has DNS resolution failures, severity major."
"Why is site X dropping clients? Diagnose it."

---name: root-cause-alertdescription: Root-cause a specific incident/alert in a Sauble-curated environment (device/site/client symptoms). Sauble-curated environments only — for playground / bring-your-own-source environments where you connected your own MCP sources, use the correlate skill instead.---# Root-cause an alert in a Sauble-curated environment## When to useA specific incident or alert in a **Sauble-curated** environment — a device, site, or client symptom todiagnose. For open-ended "how healthy is my network?" questions in such an environment, use investigateinstead.**Not for playground / bring-your-own-source environments.** If you connected your own MCP data sources,`run_rca` returns no data — use the **correlate** skill instead. Run connect-and-verify if you're unsurewhich kind of environment you have.## How to runCall `run_rca`. Compose the arguments from what the user gives you:- `incident_summary` (required) — a specific, concrete symptom, not a vague phrase.- Optional: `severity` (Critical/Major/Minor), `serial` (device/AP), `site_id` (venue/site), `client` (MAC), `start_time`/`end_time` (ISO; defaults to the last 15 minutes).- Leave `transformer_type` = `KIC` and `environment_id` defaulted unless the user specifies otherwise.- `wait` defaults to `true` (blocks and returns the analysis). **Tell the user it runs ~2–3 min.**The returned `session_id` can be re-fetched later with `get_rca_session`.*If a tool name or argument here differs from the server's live tool list, trust the livedefinitions (you can see them) and run `/plugin marketplace update` to refresh this pack.*## How to present resultsUse a clean structure — **Root cause** → **Key findings** → **Recommended actions** → session id.Do not dump raw JSON. On error, surface it plainly:- 402 → out of Sauble credits.- 403 → the token lacks `analysis:create` (run connect-and-verify to confirm).## Example prompts- "Root-cause: AP 903cb32d33f0 has DNS resolution failures, severity major."- "Why is site X dropping clients? Diagnose it."

Frequently asked questions