Incident Triage And Pipeline Recovery
Guides agents through production data incidents. Use when a pipeline fails, publishes bad data, misses an SLA, partially loads, corrupts state, or requires rollback, replay, or stakeholder communication.
Install
$ agentstack add skill-vaquarkhan-data-engineering-agent-skills-incident-triage-and-pipeline-recovery ✓ scanned · ✓ verified — works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
About
Incident Triage And Pipeline Recovery
Overview
Use this skill when production behavior is already wrong and the team needs controlled recovery. It helps agents contain blast radius, diagnose quickly, restore trust, and avoid making the incident worse.
When to Use
- failed production runs
- bad or partial publishes
- corrupted incremental state
- freshness SLA breaches
- emergency rollback or replay decisions
Do not jump to fixes before stabilizing the system and understanding impact.
Workflow
- Contain the incident.
Decide whether to:
- pause schedules
- block downstream publish
- isolate bad partitions
- notify owners and consumers
- Pull live signals before mutation when possible.
Load mcp-data-observability-integration to inspect lag, run state, or Spark stage metrics before reruns or replays.
- Classify impact.
Identify:
- affected datasets
- time window
- downstream consumers
- whether data is late, missing, duplicated, or wrong
- Determine the safest recovery path.
Options include:
- rerun
- replay
- rollback
- partial correction
- full backfill
When replay or backfill is chosen, load safe-backfill-and-replay-orchestration and draft templates/backfill-plan.yaml before execution.
- Validate recovery before reopening publish paths.
- Record the incident and add a guardrail.
A fixed incident with no prevention work is unfinished.
- Turn high-value incidents into repeatable resilience tests.
Load skills/data-resiliency-testing-and-failure-injection/SKILL.md or references/data-resiliency-testing-patterns.md when the same failure mode must be prevented from surprising the team again.
Common Rationalizations
| Rationalization | Reality | | --- | --- | | "Let us rerun everything now." | Blind reruns can duplicate data or destroy evidence. | | "We can clean up downstream later." | Downstream trust loss is often harder to recover than the pipeline itself. | | "The root cause can wait." | Without a guardrail, the same incident often returns quickly. |
Red Flags
- no attempt to contain blast radius
- reruns happen before impact is understood
- downstream consumers are not informed
- recovery succeeds but no new guardrail is added
Verification
- [ ] Impact scope and affected consumers are identified
- [ ] The chosen recovery path is safer than the alternatives
- [ ] Publish is reopened only after validation
- [ ] Post-incident guardrails or checks are added
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: vaquarkhan
- Source: vaquarkhan/data-engineering-agent-skills
- License: MIT
- Homepage: https://vaquarkhan.github.io/data-engineering-agent-skills/
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet — be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.