{
  "markdown": "# Datadog Skills for AI Agents\n\nDatadog skills for Claude Code, Codex CLI, Gemini CLI, Cursor, Windsurf, OpenCode, and other AI agents.\n\n## Skills\n\n| Skill | Description |\n|-------|-------------|\n| **dd-pup** | Primary CLI - commands, auth, PATH setup |\n| **dd-monitors** | Create, manage, mute monitors |\n| **dd-logs** | Search logs |\n| **dd-apm** | Traces, services, performance, Single-Step Instrumentation |\n| **dd-docs** | Search Datadog documentation |\n| **agent-observability** | Agent Observability: experiments, eval RCA, evaluator generation, session classification |\n| **dd-browser-sdk** | Browser SDK: RUM, Logs, Session Replay, profiling, product analytics, error tracking, version migration |\n| **dd-audit** | Audit Trail investigations: who changed what, key compromise, cost spike root cause, compliance evidence (SOC 2/PCI), AI activity auditing |\n| **dd-software-delivery** | CI/CD workflow skills — unblock PR pipelines, triage flaky tests (MCP + pup) |\n| **dd-apps** | Build Datadog Apps — scaffold, run locally, upload, publish, CI/CD, DDSQL data access |\n| **dd-product-recommender** | Recommend the right Datadog products for a codebase and/or goal (recommendation only) |\n| **dd-instrument-rum** | Instrument browser apps with Datadog Browser RUM — React, Next.js, Angular, Vue, Nuxt, Svelte, vanilla |\n\n## Install\n\n### Setup Pup\n\n```bash\n# Homebrew (macOS/Linux) — recommended\nbrew tap datadog-labs/pack\nbrew install datadog-labs/pack/pup\n\n# Or build from source\ngit clone https://github.com/datadog-labs/pup.git && cd pup\ncargo build --release\ncp target/release/pup ~/.local/bin\n```\n\nPre-built binaries are also available from the [latest release](https://github.com/datadog-labs/pup/releases/latest).\n\n```bash\n# Authenticate\npup auth login\n```\n\n### Add Skill(s) \n\nFor JUST `dd-pup`:\n\n```bash\nnpx skills add datadog-labs/agent-skills \\\n  --skill dd-pup \\\n  --full-depth -y\n```\n\nFor ALL skills:\n\n```bash\nnpx skills add datadog-labs/agent-skills \\\n  --skill dd-pup \\\n  --skill dd-monitors \\\n  --skill dd-logs \\\n  --skill dd-apm \\\n  --skill dd-docs \\\n  --skill dd-browser-sdk \\\n  --skill dd-audit \\\n  --skill service-remapping \\\n  --skill agent-install \\\n  --skill enable-ssi \\\n  --skill verify-ssi \\\n  --skill troubleshoot-ssi \\\n  --skill onboarding-summary \\\n  --skill upgrade-browser-sdk-v7 \\\n  --skill dd-audit-security-investigation \\\n  --skill dd-audit-key-compromise \\\n  --skill dd-audit-cost-spike-investigation \\\n  --skill dd-audit-compliance-report \\\n  --skill dd-audit-ai-activity \\\n  --skill agent-observability-experiment-analyzer \\\n  --skill agent-observability-experiment-bootstrap \\\n  --skill agent-observability-trace-rca \\\n  --skill agent-observability-eval-bootstrap \\\n  --skill agent-observability-eval-pipeline \\\n  --skill agent-observability-session-classify \\\n  --skill agent-observability-auto-experiment \\\n  --skill agent-observability-replay-trace \\\n  --skill k9-ownership-byod-setup \\\n  --full-depth -y\n```\n\n### Agent Observability (LLMO)\n\nThe `agent-observability` directory contains eight skills for working with Agent Observability data:\n\n| Skill | Purpose |\n|-------|---------|\n| `agent-observability-experiment-analyzer` | Analyze and compare offline LLM experiments |\n| `agent-observability-experiment-bootstrap` | Bootstrap reproducible experiments through the Python or Node SDK |\n| `agent-observability-trace-rca` | Root-cause production failures using eval judge signal or runtime errors |\n| `agent-observability-eval-bootstrap` | Generate evaluator code from traces, optionally seeded by RCA output. Also emits a dataset from traces in `--emit-dataset` mode. |\n| `agent-observability-eval-pipeline` | Eight-phase pipeline: classify → RCA → bootstrap evaluators → create dataset → publish → generate experiment → run → analyze. Stop early with `--stop-after`. |\n| `agent-observability-session-classify` | Classify whether user intent was satisfied in a session (trace + RUM signals) |\n| `agent-observability-auto-experiment` | Local hill-climb: baseline-eval a prompt/file against LLM-Obs data, make one focused change, re-score with the same harness, keep it only if it beats the best, repeat |\n| `agent-observability-replay-trace` | Iterate on one trace: re-run it against local code, diff old vs new output, loop until satisfied (CLI, no server; edit → replay → diff) |\n\n**Eval pipeline flow:**\n\n```\nagent-observability-session-classify    agent-observability-trace-rca → agent-observability-eval-bootstrap\n (classify sessions)          (diagnose why)      (build evals)\n```\n\nRun `agent-observability-trace-rca` to understand why an app is failing by analyzing eval judge verdicts or\nruntime errors across production traces. Then run `agent-observability-eval-bootstrap` to generate evaluator\ncode that captures those failure patterns. Pass the RCA output directly to `agent-observability-eval-bootstrap`\nto seed it with the discovered failure taxonomy.\n\nUse `agent-observability-eval-pipeline` to run all three steps in sequence with checkpoints between each phase.\n\nUse `agent-observability-session-classify` independently to evaluate whether individual assistant sessions\nsatisfied user intent, combining Agent Observability trace data with RUM behavioral signals.\n\nUse `agent-observability-experiment-bootstrap` to bootstrap a reproducible experiment through the\nPython `ddtrace.llmobs` SDK or the Node `dd-trace` SDK. Python remains the default adapter;\ngenerated artifacts can use inline records, local files, or named Datadog datasets.\n\nThe bootstrap skill keeps adapter-specific contracts in its `references/` directory and loads only the selected\nPython or Node SDK reference. Python provider and evaluator-style references live under `references/python/` and are\nloaded separately when needed.\n\n#### Install\n\n```bash\n# Claude Code — copy any or all skills\ncp -r agent-observability/agent-observability-experiment-analyzer ~/.claude/skills\ncp -r agent-observability/agent-observability-experiment-bootstrap ~/.claude/skills\ncp -r agent-observability/agent-observability-trace-rca ~/.claude/skills\ncp -r agent-observability/agent-observability-eval-bootstrap ~/.claude/skills\ncp -r agent-observability/agent-observability-eval-pipeline ~/.claude/skills\ncp -r agent-observability/agent-observability-session-classify ~/.claude/skills\n```\n\n#### MCP Requirements\n\nAll six skills require the LLMO toolset:\n\n```bash\nclaude mcp add --scope user --transport http \"datadog-llmo-mcp\" 'https://mcp.datadoghq.com/api/unstable/mcp-server/mcp?toolsets=llmobs'\n```\n\n`experiment-analyzer` uses the core toolset for notebook export (optional). `eval-session-classify`\nrequires it for RUM behavioral analysis and efficient batched fetches of trace session spans:\n\n```bash\nclaude mcp add --scope user --transport http \"datadog-mcp-core\" 'https://mcp.datadoghq.com/api/unstable/mcp-server/mcp?toolsets=core'\n```\n\n#### Usage\n\n```\n# Analyze experiments\nexperiment-analyzer <experiment_id>                         # single experiment\nexperiment-analyzer <baseline_id> <candidate_id>            # compare two experiments\nexperiment-analyzer <id(s)> <question>                      # ask a specific question\nexperiment-analyzer <id(s)> [question] --output notebook    # export to Datadog notebook\n\n# Root-cause why an app is failing\nWhat's wrong with <ml_app> based on its evals over the last 24h\nAnalyze eval failures for <eval_name> over the last week\nLook at the errors on <ml_app> over the last 24h\n\n# Generate evaluator code from production traces\n/eval-bootstrap <ml_app>                                    # cold start\n/eval-bootstrap <ml_app> [paste eval-trace-rca output here] # seeded from RCA\n/eval-bootstrap <ml_app> --data-only                        # emit JSON spec instead of Python SDK code\n\n# Bootstrap an experiment (Python SDK remains the default)\n/agent-observability-experiment-bootstrap                                                  # 3-record inline Python sample\n/agent-observability-experiment-bootstrap --dataset ./data/qa.json --format ipynb          # local JSON dataset, Python notebook\n/agent-observability-experiment-bootstrap --dataset-name qa_v3 --project-name customer-qa  # existing Datadog dataset\n/agent-observability-experiment-bootstrap --evaluator-style remote                         # server-side RemoteEvaluator stubs\n/agent-observability-experiment-bootstrap --adapter node --format mjs --task-source app:answer # Node SDK artifact\n\n# Classify a session\n/eval-session-classify <session_id>\n\n# Guided end-to-end pipeline (6 narrated phases — classify → RCA → eval bootstrap → dataset → experiment → analyze)\n/agent-observability-eval-pipeline <ml_app>\n/agent-observability-eval-pipeline <ml_app> --timeframe now-30d --trace-limit 25 --format ipynb\n```\n\n### Software Delivery (dd-software-delivery)\n\nThe `dd-software-delivery` directory contains workflow skills for CI/CD visibility and test reliability:\n\n| Skill | Purpose |\n|-------|---------|\n| `unblock-pr` | Investigate a failing PR CI pipeline — classify each failure as flaky, infra, or regression; fetch code coverage and PR quality/security insights; propose targeted actions |\n| `triage-flaky-test` | Deep-dive on a specific flaky test — get history, blast radius, root cause category, and recommend a code fix or quarantine |\n\n**Workflow:**\n\n```\nunblock-pr → (if flaky failure) → triage-flaky-test → quarantine or fix\n```\n\n#### Backend\n\nBoth skills auto-detect the available backend at runtime:\n- **MCP mode** (preferred): uses the Datadog software-delivery MCP tools (`search_datadog_ci_pipeline_events`, `get_datadog_flaky_tests`, `retry_datadog_ci_job`, etc.). Enables PR quality/security insights and native GitHub Actions retry.\n- **pup mode** (fallback): uses the `pup` CLI. PR quality/security data is not available; GitHub Actions retry falls back to `gh run rerun`.\n\nPass `--backend pup` to force pup mode regardless of MCP availability.\n\n#### MCP Requirements\n\nConnect the Datadog MCP server with the `software-delivery` toolset:\n\n```bash\nclaude mcp add --scope user --transport http \"datadog-mcp\" \\\n  'https://mcp.datadoghq.com/api/unstable/mcp-server/mcp?toolsets=core,software-delivery'\n```\n\n#### Prerequisites\n\nRequires `pup` CLI for pup mode (and as a fallback). See [Setup Pup](#setup-pup).\n\n#### Install\n\n```bash\n# Claude Code — copy any or all skills\ncp -r dd-software-delivery/unblock-pr ~/.claude/skills\ncp -r dd-software-delivery/triage-flaky-test ~/.claude/skills\n```\n\nOr via `npx`:\n\n```bash\nnpx skills add datadog-labs/agent-skills \\\n  --skill dd-software-delivery/unblock-pr \\\n  --skill dd-software-delivery/triage-flaky-test \\\n  --full-depth -y\n```\n\n#### Usage\n\n```\n# Investigate a failing PR\nunblock-pr                                     # auto-detects branch and repo from git\nunblock-pr my-feature-branch                   # explicit branch\nunblock-pr my-feature-branch github.com/org/repo\n\n# Triage a specific flaky test\ntriage-flaky-test TestMyFunc\ntriage-flaky-test com.example.MyTest github.com/org/repo\n```\n\n### Audit Trail (dd-audit)\n\nThe `dd-audit` directory contains five skills for investigating Datadog Audit Trail data:\n\n| Skill | Purpose |\n|-------|---------|\n| `security-investigation` | Who changed what, user activity, login geo, deletions, permission changes |\n| `key-compromise` | Investigate a potentially compromised API key — timeline, geo/IP, endpoints called |\n| `cost-spike-investigation` | Correlate usage spike (Usage Metering) with config changes (Audit Trail) to find root cause |\n| `compliance-report` | Generate SOC 2 / PCI DSS evidence from audit data |\n| `ai-activity-audit` | Audit what the Bits AI / MCP assistant did in your org |\n\n#### Prerequisites\n\nThese skills use the Datadog Audit REST API directly (no `pup audit` command exists yet). You need an API key + App key with `audit_logs_read` scope:\n\n```bash\nexport DD_API_KEY=<your-api-key>\nexport DD_APP_KEY=<your-app-key>\nexport DD_SITE=datadoghq.com   # or us3/us5/eu/ap1/ap2\n```\n\n#### Install\n\n```bash\n# Claude Code — copy any or all skills\ncp -r dd-audit/security-investigation ~/.claude/skills\ncp -r dd-audit/key-compromise ~/.claude/skills\ncp -r dd-audit/cost-spike-investigation ~/.claude/skills\ncp -r dd-audit/compliance-report ~/.claude/skills\ncp -r dd-audit/ai-activity-audit ~/.claude/skills\n```\n\n#### Usage\n\n```\n# Security investigation\nWho deleted monitors in the last 24 hours?\nWhat did user@example.com do this week?\nShow login activity from unexpected locations\n\n# Key compromise\nWas API key <key_id> used from unexpected locations?\nInvestigate this API key: <key_id>\n\n# Cost spike\nWhy did our Agent Observability usage spike on May 1?\nWhat caused the cost increase this week?\n\n# Compliance\nGenerate SOC 2 evidence for CC6.2 and CC6.3 for Q1 2026\nCreate a PCI DSS Requirement 10 report for the last 90 days\n\n# AI activity\nWhat did the Bits AI assistant do in my org this week?\nShow me a governance report for AI tool calls in April\n```\n\n### Software Delivery (dd-software-delivery)\n\nThe `dd-software-delivery` directory contains workflow skills for CI/CD visibility and test reliability:\n\n| Skill | Purpose |\n|-------|---------|\n| `unblock-pr` | Investigate a failing PR CI pipeline — classify each failure as flaky, infra, or regression; fetch code coverage; propose targeted actions |\n| `triage-flaky-test` | Deep-dive on a specific flaky test — get history, blast radius, root cause category, and recommend a code fix or quarantine |\n\n**Workflow:**\n\n```\nunblock-pr → (if flaky failure) → triage-flaky-test → quarantine or fix\n```\n\nRun `unblock-pr` when CI is red on a PR to attribute each failing job. If a failure is classified as **flaky**, the skill hands off to `triage-flaky-test` for deeper investigation and a targeted fix or quarantine via `pup test-optimization flaky-tests update`.\n\n#### Prerequisites\n\nRequires `pup` CLI installed and authenticated (`pup auth login`). See [Setup Pup](#setup-pup).\n\n#### Install\n\n```bash\n# Claude Code — copy any or all skills\ncp -r dd-software-delivery/unblock-pr ~/.claude/skills\ncp -r dd-software-delivery/triage-flaky-test ~/.claude/skills\n```\n\nOr via `npx`:\n\n```bash\nnpx skills add datadog-labs/agent-skills \\\n  --skill dd-software-delivery/unblock-pr \\\n  --skill dd-software-delivery/triage-flaky-test \\\n  --full-depth -y\n```\n\n#### Usage\n\n```\n# Investigate a failing PR\nunblock-pr                                    # auto-detects branch and repo from git\nunblock-pr my-feature-branch                  # explicit branch\nunblock-pr my-feature-branch github.com/org/repo\n\n# Triage a specific flaky test\ntriage-flaky-test TestMyFunc\ntriage-flaky-test com.example.MyTest github.com/org/repo\n```\n\n### Datadog Apps (dd-apps)\n\nThe `dd-apps` directory contains a skill for building [Datadog Apps](https://docs.datadoghq.com/developers/apps/) — locally-developed web apps built with TypeScript and React that integrate with Datadog surfaces.\n\n| Skill | Purpose |\n|-------|---------|\n| `datadog-app` | Scaffold, run locally, build, upload, publish, set up CI/CD, trigger Workflow Automation, and query data with DDSQL or Action Catalog |\n\n#### Prerequisites\n\nA Datadog account with an API key and application key that have Actions API Access enabled. See [App Builder Access and Authentication](https://docs.datadoghq.com/actions/app_builder/access_and_auth/).\n\n```bash\nexport DD_API_KEY=\"<YOUR_API_KEY>\"\nexport DD_APP_KEY=\"<YOUR_APPLICATION_KEY>\"\n```\n\nNode.js 20.19+ or 22.12+ is required. Use Volta, nvm, or fnm to manage versions.\n\n#### Install\n\n```bash\n# Claude Code\ncp -r dd-apps/datadog-app ~/.claude/skills\n```\n\nOr via npx:\n\n```bash\nnpx skills add datadog-labs/agent-skills \\\n  --skill datadog-app \\\n  --full-depth -y\n```\n\n#### Usage\n\n```\n# Scaffold a new app\nScaffold a new Datadog App called my-app\n\n# Run locally\nRun my Datadog App locally\n\n# Upload and publish\nUpload my app to Datadog\nHow do I publish my app?\n\n# Troubleshoot\nI'm getting a 401 error when uploading\nMy backend function isn't working\n\n# Query data\nQuery my app datastore with DDSQL\nTrigger a Workflow Automation workflow from a backend function\n```\n\n## Quick Reference\n\n| Task | Command |\n|------|---------|\n| Search error logs | `pup logs search --query \"status:error\" --from 1h` |\n| List monitors | `pup monitors list` |\n| Schedule monitor downtime | `pup downtime create --file downtime.json` |\n| Find slow traces | `pup traces search --query \"service:api @duration:>500ms\" --from 1h` |\n| Query metrics | `pup metrics query --query \"avg:system.cpu.user{*}\"` |\n| List services for an env (required) | `pup apm services list --env <env> --from 1h --to now` |\n| Check auth | `pup auth status` |\n| Refresh token | `pup auth refresh` |\n\nMore commands for `pup` are found in the [official pup docs](https://github.com/datadog-labs/pup/blob/main/docs/COMMANDS.md).\n\n## Auth\n\n```bash\n# Check auth first (includes token time remaining)\npup auth status\n\n# If commands fail with 401/403, try refresh first\npup auth refresh\n\n# If refresh fails or no session exists, do full OAuth login\npup auth login\n\n# Non-default site/org\npup auth login --site datadoghq.eu --org <org>\n```\n\nIf the browser opens the wrong profile/window, use the one-time URL printed by `pup auth login` and open it manually in the correct session.\n\n## More Skills\n\nAdditional skills available soon.\n\n```bash\n# List all available\nnpx skills add datadog-labs/agent-skills --list --full-depth\n```\n\n## License\n\nMIT\n",
  "bytes": 17379,
  "sha": "2fe2fed05f3d93943a78c12d69a64898841b05bed39fc2c94a8ffa35edfd39ac",
  "repo_slug": "datadog-labs/agent-skills",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/skl_datadog_labs_agent_skills_dd_docs_35d63d43/readme"
}