# Idmp Workflow Alert Create

> IDMP alert creation workflow. Prepare the event template, create the Event-trigger analysis, and treat reread plus Running as success without actively triggering alerts.

- **Type:** Skill
- **Install:** `agentstack add skill-taosdata-agent-skills-idmp-workflow-alert-create`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [taosdata](https://agentstack.voostack.com/s/taosdata)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [taosdata](https://github.com/taosdata)
- **Source:** https://github.com/taosdata/agent-skills/tree/main/plugins/idmp-plugin/skills/idmp-workflow-alert-create

## Install

```sh
agentstack add skill-taosdata-agent-skills-idmp-workflow-alert-create
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# workflow: alert create

**Read [`../idmp-shared/SKILL.md`](../idmp-shared/SKILL.md) first.**

## Recommended references

- [`references/alert-create.md`](references/alert-create.md)
- [`../idmp-workflow-analysis-create/SKILL.md`](../idmp-workflow-analysis-create/SKILL.md)

## Missing context to resolve first

- Whether the alert intent is natural-language friendly enough for AI-first analysis drafting.
- Candidate analysis name.
- Whether downstream notification routing is in scope after create success.
- Notify target when routing is in scope.
- AI alert prompt seed.
- `idmp-cli ai create create --ack-risk --data '{"elementId":123,"prompt":"alert when ...","record":true}'`
- `idmp-cli event-template events get --params '{"id":789}'`
- `idmp-cli analysis analyses new-name --ack-risk --params '{"elementId":123,"name":"demo-alert"}'`
- Trigger source.
- Non-leaf proof boundary.
- Whether the operator wants only create success or an extra downstream-debug pass later.

## Constrained live behaviors

- `try-send` is not part of create success.
- Write-chain boundary.
- Prefer AI draft-first create for the Event-trigger analysis when the operator starts from natural language; fall back to the structured alert chain when the AI draft is unsuitable or persistence fails.
- `event-template events get` uses `id`.
- `analysis.analyses.new-name` needs a candidate `name` and `--ack-risk`.
- Create or resume the analysis before you write the notify rule.
- If `analysis trigger-types list` for `applyOnSelf=false` does not include `Event`, stop instead of forcing child-scope alert creation.
- Trigger types gate create eligibility; they do not require a real event during create proof.
- Keep `escalationInterval` aligned with the actual notify-rule DTO.
- Create success means the analysis is created, reread, and `Running`.
- Do not write source attributes or replay history just to prove alert creation.
- Real event materialization and notification delivery are optional downstream diagnostics, not part of create success.

## Execution flow

1. Prepare the template side with `idmp-cli event-template events list`, `idmp-cli event-template events get --params`, and `idmp-cli event-template events create --ack-risk` only when no reusable template exists.
2. For natural-language alert requests, try AI draft-first create for the analysis portion with `idmp-cli ai create create --ack-risk --data '{"elementId":123,"prompt":"alert when ...","record":true,"deepThinking":false,"deviceDocument":false}'`, then persist the returned draft through `idmp-cli analysis analyses create --ack-risk --params` after removing `id` and injecting `rootElementId`.
3. If the AI draft does not preserve the required event template, severity, scope, or output bindings, fall back to the current structured alert flow.
4. Reserve the analysis name with `idmp-cli analysis analyses new-name --ack-risk --params`, then prove scope support with `idmp-cli analysis trigger-types list --params`.
5. Create the missing output attribute only if required by using `idmp-cli attribute elements attributes-post --ack-risk --params`.
6. Create and reread the alert analysis via `idmp-cli analysis analyses create --ack-risk --params` and `idmp-cli analysis analyses get --params`.
7. Resume the analysis with `idmp-cli analysis analyses resume --ack-risk --params`. Success means `analysis analyses get` reread plus `analysis analyses resume` reaching `Running`.
8. If downstream routing is explicitly in scope after the analysis is already `Running`, inspect or add notify-rule coverage with `idmp-cli notification notify-rules list --params`, `idmp-cli notification notify-rules create --ack-risk --params`, and `idmp-cli notification notify-rules update --ack-risk --params`.
9. Clean up abandoned drafts with `idmp-cli analysis analyses delete --ack-risk --params`.

For command-family coverage, the core create flow touches these steps in order: `idmp-cli event-template events list`, `idmp-cli event-template events get --params`, `idmp-cli analysis analyses new-name --ack-risk --params`, `idmp-cli analysis trigger-types list --params`, `idmp-cli attribute elements attributes-post --ack-risk --params`, `idmp-cli analysis analyses create --ack-risk --params`, `idmp-cli analysis analyses get --params`, and `idmp-cli analysis analyses resume --ack-risk --params`. Optional post-create routing can also use `idmp-cli notification notify-rules list --params`, `idmp-cli notification notify-rules create --ack-risk --params`, and `idmp-cli notification notify-rules update --ack-risk --params` after the analysis is already `Running`.

## Exception paths

- Stop immediately when child-scope trigger types do not include `Event`.
- If the AI draft does not survive persistence or comes back without the required Event-trigger fields, clean any draft-only output attributes and resume from the structured alert path.
- If `analysis analyses get --params` succeeds but `analysis analyses resume --ack-risk --params` does not leave the analysis in `Running`, classify the attempt as create incomplete or runtime-start boundary.
- A missing real event is not a create failure for this skill.
- `analysis attribute list`, `attribute write-data create`, `analysis analyses fill-history`, `event events list`, `event events confirm`, and `notification try-send create` belong to later debugging or delivery validation, not to create proof.
- Delete temporary output attributes, notify rules, or draft analyses when a proof attempt is abandoned.

## Validation scenarios

### 1. Leaf owner strict live proof
Use the chain from `idmp-cli analysis analyses create --ack-risk --params` through `idmp-cli analysis analyses resume --ack-risk --params`. Success is create + reread + `Running`; do not replay source data just to open a real event.

### 2. Middle owner strict replay proof
Keep the same create chain, but require only explicit evidence that the non-leaf self analysis was created, reread, and reached `Running`. Trigger support gates create eligibility; it does not require event materialization.

### 3. Middle child aggregation must stop when `Event` is unavailable
Run `idmp-cli analysis trigger-types list --params` first. If `Event` is absent for `applyOnSelf=false`, stop and report the boundary without forcing create.

### 4. New event template plus notify-rule reuse
Read event-template and notify-rule state separately before writing. Reuse a working notify rule when possible instead of duplicating it, but treat notify-rule work as optional follow-up after create success.

### 5. Template-mode alert workflow
Preserve the same proof discipline in template mode: scope check, create, reread, and `Running`. Do not call the workflow successful on template reads alone, and do not require real event materialization.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [taosdata](https://github.com/taosdata)
- **Source:** [taosdata/agent-skills](https://github.com/taosdata/agent-skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-taosdata-agent-skills-idmp-workflow-alert-create
- Seller: https://agentstack.voostack.com/s/taosdata
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.