morning-briefing - SKILL.md Agent Skill

name: morning-briefing description: > Generate a concise daily infrastructure briefing. Covers: service health, resource usage, security events, overnight incidents, and cost tracking. Designed for Telegram/chat delivery. tools: - system_health - service_status - journal_logs - shell_exec - memory_recall - event_log - teach_patterns - teach_context activation: manual

Morning Briefing Skill

Generate a daily server briefing. Run this as part of the morning heartbeat.

Briefing Template

Gather data, then compose a message in this format:

Good morning. Here's your infrastructure report:

[SERVICE STATUS]
List each critical service with a status emoji:
  green = running and healthy
  yellow = running but degraded
  red = down or failing

[RESOURCE USAGE]
CPU average overnight, current memory, disk usage per mount.
Flag anything above threshold.

[OVERNIGHT EVENTS]
Summarize what happened while the user was asleep.
Include: auto-remediations, config changes, unusual activity.
Reference audit ledger entries.

[SECURITY]
Failed SSH attempts (count + notable IPs).
Any firewall blocks.
Port scan detection.
New or unexpected processes.

[COST]
Estimated daily server cost.
API call costs if tracked.

[SUMMARY]
One-line assessment: "All quiet" or "One incident overnight, resolved."

Data Collection

Run these in sequence:

System health overview
```
system_health()
```

Critical services check

service_status({ service: "agentd" })
service_status({ service: "osmoda-gateway" })
service_status({ service: "sshd" })
service_status({ service: "nginx" })  -- if configured

Overnight errors (last 12 hours)

journal_logs({ priority: "err", since: "12 hours ago", lines: 50 })

Security events

journal_logs({ unit: "sshd", since: "12 hours ago", lines: 30 })
shell_exec({ command: "journalctl -u sshd --since '12 hours ago' | grep 'Failed password\\|Invalid user' | wc -l" })

Audit log overnight activity
```
event_log({ limit: 20 })
```

Memory — overnight context

memory_recall({ query: "overnight incidents errors fixes", timeframe: "24h" })

teachd patterns — check for overnight trends and anomalies detected between conversations
```
teach_patterns({ min_confidence: 0.5 })
teach_context({ context: "overnight incidents failures resource trends" })
```
Include any detected patterns in the briefing under [OVERNIGHT EVENTS].

NixOS generation

shell_exec({ command: "nixos-rebuild list-generations | tail -5" })

Delivery Style

Be concise — this is scanned on a phone
Use emojis sparingly but effectively for status
Lead with the worst news if there is any
If everything is fine, say so in one line — don't pad
Include specific numbers — "CPU avg 12%" not "CPU was low"
Reference audit entries by number for traceability

Example Output

Good morning. Infrastructure report for Feb 20:

Services: agentd, osmoda-gateway, sshd, nginx — all running
Resources: CPU avg 11% overnight | RAM 4.1/7.6 GB | Disk 38%

Overnight: Quiet night. No incidents.
  - PostgreSQL connections peaked at 72/100 at 02:41 (normal range)
  - 1 NixOS garbage collection freed 2.3 GB (auto, audit #51)

Security: 7 failed SSH attempts from 3 IPs
  - 185.220.101.33 (Tor exit, 4 attempts) — already blocked
  - 2 other IPs, single attempts each — noise

Cost: ~$0.33/day (Hetzner CX22)

All systems nominal. Have a good day.