How do I install the Ops Detection Incident Routing skill?

Run npx skillmds@latest add modbender/ops-detection-incident-routing in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Ops Detection Incident Routing safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: executes scripts. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Ops Detection Incident Routing?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Ops Detection Incident Routing free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Ops Detection Incident Routing?

modbender (@modbender) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Ops Detection Incident Routing by modbender

Name: Ops Detection Incident Routing
Rating: 4.2 (5 reviews)
Author: modbender

Ops Detection Incident Routing

Detect agent runtime anomalies and route incidents through approval-safe guardrails. Use when you need deterministic checks for cron failures, context pressure, dangling sessions, token spikes, and a controlled incident workflow (detect -> route -> investigate -> remediate).

modbender Updated Sep 9, 2026 12 repo stars

File contents

ops-detection-incident-routing

Run deterministic operations checks and route incidents with guardrails.

This skill ships a small toolkit for:

detecting runtime anomalies from local state/log files
applying in-flight + cooldown guards
emitting structured incident actions for investigator/remediator flows

Use This Skill

Use this skill when you need a production-safe ops loop for agent systems and do not want ad-hoc prompt-only monitoring.

Files

scripts/ops-threshold-detector.sh reads session/cron/snapshot state and appends detector JSONL events
scripts/incident-guard-check.sh checks in-flight/cooldown guard status for a check id
scripts/incident-state-update.sh updates guard state for start/complete/fail transitions
scripts/ops-incident-router.sh converts detector alerts into structured actions
scripts/ops-detector-cycle.sh detector + router cycle runner
scripts/setup.sh dependency checks + local example scaffold
scripts/clean-generated.sh removes generated .jsonl and lock artifacts before republishing from a used folder

Setup

bash scripts/setup.sh

Quick Start

Run one full dry-run cycle:

bash scripts/ops-detector-cycle.sh \
  --workspace "$(pwd)/examples/workspace" \
  --state-file "$(pwd)/examples/incident-state.json" \
  --detector-out "$(pwd)/examples/ops-detector.jsonl" \
  --router-out "$(pwd)/examples/router-actions.jsonl"

Run live mode (router also acquires in-flight locks):

bash scripts/ops-detector-cycle.sh \
  --workspace "$(pwd)/examples/workspace" \
  --state-file "$(pwd)/examples/incident-state.json" \
  --detector-out "$(pwd)/examples/ops-detector.jsonl" \
  --router-out "$(pwd)/examples/router-actions.jsonl" \
  --live

Output Contract

Detector writes one JSON line per run:

{
  "ts": "2026-02-24T02:30:00Z",
  "status": "ALERT",
  "checks": 5,
  "alerts": [{"sev":"Sev-2","trigger":"cron_failure","value":2,"threshold":0}],
  "gaps": []
}

Router emits one JSON action per alert decision:

{"action":"spawn","check_id":"cron_failure","severity":"Sev-2","mode":"dry-run","task":"Investigate incident: cron_failure"}

Operational Pattern

schedule ops-threshold-detector.sh (every 5-15 min)
feed the latest detector line to ops-incident-router.sh
spawn investigator/remediator only from router output
keep remediation behind explicit owner approval

For details, read references/architecture.md.

---name: ops-detection-incident-routingdescription: Detect agent runtime anomalies and route incidents through approval-safe guardrails. Use when you need deterministic checks for cron failures, context pressure, dangling sessions, token spikes, and a controlled incident workflow (detect -> route -> investigate -> remediate).--- # ops-detection-incident-routing Run deterministic operations checks and route incidents with guardrails. This skill ships a small toolkit for: 1. detecting runtime anomalies from local state/log files 2. applying in-flight + cooldown guards 3. emitting structured incident actions for investigator/remediator flows ## Use This Skill Use this skill when you need a production-safe ops loop for agent systems and do not want ad-hoc prompt-only monitoring. ## Files - `scripts/ops-threshold-detector.sh` reads session/cron/snapshot state and appends detector JSONL events - `scripts/incident-guard-check.sh` checks in-flight/cooldown guard status for a check id - `scripts/incident-state-update.sh` updates guard state for start/complete/fail transitions - `scripts/ops-incident-router.sh` converts detector alerts into structured actions - `scripts/ops-detector-cycle.sh` detector + router cycle runner - `scripts/setup.sh` dependency checks + local example scaffold - `scripts/clean-generated.sh` removes generated `.jsonl` and lock artifacts before republishing from a used folder ## Setup ```bash bash scripts/setup.sh ``` ## Quick Start Run one full dry-run cycle: ```bash bash scripts/ops-detector-cycle.sh \ --workspace "$(pwd)/examples/workspace" \ --state-file "$(pwd)/examples/incident-state.json" \ --detector-out "$(pwd)/examples/ops-detector.jsonl" \ --router-out "$(pwd)/examples/router-actions.jsonl" ``` Run live mode (router also acquires in-flight locks): ```bash bash scripts/ops-detector-cycle.sh \ --workspace "$(pwd)/examples/workspace" \ --state-file "$(pwd)/examples/incident-state.json" \ --detector-out "$(pwd)/examples/ops-detector.jsonl" \ --router-out "$(pwd)/examples/router-actions.jsonl" \ --live ``` ## Output Contract Detector writes one JSON line per run: ```json { "ts": "2026-02-24T02:30:00Z", "status": "ALERT", "checks": 5, "alerts": [{"sev":"Sev-2","trigger":"cron_failure","value":2,"threshold":0}], "gaps": [] } ``` Router emits one JSON action per alert decision: ```json {"action":"spawn","check_id":"cron_failure","severity":"Sev-2","mode":"dry-run","task":"Investigate incident: cron_failure"} ``` ## Operational Pattern 1. schedule `ops-threshold-detector.sh` (every 5-15 min) 2. feed the latest detector line to `ops-incident-router.sh` 3. spawn investigator/remediator only from router output 4. keep remediation behind explicit owner approval For details, read `references/architecture.md`.

Frequently asked questions