dt-obs-genai

Distributed traces, spans, service dependencies, and request flow analysis. Use when investigating span-level details, failures, performance bottlenecks, or trace correlation. Trigger: "trace analysis", "slow requests", "failed spans", "service dependencies", "distributed trace", "span details", "HTTP status codes in traces", "database query spans", "messaging spans", "gRPC calls", "Lambda cold starts", "trace ID lookup", "exception analysis", "correlate logs and traces", "request attributes". Do NOT use for explaining existing queries, product documentation or configuration questions, service-level RED metrics (use dt-obs-services), log searching (use dt-obs-logs), or problem analysis (use dt-obs-problems).

Hunt threat-intelligence indicators of compromise (IoCs) across Dynatrace logs and spans and produce a 0-100 threat-exposure score. Extracts and normalizes IoCs — IPs, Domains (hostnames included), URLs, Emails, CVEs, File hashes (md5/sha1/sha256), MITRE TTPs — from unstructured reports, advisories, advisory URLs, pasted text, or STIX, then hunts them in fetch logs and fetch spans. Trigger: hunt these IoCs, am I exposed to this threat or ingested reports, check these indicators in my logs and traces, threat exposure report, extract IoCs from this advisory URL, search these hashes/domains/IPs in my environment. Also investigates repeated detections: same source IP across many targets, same rule re-firing on one object. Do NOT use for: generic security.events retrieval (vulnerabilities, detections, compliance, THREAT_REPORT — use dt-sec-insights); general log queries not tied to an IoC hunt (use dt-obs-logs); general span/trace analysis (use dt-obs-tracing); explaining DQL syntax (use dt-dql-essentials).

Query Dynatrace security.events with DQL: vulnerabilities, threat detections, compliance posture. Covers Dynatrace-native Runtime Vulnerability Analytics (RVA — CVEs, reachability, exploit), Runtime Application Protection (RAP), Automated Detections, Security Posture Management (KSPM/CSPM), Dynatrace vulnerability feed, external tools. Trigger: "open critical vulnerabilities", "vulnerable functions in use and exposed", "top vulnerable libraries / K8s workloads", "vulnerabilities on this host", "CIS/DORA compliance pass rate", "SQL injection detections", "does Dynatrace know CVE-X / how is it fixed", "what is DTV-…", "new in the feed", "exploited in the wild (KEV)". Do NOT use for scan coverage, mapping external findings to workloads / entity mapping, or RVA verification of external findings (use dt-sec-contextualization), explaining DQL (dt-dql-essentials), Davis problems (dt-obs-problems), logs (dt-obs-logs), tracing (dt-obs-tracing), service metrics (dt-obs-services), platform audit (dt-platform).

Resolve security signals, IoC matches, or Smartscape nodes to runtime entities, connect findings across entity levels, verify external findings against RVA on the same entity, and measure scan coverage against a Smartscape denominator. Covers identity mapping, RVA id resolution, K8s pod vs. node CVE topology, AI-service vulnerabilities, coverage counts. Trigger: "map these findings to workloads/hosts", "which workload does this image run as", "is this scanner finding also detected by RVA on a running workload", "which AI services have vulnerabilities", "enrich this IoC match", "which report mentions this IoC", "hosts not covered by scanning". Queries security.events only for THREAT_REPORT IoC enrichment, coverage numerators, joining supplied findings, RVA verification, and AI-service findings. Do NOT use for broad posture, rankings, or an entity's vulnerabilities (dt-sec-insights), general DQL (dt-dql-essentials), IoC hunting in logs/spans (dt-sec-ioc-hunting), K8s observability (dt-obs-kubernetes).

Query and analyze a Dynatrace tenant's ACTUAL billing and usage data with DQL on dt.system.events — DPS consumption breakdown, cost-normalized spend ranking, included volume deduction, chargeback/showback, cost drivers, spending trends, cost investigation, log import cost, metrics ingest optimization, drop/remove a metric or dimension from ingestion, reduce metric cardinality, metric usage, query cost attribution, workflow total cost, entity cost drill-down (RUM, hosts, synthetic, K8s), AI/LLM cost (AI Units, AI Function Standard Calls). Directs licensing/entitlement questions (am I entitled to use X?) to docs (not via DQL). USE ONLY for the tenant's actual consumption. Do NOT use for conceptual 'explain' questions about how DPS billing/pricing works or what units/weights/the rate card mean — see Dynatrace docs. Do NOT use for tuning DQL queries to be faster or cheaper to run (query optimization, reducing scanned data/consumption per run, filter-early best practices) — that belongs to dt-dql-essentials.

DAVIS problem analysis including root cause identification, impact assessment, and correlation with other telemetry. Use when querying or investigating detected problems. Trigger: "active problems", "root cause analysis", "problem impact", "affected users", "list problems", "P-12345 details", "recurring problems", "problem history", "problem trending", "blast radius", "which entity caused the problem", "problems affecting Kubernetes", "problems by service". Do NOT use for explaining existing queries, product documentation questions, generic log searching, distributed tracing, or host-level resource monitoring.

Network flow analysis in Dynatrace across three sources: OneAgent flows (host/process/pod-to-peer connections in the `default_network_flows` Grail bucket), NetFlow/IPFIX/sFlow (via an OpenTelemetry Collector), and cloud flow logs (AWS VPC / Transit Gateway; Azure and GCP planned). Use to analyze traffic between entities, find top talkers by bandwidth, map communication dependencies, investigate connection health (resets, timeouts, retransmissions, RTT), and resolve peers to monitored entities. Routes each question to the right source; source-specific DQL lives in the reference files. Trigger: "network flows", "top talkers", "traffic between hosts", "connection resets", "TCP retransmissions", "RTT", "pod connections", "network dependencies", "NetFlow", "IPFIX", "sFlow", "VPC flow logs", "cloud network traffic". Do NOT use for host NIC throughput or packet drops (use dt-obs-hosts), service request rate or latency (use dt-obs-services), or synthetic/uptime monitoring (use dt-obs-ext-monitors).

Predictive analytics for Dynatrace — time series forecasting with the timeseries-forecast tool, capacity saturation planning, trend and anomaly detection across hosts, services, and infrastructure.

Scan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.

Diagnosis loop for hard bugs and performance regressions. Use when the user says "diagnose"/"debug this", or reports something broken/throwing/failing/slow.

Review the changes since a fixed point (commit, branch, tag, or merge-base) along two axes: Standards (does the code follow this repo's documented coding standards?) and Spec (does the code match what the originating issue/spec asked for?). Runs both reviews in parallel sub-agents and reports them side by side. Use when the user wants to review a branch, a PR, work-in-progress changes, or asks to "review since X".

Investigate a question against high-trust primary sources and capture the findings as a Markdown file in the repo. Use when the user wants a topic researched, docs or API facts gathered, or reading legwork delegated to a background agent.

This skill should be used when the user wants to "write agent code", "build an agent with ADK", "add a tool", "create a callback", "define an agent", "use state management" — in a project that needs ADK (Agent Development Kit) API patterns and code examples. It provides a quick reference for agent types, tool definitions, orchestration patterns, callbacks, state management, the graph Workflow API, and reference recipes to study. Do NOT use for scaffolding (use google-agents-cli-scaffold) or deployment (use google-agents-cli-deploy).

Set up Claude Code hooks to block dangerous git commands (push, reset --hard, clean, branch -D, etc.) before they execute. Use when user wants to prevent destructive git operations, add git safety hooks, or block git push/reset in Claude Code.

Generate AI music on RunComfy via the `runcomfy` CLI — a smart router across the music-model catalog. Routes to ElevenLabs AI Music Generation (premium 44.1 kHz stereo vocal tracks, 5 s–5 min, $0.0083/s) and ACE Step / ACE Step 1.5 (StepFun-AI open-weights, tag-driven composition, multilingual lyrics, $0.0002–0.0003/s, ~27× cheaper), plus ACE Step audio-inpaint (regenerate a time range inside an existing track) and ACE Step audio-outpaint (extend a track before or after). Picks the right model for the user's actual intent — premium vocal hook, cheap background music library, multilingual pop song, repair a bad chorus, lengthen a 30 s draft into a 2 min cut — and ships each model's documented prompting patterns plus the minimal `runcomfy run` invoke. Triggers on "generate music", "make a song", "AI music", "background music", "instrumental track", "soundtrack", "jingle", "theme music", "royalty-free music", "compose", "music with lyrics", "extend music", "fix this song", "inpaint music", or any explicit ask to generate or edit music.

创建 lark-cli 的自定义 Skill。当用户需要把飞书 API 操作封装成可复用的 Skill（包装原子 API 或编排多步流程）时使用。