Read and, after human approval, update the Linear `incident-alert` knowledge base. Use before and after investigating a named Datadog monitor, incident.io alert or incident, or on-call page to find or record root causes.
SkillScore73Maintained
Automatic
◆DevOps & SRE pack
Last verified 9/27/2026
What it changes
Passed 14 of 19 test cases with the skill, and 9 of 19 without it.
Without skill45%
With skill73%
Checks it passed that the model alone missed
Assign the incident-alert label to the ticket.
Include sub-sections for Recognize it, How urgent, and Fix.
Apply label AI edited to the appended ticket upon approval.
and 7 more in the full report
6 fixed10 passed either way6 still failing0 broke
Pass-rate lift
+27 pp
Tokens
+42%
Agent turns
0%
Response time
-48%
Model gemini-3.6-flashMeasured 9/27/2026v316 of 22 cases passed with skill · 19 comparable
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 6 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 6
Prompt
We identified a new cause on an existing ticket for `mon-102` that requires appending a block. What exact text format should be put in the 'Action' column of the write-back proposal table before human approval is granted?
What was checked, without and with the skill
Checked
Without skill
With skill
Set the Action column status to awaiting your go-ahead prior to approval.
Missed
Passed
case-14 · gemini-3.6-flash · 9/27/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md130 linessingle file
Incident Alert Tickets
Incident-alert tickets turn on-call debugging into searchable knowledge: one
Linear ticket per production alert/monitor, one dated section per distinct
root cause. This skill owns lookup, comparison, and the human-gated
write-back; calling skills own the investigation itself. The team SOP is the
Linear document titled "Incident Alert Tickets".
When to Apply
Apply whenever the task is anchored to an alert identity:
a Datadog monitor ID or title,
an incident.io alert or INC reference,
an on-call page ("we got paged for X").
Do not try to detect "incident mode" — the presence of a named alert is the
condition, because the monitor is the ticket key. When an alert identity is
present, the lookup is mandatory; recording is offered after the investigation
and gated on human approval. A customer report or code question with no alert
identity skips this skill.
When multiple alerts fire together (a cascade), run lookup, compare, and
classify for each alert identity — every monitor has its own ticket. If
one root cause explains several alerts, write the full cause section on the
monitor closest to the cause and propose a short dated section on the other
monitors' tickets that links to it.
Ticket Contract
One ticket per monitor (per env when monitors are per-env), titled
[ENV] <Monitor title>, in the Engineering (LFE) team, carrying the
incident-alert label. The label set is the knowledge base.
Regional twins of one monitor (same metric and threshold per env) may share
a single ticket titled [ENV1/ENV2] <Monitor title> when the causes are
region-independent; list each env's monitor ID in the alert header.
The description opens with an alert header: monitor ID, trigger condition,
and how it surfaces (incident.io urgency, auto-resolve behavior).
One dated section per distinct root cause, separated by ---: