microsoft/recommendations-next-steps
labs/zava-learning/sre-config/agent-config/skills/recommendations-next-steps/SKILL.md
Use to produce the forward-looking recommendations and next steps for a Zava Learning incident — prioritized preventive, detective, and process actions with owners, target dates, and the risk of inaction. Its output is used in the zava-reporting deliverables.
$ install --global
skillsauthnpx skillsauth add microsoft/sre-agent recommendations-next-stepsInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jun 23, 2026, 7:53 AM86.6s1 file scanned
SKILL.md
- api_version:
- azuresre.ai/v2
- kind:
- Skill
- name:
- recommendations-next-steps
- description:
- Use to produce the forward-looking recommendations and next steps for a Zava Learning incident — prioritized preventive, detective, and process actions with owners, target dates, and the risk of inaction. Its output is used in the zava-reporting deliverables.
Zava Learning — Recommendations & Next Steps
Turn the RCA into a concrete, accountable action plan. Retrieve zava-brand and
zava-report-template with SearchMemory; follow the Recommendations section. Use
SearchIncidentKnowledge for related past incidents and microsoft-learn_microsoft_docs_search
to ground recommendations in Azure best practice.
Derive actions from the RCA
Map each contributing factor and detection gap to an action. Classify every action:
- Preventive — stops recurrence (e.g. an NSG priority guardrail in IaC, a CI check for synchronous work on the request path, an autoscale floor so an API can't reach zero replicas).
- Detective — catches it sooner (a targeted alert/metric, a synthetic probe on
/api/quiz/*, a dashboard). - Process — runbook, ownership, review, or deployment-policy change.
Present as an accountable table
Columns: action · type · owner · priority (P1/P2/P3) · target date · risk if not done · status.
- Priority by likelihood × impact of recurrence.
- Owners are roles/teams, not named individuals.
- Every recommendation is specific and testable — no "improve monitoring".
- Separate immediate next steps (this week) from longer-term hardening.
Rules
- Recommend only what the evidence supports; don't pad the list.
- Note where a recommendation is already partially done (e.g. mitigation applied, guardrail PR open) and what remains.
Verification
A prioritized, owned, dated action table where each row traces to an RCA finding, immediate vs.
long-term separated, ready for zava-reporting.
Related Skills
microsoft/zava-reporting
development
VerifiedTrustedCommunity
Use to package a completed Zava Learning incident analysis for the audience. First present a branded in-thread executive summary (markdown with the before/after visuals inline), then produce the downloadable deliverables — a PowerPoint deck, an HTML email, and a Teams notification — using the Zava corporate template. The calling agent may narrow this to a subset (e.g. only the HTML report). Produces content and artifacts; it does not send them. Assembles the output of rca-analysis, evidence-before-after, recommendations-next-steps, and pr-delivery.
123SKILL.mdUpdated Jun 23, 2026
microsoft/zava-audit-report
development
VerifiedTrustedCommunity
Use to package a completed Zava Learning weekly governance audit (NSG / network security, RBAC / least-privilege, or cloud cost) into a single branded, downloadable PowerPoint deck in the Zava house style. The calling audit agent passes its findings (a list of rows with severity) and a short posture summary; this skill renders the deck, applies redaction, and returns the attachment download link. Produces the artifact; it does not send it.
123SKILL.mdUpdated Jun 23, 2026
microsoft/servicenow-change-management
development
VerifiedTrustedCommunity
Use whenever a Zava Learning investigation produces a durable fix that needs change management — after a GitHub PR is opened for an Infrastructure-as-Code or application code root cause, raise a ServiceNow Change Request referencing the PR and attach the RCA report. The single owner of ServiceNow Change Request and attachment operations.
123SKILL.mdUpdated Jun 23, 2026
microsoft/redaction-guard
development
VerifiedTrustedCommunity
Use whenever you are about to emit operator-visible content — a chat/thread message, a PagerDuty or ServiceNow note, a commit message or pull-request body, or any report artifact (HTML, PowerPoint, Teams card). Deterministically masks secrets, credentials, tokens, private keys, URI-embedded passwords, and PII so they never appear in the thread or in any deliverable. This is a cross-cutting guardrail invoked by the output-producing skills, not a runbook step.
123SKILL.mdUpdated Jun 23, 2026