How this skill is triggered — by the user, by Claude, or both
Slash command
/milo-activity:investigateThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
<!-- Manual slash-command entry point: /milo-activity:investigate <description>
Investigate the following incident:
$ARGUMENTS
Start by establishing the time window and scope from the description above. If no time window is specified, default to the last 1 hour. If no namespace or resource is specified, search across all namespaces.
Follow your investigation methodology and return a structured report with timeline, key actors, failures, root cause hypothesis, and next steps.
npx claudepluginhub datum-cloud/claude-code-plugins --plugin milo-activityAnalyzes incidents with a blameless post-mortem: build timeline, identify root causes, suggest improvements. Use after production incidents or recurring issues.
Classifies incidents by severity (SEV1-4), constructs timelines, assesses impact, performs 5 Whys root cause analysis, and generates blameless post-mortems for production issues.
Activate for: incident, outage, system failure, post-mortem, incident post-mortem, root cause analysis, RCA, five whys, corrective action, lessons learned, incident log, incident report, P1, P2, major incident, incident review, incident timeline, what went wrong, service outage, payment failure, data breach incident, incident response, MTTD, MTTR, incident management, on-call, escalation, incident retrospective, corrective action tracker, lessons learned brief. NOT for: change impact assessment (use official /change-request), risk register building (use official risk-assessment auto-skill), compliance obligation mapping (use official compliance-tracking auto-skill).