---

name: incident-log-analysis description: Analyze the workshop application log from inside OpenShell and produce incident artifacts.

Incident Log Analysis

Use this skill for incident summaries, error spikes, latency patterns, and remediation recommendations.

Instructions

• Remember that the parent agent, subagent, Python process, and filesystem tools already run inside OpenShell.
• Treat /workshop/data/sample_app.log as the virtual source fixture, backed by /app/workshop/data/sample_app.log.
• Copy source data into /sandbox before analysis.
• Write Python scripts and generated files under /sandbox.
• Parse records before summarizing and compute counts by level, service, status, failing endpoint, slow requests, p95 latency, and first/last errors.
• Keep level=ERROR counts separate from HTTP 5xx counts, and do not assign an incident severity unless the participant provides a severity rubric.
• Write /sandbox/incident_summary.json and /sandbox/incident_report.md.
• Read the artifacts back before reporting success.
• Do not create or call a nested sandbox and do not expose credentials.

Report Shape

# Incident Report

## Executive Summary
## Evidence
## Timeline
## Suspected Cause
## Recommended Next Actions