Teach an SRE Agent Your Triage Procedure with Agent Skills

Your best on-call engineer triages in the same order every time: scope first, then workload state, then events, then a narrow look at the failing pods, and then a report in a format the team expects.

Most AI agents don't. They improvise a new approach on every incident, and the quality depends on the day.

This example gives an AURA agent your procedure as a markdown file. The agent reads only a short description of it until a request matches. Then it loads the full procedure, follows it step by step, and says which procedure it used.

TL;DR

• What it is: An AURA agent that loads step-by-step procedures from SKILL.md files on demand, following the open Agent Skills format.
• What ships with it: An incident-triage skill for Kubernetes. It covers five ordered steps and a fixed report format: Impact, Since, Cause, Evidence, and Next step.
• Why it's efficient: At startup, only each skill's name and description enter the agent's context. The full instructions load only when needed, so you can ship many skills without paying for them on every request.
• What it can change: Nothing, in this example. The Kubernetes MCP server runs read-only.
• What you need: kubectl access to a cluster, Node.js, and a model provider API key.
• Cost: AURA is free and open source (Apache 2.0). You pay only for your model usage.
• Source: examples/complete/skills-agent.toml and skills/incident-triage/SKILL.md

What this example does

1. Catalog at startup. AURA scans the skills directory. Each subfolder with a SKILL.md becomes one skill, and its name and description go into the agent's context.
2. Match. When a request matches a skill's description, such as "triage this outage," the agent calls load_skill.
3. Follow. The agent works through the loaded procedure in order, using its Kubernetes tools at each step.
4. Cite. The answer names the skill it followed.

The included incident-triage skill tells the agent to:

1. Establish scope. Identify the namespace and workload, and ask if none was given.
2. Check workload state. Note unhealthy pods, restart counts, and termination reasons.
3. Read recent events. Look for OOMKilled, CrashLoopBackOff, scheduling failures, image pull errors, probe failures, and node pressure.
4. Read pod output narrowly. Check only the unhealthy pods, and only the most recent 200 lines.
5. Report in a fixed format. If the evidence doesn't support a single cause, say so and list the two most likely candidates, with what would tell them apart.

Who it's for

Jobs to be done

• SRE lead: When a senior engineer has a reliable triage method, I want it captured where the agent will follow it, so newer engineers get the same quality first pass.
• On-call engineer: When I hand an incident to the agent, I want a report in our standard format, so I can paste it into the incident channel without rewriting it.
• Platform engineer: When we add procedures for databases, queues, or deploys, I want to add files rather than rewrite prompts, so the library grows without bloating every request.

Pain points it removes

• Improvised investigations. The agent follows a defined order instead of inventing one each time.
• Bloated system prompts. Procedures load only when relevant, instead of living in every request.
• Inconsistent reports. One fixed structure: Impact, Since, Cause, Evidence, Next step.
• Jumping to fixes. The skill says "do not skip ahead to a fix," and next steps stay read-only unless asked.
• Knowledge loss when people leave. Procedures live in version-controlled files.

What it replaces, and why it's better

The value it drives

• Consistent first response. Every incident gets the same structured investigation.
• Senior judgment at scale. One engineer's method reaches every shift.
• Lower token cost as the library grows. Only the matching skill is loaded.
• Faster handoffs. Reports arrive in the format the team already uses.

What to measure in a pilot: how often the agent loads the right skill, how many reports need rewriting before posting, and time from request to report.

Why AURA

• Production-tested. AURA started as Mezmo's internal harness for operating our own SaaS. Our engineering and SRE teams still use it in production, and it powers thousands of agent sessions each month in Mezmo's hosted platform.
• Open standards. Agent Skills for procedures, and MCP for tools.
• Composable. Skills combine with orchestration, Scratchpad, human approval, and retrieval in the same config.
• Runs inside your security boundary. Deploy in your own infrastructure, including air-gapped environments.
• Model-agnostic. OpenAI, Anthropic, Bedrock, Gemini, Ollama, or OpenRouter.

Start from where you are

• Already have runbooks? Turn the most-used one into a SKILL.md with a clear description of when to use it.
• Runbooks too long or too many for skills? Use a runbook knowledge base and keep skills for procedures.
• Running an agent team? Skill sources can be set per specialist. See orchestrated-worker-overrides.toml.
• Multiple skill libraries? Add more [[agent.skills.local]] sources. If two define the same skill name, the first one listed wins, and AURA logs a warning.

Look inside the config

The whole skills setup is one block, plus a sentence in the prompt:

[agent]
name = "SRE Assistant"
system_prompt = """
You are an SRE assistant with access to a Kubernetes cluster and a library
of skills. When a request matches a skill's description, call `load_skill`
first and follow the procedure it gives you before using cluster tools.
Cite which skill you followed in your answer.
"""

[[agent.skills.local]]
source = "examples/complete/skills"

And this is the top of the skill file itself:

---
name: incident-triage
description: Use when asked to triage, investigate, or diagnose a Kubernetes incident, outage, or unhealthy workload.
---
# Incident triage

Follow these steps in order. Do not skip ahead to a fix.

Try it in three steps

1. Install AURA (Linux or macOS):

curl -fsSL https://raw.githubusercontent.com/mezmo/aura/main/scripts/install.sh | bash

2. Start the Kubernetes MCP server in read-only mode:

npx -y kubernetes-mcp-server@latest --port 8081 --read-only

3. Set your model key, clone the repo, and run the example from the repo root, so the skills path resolves:

export OPENAI_API_KEY="sk-..."
git clone https://github.com/mezmo/aura.git && cd aura
aura --config examples/complete/skills-agent.toml

More detail: AURA skills docs.

Then ask: "Triage the unhealthy workload in the checkout namespace."

FAQ

What's an Agent Skill?

A folder with a SKILL.md file: a name, a description of when to use it, and instructions. AURA follows the open Agent Skills specification.

Does every skill cost tokens on every request?

Only its name and description. The full body loads when the agent calls load_skill.

Can the agent take action when following a skill?

Not in this example. The cluster tools are read-only, and the triage skill keeps next steps read-only unless the user asks for a fix. To allow actions, add write tools behind human approval.

How is a skill different from a runbook in a knowledge base?

A skill is a procedure the agent follows. A knowledge base is reference material the agent searches. Many teams use both.

Next steps

• Engineers: Clone the example, then write a second skill for a failure your team sees often.
• Leads: Ask your most experienced on-call engineer to write down their triage order. That's your first custom skill.
• Everyone: Join the AURA Slack community.