kopai/root-cause-analysis
Investigate and root-cause production issues from live OpenTelemetry telemetry (traces, logs, metrics) with the Kopai SDK in TypeScript code mode. Use this skill to debug errors and error-rate spikes, investigate latency/slowness and timeouts, trace requests across services, find failing or cascading services, and correlate logs to a trace — including vague symptom reports like 'why is my API slow', 'getting 500 errors', 'service is down', 'requests are timing out', or 'something is failing in prod', even when the user never says 'traces' or 'observability'. This analyzes existing telemetry to find a cause. Do NOT use it to add instrumentation (use otel-instrumentation), to build dashboards or visualizations (use create-dashboard), or to fix non-telemetry problems like failing CI, lint errors, unit tests, or SQL query tuning.
91%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
Low
Low-risk findings worth noting
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
The workflow queries live OpenTelemetry traces, logs, and metrics stored in Kopai, which ingest unstructured application telemetry and log messages authored by external users or systems.
Where we found it
http://localhost:8000
url · 1 site
The plugin connects to a Kopai backend via the @kopai/sdk, reading the URL from .kopairc (defaulting to http://localhost:8000), and queries live OpenTelemetry traces, logs, and metrics which may contain unstructured content from external users/systems.
SKILL.md
28
// Reads ./.kopairc then ~/.kopairc; defaults to http://localhost:8000.
- Audited
- Security analysis