Update to Incident Investigator

{
  "description": "Perform evidence-grounded causal analysis from completed or emerging incident findings. Use to distinguish immediate causes, contributing conditions, failed or absent controls, and systemic root causes.",
  "included_files": [],
  "name": "root-cause-analysis",
  "skill_md_contents": "---\nname: root-cause-analysis\ndescription: Perform evidence-grounded causal analysis from completed or emerging incident findings. Use to distinguish immediate causes, contributing conditions, failed or absent controls, and systemic root causes.\n---\n\n# Root Cause Analysis\n\nExplain how and why the incident occurred with causal claims traceable to evidence.\n\nFirst define the unwanted outcome and relevant boundary. Build the causal chain backward from the outcome, using a method suited to the evidence such as five-whys, causal-factor charting, barrier analysis, or change analysis. Use more than one lens when a single linear chain would hide interacting causes.\n\nFor every proposed cause, state:\n\n- the evidence supporting it;\n- the causal mechanism connecting it to the outcome;\n- whether it was necessary, sufficient, contributing, or severity-influencing;\n- plausible alternatives or disconfirming evidence;\n- confidence and remaining gaps.\n\nSeparate event-level actions and conditions from latent organizational factors. Analyze control design, availability, implementation, use, monitoring, and recovery. Do not label a person's error as a root cause without explaining the conditions that made it possible or likely. Do not infer causation from chronology or policy deviation alone.\n\nConclude with a concise causal statement or map, contributing factors, failed or missing barriers, systemic causes, uncertainty, and evidence needed to raise confidence. If findings are insufficient, provide hypotheses and validation needs rather than a definitive root cause.\n"
}