Skills

Skills are reusable bundles of instructions and knowledge that extend what an agent knows how to do during an incident. A skill never grants tool access — an agent can only ever call the tools already bound to it by its own tool factory. What a skill adds is guidance (and, optionally, a bias toward specific already-bound tools), keeping each agent’s behavior focused and auditable without changing what it’s capable of calling.

​

What a skill contains

A skill has two parts:

• Instructions: guidance for the agent on when and how to approach a problem, including how to use tools it already has
• Tool hints: references to specific tool names (MCP endpoints, API wrappers) that this skill’s instructions are about. A tool hint only reorders or biases which of the agent’s already-bound tools get emphasized when this skill is active — it cannot add a tool the agent doesn’t already have

When an agent runs, it receives the combined instructions and content from all skills attached to it, plus tool-hint-driven emphasis over its existing tool set. The tools themselves come from the agent’s own tool factory, never from a skill.

---

​

Built-in landscape tools

Your service topology — the graph of services, dependencies, ownership, and deployment information built from your .sureops/ contract and telemetry discovery — reaches agents in two different ways, and only one of them is bound tools:

• Diagnosis Specialist: has the landscape_* tools below bound directly as callable tools, wired in as a built-in tool factory. It can call them on-demand mid-investigation (“let me check the blast radius of this service”). It also gets a pre-rendered landscape context block up front, same as the agents below — the bound tools are for digging deeper on demand beyond that baseline.
• Incident Commander, Verification Specialist, the Deep RCA Investigator, and the Incident Response Critic: do not have these tools bound. Instead, relevant landscape context is pre-rendered as a block of text and prepended to the agent’s prompt — free context with no extra LLM round-trip, but not something the agent can query dynamically.
• Problem Commander and the Fix-PR Agent get none of this. Problem Commander is the pipeline orchestrator — the pre-rendered block goes to its sub-agents (the Deep RCA Investigator and the Incident Response Critic, listed above), not to the Problem Commander node itself. The Fix-PR Agent gets zero tools and zero landscape context of any kind.

Either way, this isn’t a per-agent toggle in the Skills UI — there’s nothing to enable or disable here. Tools included (all prefixed landscape_):

​

GitHub agent skills

GitHub skills give agents read access to your code repositories for diagnosis. Available to: Diagnosis Specialist, via its “code” domain subagent — invoked only when diagnosis suspects a recent code change caused the incident. Problem Commander’s sub-agents (the Deep RCA Investigator and the Incident Response Critic) also get GitHub read-tools, via that same shared “code” domain subagent. Only the Fix-PR Agent has zero tools bound to it at all; it works from pre-rendered context in its prompt, not tool calls. Tools included:

• get_file_contents — Read a specific file from a repository
• search_code — Search for patterns in repository code
• list_commits — List recent commits (used for attributing a root cause to a specific commit)

Pull requests (fix-PR, postmortem, and runbook) are not opened by an agent calling a tool — there is no create_pull_request tool bound to any agent. They’re opened by a deterministic backend service call once the relevant pipeline stage completes. GitHub skills require a connected GitHub integration. See the Integrations section for setup.

---

​

Attaching skills to agents

There are two places to manage which agents a skill is attached to, and both write to the same underlying assignment:

• The org-wide Settings → Skills screen — author a skill once, then assign it outward to whichever agents should have it.
• A Connected Skills section directly on each agent’s own card at Settings → AI Agents, where you can toggle individual skills on or off for just that agent.

---

​

Custom skills

You can define custom skills that reference your own MCP endpoints. This is useful for integrating proprietary tools — internal runbook APIs, custom dashboards, or in-house automation platforms — without building a new integration. A custom skill requires:

• A name and description
• A slug (auto-generated from the name, editable)
• Content: instructions for the agent on when and how to use the tools
• A category
• A list of tool hints that reference MCP endpoint names — these only bias emphasis among tools the agent already has bound; they cannot grant a new tool
• The set of agents it’s assigned to
• Enabled left on (a disabled skill silently does nothing)

Custom skills are configured via Settings → Skills → Create Skill. The tool hints must match the names of tools exposed by a connected MCP integration.

---

​

How skills interact with agent instructions

When an agent runs, it receives:

1. The base agent instructions (sureops-defined; not customer-configurable)
2. Instructions and content from all skills assigned to it, plus tool-hint-driven emphasis over its already-bound tools
3. Custom agent instructions you’ve added at Settings → AI Agents → [agent] (appended, not replacing the base)

The agent uses these to decide how to approach the incident and which of its already-bound tools to prioritize. Skills are additive — they extend, never replace, the base agent behavior, and they never add tool access beyond what the agent’s own tool factory already bound.

---

​

Auditing skill tool calls

Every tool call an agent makes while a skill’s instructions are guiding it is recorded in the incident timeline. The entry shows:

• The tool name (one of the agent’s already-bound tools)
• The input parameters
• The output (or error)
• The timestamp

This gives you a complete record of what each agent queried during the incident, regardless of which skill’s tool hints drew attention to that tool. See Confidence & Audit Trace for more on reading the incident timeline.