kopai-app/root-cause-analysis
skills/root-cause-analysis/SKILL.md
Analyze telemetry data for root cause analysis using Kopai CLI. Use when debugging errors, investigating latency issues, tracing request flows across services, or correlating logs with traces. Also use when users report production issues like "why is my API slow", "getting 500 errors", "service is down", "requests are timing out", or any symptom that needs telemetry-based investigation — even if they don't mention traces or observability explicitly.
$ install --global
skillsauthnpx skillsauth add kopai-app/kopai-mono root-cause-analysisInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 16, 2026, 6:49 AM4.9s15 files scanned
SKILL.md
- name:
- root-cause-analysis
- description:
- Analyze telemetry data for root cause analysis using Kopai CLI. Use when debugging errors, investigating latency issues, tracing request flows across services, or correlating logs with traces. Also use when users report production issues like "why is my API slow", "getting 500 errors", "service is down", "requests are timing out", or any symptom that needs telemetry-based investigation — even if they don't mention traces or observability explicitly.
- license:
- Apache-2.0
- author:
- kopai
- version:
- 1.1.0
Root Cause Analysis with Kopai
Guide for debugging production issues using telemetry data (traces, logs, metrics) via Kopai CLI.
Prerequisites
Ensure access to Kopai app backend. Make sure the services are set up to send their OpenTelemetry data to Kopai. See otel-instrumentation skill for setup.
RCA Workflow
- Find error traces —
npx @kopai/cli traces search --status-code ERROR --limit 20 --json. If empty: broaden time range, check service name, or search logs with--severity-min 17 - Get full trace context —
npx @kopai/cli traces get <traceId> --json. Check Duration, StatusCode, and span hierarchy for bottlenecks - Correlate logs —
npx @kopai/cli logs search --trace-id <traceId> --json. Look for error messages, stack traces, and timestamps - Check metrics —
npx @kopai/cli metrics discover --jsonthennpx @kopai/cli metrics search --type <type> --name <name> --jsonfor anomalies - Present findings — summarize root cause with evidence (specific traceIds, log entries, metric anomalies), impact, and suggested fix
Quick Example
# Find failing requests
npx @kopai/cli traces search --status-code ERROR --service payment-api --json
# Get trace details (copy traceId from above)
npx @kopai/cli traces get abc123def456 --json
# Check correlated logs
npx @kopai/cli logs search --trace-id abc123def456 --severity-min 17 --json
Rules
1. Workflow (CRITICAL)
workflow-find-errors- Find Error Tracesworkflow-get-context- Get Full Trace Contextworkflow-correlate-logs- Correlate Logs with Traceworkflow-check-metrics- Check Related Metricsworkflow-identify-cause- Identify Root Cause & Present Findings
2. Patterns (HIGH)
pattern-http-errors- HTTP Error Debuggingpattern-slow-requests- Slow Request Analysispattern-distributed- Distributed Failure Tracingpattern-log-driven- Log-Driven Investigation
Read rules/<rule-name>.md for details.
Tips
- Always use
--jsonfor programmatic analysis - Pipe to
jqfor filtering/aggregation - Start with errors, then trace backwards
- Check span Duration to find bottlenecks
- Correlate TraceId across traces, logs, metrics
- Use
--severity-min 17instead of--severity-text ERRORto catch all error-level logs regardless of text casing. Fall back to--body "error"for errors logged at INFO or with no severity.
References
- trace-filters - Trace search filter options
- log-filters - Log search filter options
- metric-filters - Metric search filter options
Related Skills
kopai-app/otel-instrumentation
development
VerifiedTrustedCommunity
Instrument applications with OpenTelemetry SDK and validate telemetry using Kopai. Use when setting up observability, adding tracing/logging/metrics, testing instrumentation, debugging missing telemetry data, or when traces/logs/metrics aren't appearing after setup. Also use when users say things like "my traces aren't showing up", "I don't see any data", or "how do I add observability to my app".
3SKILL.mdUpdated Apr 16, 2026
kopai-app/create-dashboard
development
VerifiedTrustedCommunity
Create observability dashboards from OTEL metrics, logs, and traces using Kopai. Use when building metric visualizations, monitoring views, KPI panels, or when the user wants to see their telemetry data in a dashboard — even if they don't say "dashboard" explicitly. Also use when other skills or workflows need to present telemetry data visually (e.g. after root cause analysis).
3SKILL.mdUpdated Apr 16, 2026
openclaw/taskflow
tools
VerifiedTrustedCommunity
Use when work should span one or more detached tasks but still behave like one job with a single owner context. TaskFlow is the durable flow substrate under authoring layers like Lobster, ACPX, plugins, or plain code. Keep conditional logic in the caller; use TaskFlow for flow identity, child-task linkage, waiting state, revision-checked mutations, and user-facing emergence.
357,764SKILL.mdUpdated Apr 10, 2026
openclaw/extensions/lobster
tools
VerifiedTrustedCommunity
# Lobster Lobster executes multi-step workflows with approval checkpoints. Use it when: - User wants a repeatable automation (triage, monitor, sync) - Actions need human approval before executing (send, post, delete) - Multiple tool calls should run as one deterministic operation ## When to use Lobster | User intent | Use Lobster? | | ------------------------------------------------------ | --------------------------
357,764SKILL.mdUpdated Apr 10, 2026