Use when scoping a chaos engineering experiment before running it: a steady-state hypothesis, real-world faults (latency, node or region failure), blast radius, automation and the verdict, with a five-check validation of the hypothesis and LitmusChaos and Gremlin setup. Chaos Mesh has its own skill.
92%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
Passed
No findings from the security scan
Deep reference for gremlin.md. Consult when picking a specific attack, chaining attacks into a Scenario, wiring Gremlin into CI, reading the Reliability Score, or satisfying an audit / compliance requirement.
Per gremlin-home:
Per gremlin-home and the broader Gremlin docs, the four attack classes expand into these individual attacks:
| Class | Attack | Effect |
|---|---|---|
| Resource | CPU | Spike CPU usage |
| Resource | Memory | Spike memory |
| Resource | Disk I/O | Spike disk I/O |
| Resource | Disk space | Fill disk |
| Network | Latency | Inject latency |
| Network | Packet loss | Drop packets |
| Network | DNS | DNS resolution failure |
| Network | Blackhole | Drop all packets to/from a target |
| State | Shutdown | Reboot the host |
| State | Process killer | Kill a specific process |
| State | Time travel | Skew the system clock |
| Request | Request injection | Modify HTTP requests in flight |
Web UI workflow:
The UI provides safety: blast-radius scoping, abort button, notifications.
A Scenario chains multiple attacks:
# Pseudo-Scenario config (Gremlin's UI exports JSON; this approximates)
scenario:
name: "Checkout resilience test"
attacks:
- type: latency
target: { service: checkout }
length: 5min
latency: 500ms
- type: packet-loss
target: { service: payment }
length: 5min
loss-percent: 10
delay-after-previous: 1min
abort_conditions:
- "Sentry error rate > 2%"
- "Manual abort"Scenarios match per the chaos-experiment-author
"vary real-world events" principle - combinations approximate real
incidents.
Per gremlin-home, Gremlin's differentiator is the "Reliability Score" - "individual services" get scores "based on dependency mapping, risk detection, and failure testing."
Score components (per Gremlin docs):
A service moving from "untested" to "score 80" via passing attacks creates an objective improvement signal.
Trigger an attack directly from the API:
curl -X POST "https://api.gremlin.com/v1/attacks/new" \
-H "Authorization: Key $GREMLIN_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"command": {
"type": "latency",
"args": ["-l", "300", "-m", "500", "-c", "5", "-h", "^api\\.example\\.com$"]
},
"target": {
"type": "Random",
"containers": { "labels": { "app": "checkout" } }
}
}'The API enables CI integration - trigger a saved Scenario, wait for it to run, then evaluate a monitoring-driven verdict:
- name: Trigger Gremlin scenario
run: |
curl -X POST "https://api.gremlin.com/v1/scenarios/${{ vars.SCENARIO_ID }}/runs" \
-H "Authorization: Key ${{ secrets.GREMLIN_API_KEY }}"
- name: Wait + verdict
run: sleep 600 && ./scripts/datadog-verdict.shGremlin's enterprise tier (per gremlin-home's positioning) provides:
Important for regulated industries where audit is non-negotiable.
chaos-experiment-author - methodology Gremlin Scenarios implement.