[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M699ZNT5B9DS72SBWEHFWX8C":3,"skill-same:01M699ZNT5B9DS72SBWEHFWX8C":78},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":41,"linkOnly":42,"markdownContent":43,"markdownBody":44,"frontMatter":45,"refName":55,"commitSha":56,"skillDirectory":57,"forksCount":58,"repositoryHtmlUrl":59,"repositoryHomepageUrl":6,"ownerHtmlUrl":60,"ownerBlogUrl":61,"ownerDescription":62,"updatedAt":63,"install":64,"resources":77},"01M699ZNT5B9DS72SBWEHFWX8C","rbac-audit",null,"Use when an operator or a scheduled task requests a periodic RBAC \u002F least-privilege audit of the Zava Learning resource group — enumerate the real role assignments effective on the group, correlate each identity against actual Activity-Log usage to find standing access that is never used, flag over-privileged and directly-assigned (versus group-governed) identities and stale troubleshooting access, and recommend least-privilege corrections. Read-only; produces findings for a report.","microsoft\u002Fsre-agent","microsoft","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F6154722?v=4","01M698VYDXZ6JW5WH3CRV650R8","Microsoft","01M699YP84JQDX8CY79ZD1TTEF",188,"MIT","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fsre-agent\u002Fblob\u002Fmain\u002Flabs\u002Fzava-learning\u002Fsre-config\u002Fagent-config\u002Fskills\u002Frbac-audit\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,9],"rbac audit","rbac","audit","use","when","for","scheduled","requests","usage","read-only","task","log","periodic","only","never","docs","find","access","learning","search","learn","identity","2026-11-10 10:12:30",false,"---\nmetadata:\n  api_version: azuresre.ai\u002Fv2\n  kind: Skill\nname: rbac-audit\ndescription: Use when an operator or a scheduled task requests a periodic RBAC \u002F least-privilege audit of the Zava Learning resource group — enumerate the real role assignments effective on the group, correlate each identity against actual Activity-Log usage to find standing access that is never used, flag over-privileged and directly-assigned (versus group-governed) identities and stale troubleshooting access, and recommend least-privilege corrections. Read-only; produces findings for a report.\ntools:\n  - RunAzCliReadCommands\n  - GetAzCliHelp\n  - SearchMemory\n  - ExecutePythonCode\n  - microsoft-learn_microsoft_docs_search\n---\n\n## Zava Learning — RBAC \u002F Least-Privilege & Access-Usage Audit\n\nResource Group: `@@RG@@`. **Read-only audit — never create, modify, or remove a role assignment.**\nThis is a weekly governance review of *who can do what here, and whether they actually use it*. The\ngoal is real least-privilege hygiene: surface over-privileged identities, direct (ungoverned)\nassignments, and **standing access that has gone unused** so a human can clean it up.\n\n### Identity naming policy (governance reports name their subjects)\nThe principals under audit (their display name \u002F UPN \u002F objectId and role) are the **subject** of this\nreport — show them; an RBAC finding that hides the identity is useless. This is NOT the learner-PII\nthe redaction standard protects. Still apply `SearchMemory(\"zava-redaction\")` `redact()` to strip any\n**secrets, tokens, credentials, or learner\u002Fcustomer PII** that happen to appear, and never print\nsecret values — but DO name the admins, service principals, and groups being audited.\n\n**Where the names come from (do NOT call Microsoft Graph):** take the identity name from the\n`principalName` field that `az role assignment list` already returns, plus `principalType`. Do **not**\nrun `az ad user\u002Fgroup\u002Fsp list|show` or `az rest https:\u002F\u002Fgraph.microsoft.com\u002F...` to resolve names or\nlook up guest\u002Fenabled status — the SRE Agent's managed identity has **no Graph directory-read\npermission**, so those calls fail with `Insufficient privileges` AND are gated as `PendingAuthorization`,\nwhich would stall this unattended weekly run. If a `principalName` is blank, identify that principal by\nits `principalId` (objectId) + `principalType` and note \"display name unavailable (directory lookup not\npermitted)\". A UPN containing `#EXT#` (when present in `principalName`) still indicates a guest.\n\n### 1. Enumerate the real assignments effective on the RG\n- All assignments scoped at or above the RG (this includes subscription\u002Fmanagement-group inheritance —\n  most access here is inherited):\n  `az role assignment list --scope \u002Fsubscriptions\u002F\u003Csub>\u002FresourceGroups\u002F@@RG@@ --include-inherited -o json`.\n- For each: capture `principalName`, `principalType` (User \u002F Group \u002F ServicePrincipal), `roleDefinitionName`,\n  `scope`, `description`, and `createdOn` where present. These fields are sufficient — everything you\n  need to name and classify a principal is already in this output; no follow-up directory calls.\n\n### 2. Correlate against ACTUAL usage (the key step, BEST-EFFORT)\nStanding access that is never exercised is the prime cleanup target. Pull who has actually operated in\nthis RG and join it to the assignment list:\n- The `-g` server-side filter on the activity log is unreliable here — query **subscription-wide** and\n  filter client-side on `resourceGroupName == @@RG@@`. Use a **bounded, valid** query (the API rejects\n  oversized requests with HTTP 400 \"Bad Request\"): a window of **30 days** and **`--max-events 1000`**,\n  e.g. `az monitor activity-log list --start-time \u003CUTC now-30d> --end-time \u003CUTC now> --max-events 1000 -o json`.\n  If that still 400s, halve the window (e.g. 7-14 days) and\u002For add `--query \"[].{c:caller,r:resourceGroupName,t:eventTimestamp}\"`.\n  Then keep events where `resourceGroupName` is the RG; aggregate distinct `caller` values (these are\n  UPNs or principal objectIds) with their last-seen timestamp.\n- A principal that **holds a privileged role but appears as no caller in the window** is\n  *standing-but-unused access* → recommend removal \u002F down-scoping. (Activity Log is control-plane,\n  ~90-day retention; state the window you actually used and note data-plane-only usage may not appear.)\n- **Usage correlation is best-effort and MUST NOT block the report.** If the activity-log query keeps\n  failing or returns nothing, do **not** retry indefinitely — after at most two adjusted attempts, record\n  \"usage data unavailable (control-plane query limit \u002F retention)\" against the affected identities and\n  **continue** to the findings table and the branded deck using the assignment, scope, identity-type,\n  and `createdOn`\u002F`description` signals alone. Finishing the audit with a clear caveat is required;\n  stalling on usage correlation is a failure.\n- Do **not** attempt Entra sign-in logs or any other Microsoft Graph query (e.g.\n  `az rest https:\u002F\u002Fgraph.microsoft.com\u002F...auditLogs\u002FsignIns`) — the agent identity is not permitted and\n  the call would stall on approval \u002F fail. Base usage purely on the Activity Log window above.\n\n### 3. Flag findings with impact-based severity (see `zava-audit-report` model)\n- **SEV1** — Owner \u002F User Access Administrator \u002F Contributor held **directly by a User** (not via a\n  group), especially with **no usage in the lookback window**; any privileged role on a **guest**\n  (`#EXT#` in `principalName`) or orphaned principal; a clearly **temporary \u002F break-glass** grant still present (telltale\n  `description` like \"temp\", \"break-glass\", \"INC-####\", \"troubleshooting\", or an old `createdOn`).\n- **SEV2** — an identity assigned **broader scope than needed** (privileged role at subscription\u002FMG\n  scope when only this RG is used), or a privileged role with **stale usage** (used long ago, not\n  recently); a direct privileged grant that should be **group-governed and PIM-eligible**.\n- **SEV3** — non-privileged direct assignment that should be group-governed; duplicate \u002F redundant\n  assignments; a standing role that should be converted to a **PIM eligible (just-in-time)** assignment.\n\n### 4. Recognise legitimate platform identities (avoid false positives)\nThis subscription carries first-party security & governance service principals — **do not flag them as\nrisky**; acknowledge them as expected. These include Microsoft Defender for Cloud, Azure Policy \u002F\nremediation, AzSecPack, Wiz (`Wiz*`), Illumio, Connected Machine \u002F Arc, Backup \u002F Recovery Services,\nand the SRE Agent's own managed identity and the platform's user-assigned identity (AcrPull, Key Vault\nSecrets User, Network Contributor for the agent). Note them in an \"expected platform identities\"\nappendix rather than the findings table. Focus the findings on **human users** and **non-platform**\nprincipals.\n\n### 5. Produce the findings + recommendations\nOne row per finding:\n`Identity (type) · Role · Scope (direct\u002Finherited) · Governance (direct\u002Fgroup) · Last used · Finding · Severity · Recommendation`.\nSort SEV1 → SEV3. Recommendations should be concrete least-privilege moves: remove unused standing\naccess; replace a direct user grant with **membership in a governed group**; convert standing\nprivileged grants to **PIM eligible (JIT)**; down-scope from subscription to the specific RG\u002Fresource;\nremove stale break-glass access. Also produce a posture summary (Healthy \u002F Needs attention \u002F At risk,\ncounts by severity, # of identities with privileged-but-unused access, the single most important\naction). Cite Azure least-privilege \u002F PIM guidance via `microsoft-learn_microsoft_docs_search`.\n\n### 6. Hand off to the branded report\nThis skill does not remediate. Pass the posture summary, the findings rows (each with its severity),\nand the recommendations to the `zava-audit-report` skill, which renders the single branded,\ndownloadable PowerPoint deck and returns its download link. Surface that link to the operator.\n","## Zava Learning — RBAC \u002F Least-Privilege & Access-Usage Audit\n\nResource Group: `@@RG@@`. **Read-only audit — never create, modify, or remove a role assignment.**\nThis is a weekly governance review of *who can do what here, and whether they actually use it*. The\ngoal is real least-privilege hygiene: surface over-privileged identities, direct (ungoverned)\nassignments, and **standing access that has gone unused** so a human can clean it up.\n\n### Identity naming policy (governance reports name their subjects)\nThe principals under audit (their display name \u002F UPN \u002F objectId and role) are the **subject** of this\nreport — show them; an RBAC finding that hides the identity is useless. This is NOT the learner-PII\nthe redaction standard protects. Still apply `SearchMemory(\"zava-redaction\")` `redact()` to strip any\n**secrets, tokens, credentials, or learner\u002Fcustomer PII** that happen to appear, and never print\nsecret values — but DO name the admins, service principals, and groups being audited.\n\n**Where the names come from (do NOT call Microsoft Graph):** take the identity name from the\n`principalName` field that `az role assignment list` already returns, plus `principalType`. Do **not**\nrun `az ad user\u002Fgroup\u002Fsp list|show` or `az rest https:\u002F\u002Fgraph.microsoft.com\u002F...` to resolve names or\nlook up guest\u002Fenabled status — the SRE Agent's managed identity has **no Graph directory-read\npermission**, so those calls fail with `Insufficient privileges` AND are gated as `PendingAuthorization`,\nwhich would stall this unattended weekly run. If a `principalName` is blank, identify that principal by\nits `principalId` (objectId) + `principalType` and note \"display name unavailable (directory lookup not\npermitted)\". A UPN containing `#EXT#` (when present in `principalName`) still indicates a guest.\n\n### 1. Enumerate the real assignments effective on the RG\n- All assignments scoped at or above the RG (this includes subscription\u002Fmanagement-group inheritance —\n  most access here is inherited):\n  `az role assignment list --scope \u002Fsubscriptions\u002F\u003Csub>\u002FresourceGroups\u002F@@RG@@ --include-inherited -o json`.\n- For each: capture `principalName`, `principalType` (User \u002F Group \u002F ServicePrincipal), `roleDefinitionName`,\n  `scope`, `description`, and `createdOn` where present. These fields are sufficient — everything you\n  need to name and classify a principal is already in this output; no follow-up directory calls.\n\n### 2. Correlate against ACTUAL usage (the key step, BEST-EFFORT)\nStanding access that is never exercised is the prime cleanup target. Pull who has actually operated in\nthis RG and join it to the assignment list:\n- The `-g` server-side filter on the activity log is unreliable here — query **subscription-wide** and\n  filter client-side on `resourceGroupName == @@RG@@`. Use a **bounded, valid** query (the API rejects\n  oversized requests with HTTP 400 \"Bad Request\"): a window of **30 days** and **`--max-events 1000`**,\n  e.g. `az monitor activity-log list --start-time \u003CUTC now-30d> --end-time \u003CUTC now> --max-events 1000 -o json`.\n  If that still 400s, halve the window (e.g. 7-14 days) and\u002For add `--query \"[].{c:caller,r:resourceGroupName,t:eventTimestamp}\"`.\n  Then keep events where `resourceGroupName` is the RG; aggregate distinct `caller` values (these are\n  UPNs or principal objectIds) with their last-seen timestamp.\n- A principal that **holds a privileged role but appears as no caller in the window** is\n  *standing-but-unused access* → recommend removal \u002F down-scoping. (Activity Log is control-plane,\n  ~90-day retention; state the window you actually used and note data-plane-only usage may not appear.)\n- **Usage correlation is best-effort and MUST NOT block the report.** If the activity-log query keeps\n  failing or returns nothing, do **not** retry indefinitely — after at most two adjusted attempts, record\n  \"usage data unavailable (control-plane query limit \u002F retention)\" against the affected identities and\n  **continue** to the findings table and the branded deck using the assignment, scope, identity-type,\n  and `createdOn`\u002F`description` signals alone. Finishing the audit with a clear caveat is required;\n  stalling on usage correlation is a failure.\n- Do **not** attempt Entra sign-in logs or any other Microsoft Graph query (e.g.\n  `az rest https:\u002F\u002Fgraph.microsoft.com\u002F...auditLogs\u002FsignIns`) — the agent identity is not permitted and\n  the call would stall on approval \u002F fail. Base usage purely on the Activity Log window above.\n\n### 3. Flag findings with impact-based severity (see `zava-audit-report` model)\n- **SEV1** — Owner \u002F User Access Administrator \u002F Contributor held **directly by a User** (not via a\n  group), especially with **no usage in the lookback window**; any privileged role on a **guest**\n  (`#EXT#` in `principalName`) or orphaned principal; a clearly **temporary \u002F break-glass** grant still present (telltale\n  `description` like \"temp\", \"break-glass\", \"INC-####\", \"troubleshooting\", or an old `createdOn`).\n- **SEV2** — an identity assigned **broader scope than needed** (privileged role at subscription\u002FMG\n  scope when only this RG is used), or a privileged role with **stale usage** (used long ago, not\n  recently); a direct privileged grant that should be **group-governed and PIM-eligible**.\n- **SEV3** — non-privileged direct assignment that should be group-governed; duplicate \u002F redundant\n  assignments; a standing role that should be converted to a **PIM eligible (just-in-time)** assignment.\n\n### 4. Recognise legitimate platform identities (avoid false positives)\nThis subscription carries first-party security & governance service principals — **do not flag them as\nrisky**; acknowledge them as expected. These include Microsoft Defender for Cloud, Azure Policy \u002F\nremediation, AzSecPack, Wiz (`Wiz*`), Illumio, Connected Machine \u002F Arc, Backup \u002F Recovery Services,\nand the SRE Agent's own managed identity and the platform's user-assigned identity (AcrPull, Key Vault\nSecrets User, Network Contributor for the agent). Note them in an \"expected platform identities\"\nappendix rather than the findings table. Focus the findings on **human users** and **non-platform**\nprincipals.\n\n### 5. Produce the findings + recommendations\nOne row per finding:\n`Identity (type) · Role · Scope (direct\u002Finherited) · Governance (direct\u002Fgroup) · Last used · Finding · Severity · Recommendation`.\nSort SEV1 → SEV3. Recommendations should be concrete least-privilege moves: remove unused standing\naccess; replace a direct user grant with **membership in a governed group**; convert standing\nprivileged grants to **PIM eligible (JIT)**; down-scope from subscription to the specific RG\u002Fresource;\nremove stale break-glass access. Also produce a posture summary (Healthy \u002F Needs attention \u002F At risk,\ncounts by severity, # of identities with privileged-but-unused access, the single most important\naction). Cite Azure least-privilege \u002F PIM guidance via `microsoft-learn_microsoft_docs_search`.\n\n### 6. Hand off to the branded report\nThis skill does not remediate. Pass the posture summary, the findings rows (each with its severity),\nand the recommendations to the `zava-audit-report` skill, which renders the single branded,\ndownloadable PowerPoint deck and returns its download link. Surface that link to the operator.\n",{"name":5,"tools":46,"metadata":52,"description":7},[47,48,49,50,51],"RunAzCliReadCommands","GetAzCliHelp","SearchMemory","ExecutePythonCode","microsoft-learn_microsoft_docs_search",{"kind":53,"api_version":54},"Skill","azuresre.ai\u002Fv2","main","f3dccc6bae8c932ff4f21e6d4117e14285da4db3","labs\u002Fzava-learning\u002Fsre-config\u002Fagent-config\u002Fskills\u002Frbac-audit",197,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fsre-agent","https:\u002F\u002Fgithub.com\u002Fmicrosoft","https:\u002F\u002Fopensource.microsoft.com","Open source projects and samples from Microsoft","2026-11-10 10:20:55",{"source":8,"skillName":5,"commands":65,"prompt":75,"zipAvailable":76},[66,69,72],{"tool":67,"command":68},"npx","npx skills add microsoft\u002Fsre-agent --skill rbac-audit",{"tool":70,"command":71},"bunx","bunx skills add microsoft\u002Fsre-agent --skill rbac-audit",{"tool":73,"command":74},"pnpm","pnpm dlx skills add microsoft\u002Fsre-agent --skill rbac-audit","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fsre-agent\u002Fblob\u002Fmain\u002Flabs\u002Fzava-learning\u002Fsre-config\u002Fagent-config\u002Fskills\u002Frbac-audit\u002FSKILL.md",true,[],[79,106,141,163,188,204],{"skillNo":80,"name":81,"nameZh":6,"description":82,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":83,"categories":84,"keywords":85,"publishedAt":41},"01M699ZY06GBDPEYW1HEDRAVK8","zava-reporting","Use to package a completed Zava Learning incident analysis for the audience. First present a branded in-thread executive summary (markdown with the before\u002Fafter visuals inline), then produce the downloadable deliverables — a PowerPoint deck, an HTML email, and a Teams notification — using the Zava corporate template. The calling agent may narrow this to a subset (e.g. only the HTML report). Produces content and artifacts; it does not send them. Assembles the output of rca-analysis, evidence-before-after, recommendations-next-steps, and pr-delivery.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fsre-agent\u002Fblob\u002Fmain\u002Flabs\u002Fzava-learning\u002Fsre-config\u002Fagent-config\u002Fskills\u002Fzava-reporting\u002FSKILL.md",[],[86,87,88,89,90,91,92,93,94,95,96,32,97,98,99,100,101,102,103,104,105],"zava reporting","reporting","rca","visuals","powerpoint","executive summary","analysis","markdown","html report","template","html","evidence","before-after","next","delivery","incident","recommendations","present","inline","send",{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":125,"publishedAt":41},"01M699ZWCMAF3M8P4A8P0VXEF7","zava-audit-report","Use to package a completed Zava Learning weekly governance audit (NSG \u002F network security, RBAC \u002F least-privilege, or cloud cost) into a single branded, downloadable PowerPoint deck in the Zava house style. The calling audit agent passes its findings (a list of rows with severity) and a short posture summary; this skill renders the deck, applies redaction, and returns the attachment download link. Produces the artifact; it does not send it.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fsre-agent\u002Fblob\u002Fmain\u002Flabs\u002Fzava-learning\u002Fsre-config\u002Fagent-config\u002Fskills\u002Fzava-audit-report\u002FSKILL.md",[112,117,120],{"categoryNo":113,"categoryName":114,"taxonomyType":115,"taxonomyTypeDesc":116},"01JBSEEDCAT000000000000003","演示文稿","SCENARIO","使用场景",{"categoryNo":118,"categoryName":119,"taxonomyType":115,"taxonomyTypeDesc":116},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":121,"categoryName":122,"taxonomyType":123,"taxonomyTypeDesc":124},"01JBSEEDCAT000000000000034","行政与办公人员","PROFESSION","适用职业",[126,127,21,128,129,130,20,90,131,132,133,37,134,135,136,137,138,139,105,140],"zava audit report","report","audit report","security","network security","network","least-privilege","severity","returns","short","list","deck","artifact","weekly","single",{"skillNo":142,"name":143,"nameZh":6,"description":144,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":145,"categories":146,"keywords":147,"publishedAt":41},"01M699ZV3DK2HK74MMKABQBNC7","servicenow-change-management","Use whenever a Zava Learning investigation produces a durable fix that needs change management — after a GitHub PR is opened for an Infrastructure-as-Code or application code root cause, raise a ServiceNow Change Request referencing the PR and attach the RCA report. The single owner of ServiceNow Change Request and attachment operations.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fsre-agent\u002Fblob\u002Fmain\u002Flabs\u002Fzava-learning\u002Fsre-config\u002Fagent-config\u002Fskills\u002Fservicenow-change-management\u002FSKILL.md",[],[148,149,150,151,152,153,88,154,155,156,37,157,22,158,159,160,161,24,140,162],"change","servicenow change management","servicenow","change management","management","github","pr","code","infrastructure-as-code","fix","attach","github pr","as","infrastructure-as","root cause",{"skillNo":164,"name":165,"nameZh":6,"description":166,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":167,"categories":168,"keywords":169,"publishedAt":41},"01M699ZSQAYXNM5YXH35GQXG2E","redaction-guard","Use whenever you are about to emit operator-visible content — a chat\u002Fthread message, a PagerDuty or ServiceNow note, a commit message or pull-request body, or any report artifact (HTML, PowerPoint, Teams card). Deterministically masks secrets, credentials, tokens, private keys, URI-embedded passwords, and PII so they never appear in the thread or in any deliverable. This is a cross-cutting guardrail invoked by the output-producing skills, not a runbook step.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fsre-agent\u002Fblob\u002Fmain\u002Flabs\u002Fzava-learning\u002Fsre-config\u002Fagent-config\u002Fskills\u002Fredaction-guard\u002FSKILL.md",[],[170,171,172,173,174,175,176,177,178,22,33,179,180,181,182,183,184,185,186,187],"redaction guard","guard","redaction","commit","teams","commit message","pull","runbook","pii","pagerduty","chat","tokens","guardrail","card","output","you","passwords","thread",{"skillNo":189,"name":190,"nameZh":6,"description":191,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":192,"categories":193,"keywords":194,"publishedAt":41},"01M699ZRHD3XNYX412M7613ACM","recommendations-next-steps","Use to produce the forward-looking recommendations and next steps for a Zava Learning incident — prioritized preventive, detective, and process actions with owners, target dates, and the risk of inaction. Its output is used in the zava-reporting deliverables.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fsre-agent\u002Fblob\u002Fmain\u002Flabs\u002Fzava-learning\u002Fsre-config\u002Fagent-config\u002Fskills\u002Frecommendations-next-steps\u002FSKILL.md",[],[195,99,102,196,34,9,39,197,38,198,87,199,37,200,22,101,184,201,202,24,203],"recommendations next steps","next steps","produce","actions","risk","process","with","deliverables","dates",{"skillNo":205,"name":206,"nameZh":6,"description":207,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":208,"categories":209,"keywords":210,"publishedAt":41},"01M699ZQBV3ECBCA58WSBCJE54","rca-analysis","Use to produce the root-cause analysis narrative for a resolved or mitigated Zava Learning incident — the incident timeline, the trigger vs. latent root cause (5-Whys), contributing factors, and how to present them. Defines the RCA section format; its output is used in the before\u002Fafter, recommendations, and reporting deliverables.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fsre-agent\u002Fblob\u002Fmain\u002Flabs\u002Fzava-learning\u002Fsre-config\u002Fagent-config\u002Fskills\u002Frca-analysis\u002FSKILL.md",[],[88,211,92,197,212,213,37,214,22,215,101,102,216,217,218,184,202,24,219,162],"rca analysis","contributing","how","format","root-cause","trigger","how to","narrative","section"]