feat: add datadog-error-monitor skill

AGENTS.md

@@ -105,6 +105,7 @@ When editing or adding skills in this repo, follow these rules (and add new skil
 ## CI / validation gotchas
 
 - The test suite expects **every directory under `skills/`** to be listed in a marketplace. If you add a new skill (or rebase onto a main branch that added skills), update the appropriate marketplace file or CI will fail with `Skills missing from marketplace: [...]`.
+- `skills/index.js` embeds the **full text** of every `SKILL.md`. Any commit that modifies a `skills/*/SKILL.md` must also include a regenerated `skills/index.js` (run `node scripts/build-skills-catalog.mjs`), or `test_index_is_up_to_date` will fail.
 - `scripts/sync_extensions.py` keeps generated artifacts in sync: Claude Code command files, README catalog section, coverage checks, and vendor symlinks. Run `python scripts/sync_extensions.py --check` (or just push — CI runs it) to verify everything is consistent. Run without `--check` to auto-fix. The "Quick Start" section in `README.md` (OpenHands SDK, Claude Code, and Codex setup instructions) is **manually maintained** above the auto-generated catalog markers and is intentionally not generated by the sync script.
 - The sync script uses PyYAML to parse SKILL.md frontmatter. If you add a skill with a slash trigger (e.g., `triggers: ["/mycommand"]`), the script auto-generates `commands/mycommand.md`. **Note:** Slash triggers in SKILL.md frontmatter are deprecated — prefer adding a `commands/command-name.md` file to the plugin's `commands/` directory instead. Keyword triggers (non-slash) remain the recommended way to activate skills by topic.
 

README.md

@@ -60,7 +60,7 @@ See [`integrations/README.md`](integrations/README.md), [`automations/README.md`
 ## Extensions Catalog
 
 <!-- BEGIN AUTO-GENERATED CATALOG -->
-This repository contains **2 marketplace(s)** with **57 extensions** (47 skills, 10 plugins).
+This repository contains **2 marketplace(s)** with **58 extensions** (48 skills, 10 plugins).
 
 ### large-codebase
 
@@ -79,7 +79,7 @@ OpenHands skills for interacting, improving, and refactoring large codebases
 
 Official skills and plugins for OpenHands — the open-source AI software engineer.
 
-**53 extensions** (45 skills, 8 plugins)
+**54 extensions** (46 skills, 8 plugins)
 
 | Name | Type | Description | Commands |
 |------|------|-------------|----------|
@@ -93,6 +93,7 @@ Official skills and plugins for OpenHands — the open-source AI software engine
 | code-review | skill | Rigorous code review focusing on data structures, simplicity, security, pragmatism, and risk/safety evaluation. Provi... | `/codereview`, `/codereview-roasted` |
 | code-simplifier | skill | Simplifies and refines code across three dimensions - code reuse, code quality, and efficiency - while preserving all... | `/simplify` |
 | datadog | skill | Query and analyze Datadog logs, metrics, APM traces, and monitors using the Datadog API. Use when debugging productio... | — |
+| datadog-error-monitor | skill | Create a cron automation that polls Datadog logs every 15 minutes, maintains a self-evolving regex-based error patter... | `/datadog-monitor:setup` |
 | deno | skill | Common project operations using Deno (tasks, run/test/lint/fmt, and dependency management). | — |
 | discord | skill | Build and automate Discord integrations (bots, webhooks, slash commands, and REST API workflows). Use when the user m... | — |
 | docker | skill | Run Docker commands within a container environment, including starting the Docker daemon and managing containers. Use... | — |

automations/catalog/datadog-error-monitor.json

@@ -0,0 +1,11 @@
+{
+  "id": "datadog-error-monitor",
+  "name": "Datadog error monitor",
+  "category": "Developer tools",
+  "description": "Poll Datadog logs for new or spiking errors, investigate root causes in your codebase, and post a Slack summary with optional PR fixes.",
+  "requiredIntegrationIds": ["datadog", "slack"],
+  "popularityRank": 80,
+  "estimatedSetupMinutes": 10,
+  "prompt": "/datadog-monitor:setup",
+  "exampleImplementation": "Trigger: cron, every 15 minutes\nRequired secrets: DD_API_KEY, DD_APP_KEY, SLACK_BOT_TOKEN\n\n1. Query Datadog logs using a configured filter (e.g. service:api status:error).\n2. Match log events against a regex-based error pattern library stored in a state file.\n3. Track hit counts per pattern; detect spikes (count > 3× rolling baseline).\n4. TODO: configure Datadog query, Slack alert channel, and local repo paths.\n5. When new or spiking errors are found, start an investigation conversation.\n6. The agent categorizes unknown errors into named patterns, investigates root causes in the configured codebases, creates a PR if confident, and posts a Slack summary."
+}

automations/index.js

@@ -5,6 +5,7 @@ import slack_channel_monitor from "./catalog/slack-channel-monitor.json" with {
 import linear_triage_assistant from "./catalog/linear-triage-assistant.json" with { type: "json" };
 import research_brief_writer from "./catalog/research-brief-writer.json" with { type: "json" };
 import incident_retrospective_drafter from "./catalog/incident-retrospective-drafter.json" with { type: "json" };
+import datadog_error_monitor from "./catalog/datadog-error-monitor.json" with { type: "json" };
 
 export const AUTOMATION_CATALOG = [
   github_pr_reviewer,
@@ -14,5 +15,6 @@ export const AUTOMATION_CATALOG = [
   linear_triage_assistant,
   research_brief_writer,
   incident_retrospective_drafter,
+  datadog_error_monitor,
 ];
 export default AUTOMATION_CATALOG;

integrations/catalog/datadog.json

@@ -0,0 +1,27 @@
+{
+  "id": "datadog",
+  "name": "Datadog",
+  "description": "Query logs, metrics, APM traces, and monitors via the Datadog REST API.",
+  "docsUrl": "https://docs.datadoghq.com/api/latest/",
+  "iconBg": "#632CA6",
+  "keywords": [
+    "monitoring",
+    "logs",
+    "metrics",
+    "observability",
+    "apm",
+    "errors",
+    "alerts"
+  ],
+  "kind": "http",
+  "defaultConnectionOptionId": "api",
+  "connectionOptions": [
+    {
+      "id": "api",
+      "provider": "http",
+      "auth": {
+        "strategy": "api_key"
+      }
+    }
+  ]
+}

marketplaces/openhands-extensions.json

@@ -5,15 +5,15 @@
     "email": "contact@all-hands.dev"
   },
   "metadata": {
-    "description": "Official skills and plugins for OpenHands \u2014 the open-source AI software engineer.",
+    "description": "Official skills and plugins for OpenHands — the open-source AI software engineer.",
     "maintainer": "OpenHands",
     "homepage": "https://github.com/OpenHands/extensions"
   },
   "plugins": [
     {
       "name": "agent-creator",
       "source": "./skills/agent-creator",
-      "description": "Create file-based sub-agents as Markdown files \u2014 no Python code required. Guides the user through a structured interview and generates a ready-to-deploy .md agent file following the OpenHands SDK specification.",
+      "description": "Create file-based sub-agents as Markdown files — no Python code required. Guides the user through a structured interview and generates a ready-to-deploy .md agent file following the OpenHands SDK specification.",
       "category": "development",
       "keywords": [
         "agent",
@@ -165,6 +165,23 @@
         "apm"
       ]
     },
+    {
+      "name": "datadog-error-monitor",
+      "source": "./skills/datadog-error-monitor",
+      "description": "Create a cron automation that polls Datadog logs every 15 minutes, maintains a self-evolving regex-based error pattern library, and triggers an OpenHands investigation conversation when new or spiking errors are detected. The agent categorizes unknown errors, investigates root causes in local codebases, optionally creates PRs, and posts a summary to Slack.",
+      "category": "monitoring",
+      "keywords": [
+        "datadog",
+        "monitoring",
+        "errors",
+        "logs",
+        "alerting",
+        "cron",
+        "automation",
+        "slack",
+        "investigation"
+      ]
+    },
     {
       "name": "deno",
       "source": "./skills/deno",
@@ -391,7 +408,7 @@
     {
       "name": "openhands",
       "source": "./plugins/openhands",
-      "description": "Unified OpenHands plugin \u2014 bundles Cloud CLI, REST API (openhands-api), and Automations (openhands-automation) into a single plugin.",
+      "description": "Unified OpenHands plugin — bundles Cloud CLI, REST API (openhands-api), and Automations (openhands-automation) into a single plugin.",
       "category": "openhands",
       "keywords": [
         "openhands",
@@ -432,7 +449,7 @@
     {
       "name": "pr-review",
       "source": "./plugins/pr-review",
-      "description": "Automated PR code review \u2014 analyzes diffs and posts inline review comments via the GitHub API.",
+      "description": "Automated PR code review — analyzes diffs and posts inline review comments via the GitHub API.",
       "category": "code-quality",
       "keywords": [
         "pr-review",
@@ -444,7 +461,7 @@
     {
       "name": "qa-changes",
       "source": "./plugins/qa-changes",
-      "description": "Validate pull request changes by actually running the code \u2014 setting up the environment, exercising changed behavior, and posting a structured QA report.",
+      "description": "Validate pull request changes by actually running the code — setting up the environment, exercising changed behavior, and posting a structured QA report.",
       "category": "quality-assurance",
       "keywords": [
         "qa",
@@ -593,7 +610,7 @@
     {
       "name": "iterate",
       "source": "./skills/iterate",
-      "description": "Iterate on a GitHub pull request \u2014 drive it through CI, code review, and QA until merge-ready. Monitors state, fixes failures, addresses review feedback, retries flaky checks, and pushes fixes in one continuous loop.",
+      "description": "Iterate on a GitHub pull request — drive it through CI, code review, and QA until merge-ready. Monitors state, fixes failures, addresses review feedback, retries flaky checks, and pushes fixes in one continuous loop.",
       "category": "productivity",
       "keywords": [
         "github",

skills/datadog-error-monitor/.claude-plugin

@@ -0,0 +1 @@
+.plugin

skills/datadog-error-monitor/.codex-plugin

@@ -0,0 +1 @@
+.plugin

skills/datadog-error-monitor/.plugin/plugin.json

@@ -0,0 +1,23 @@
+{
+  "name": "datadog-error-monitor",
+  "version": "1.0.0",
+  "description": "Create a cron automation that polls Datadog logs every 15 minutes, maintains a self-evolving regex-based error pattern library, and triggers an OpenHands investigation conversation when new or spiking errors are detected. The agent categorizes unknown errors, investigates root causes in local codebases, optionally creates PRs, and posts a summary to Slack.",
+  "author": {
+    "name": "OpenHands",
+    "email": "contact@all-hands.dev"
+  },
+  "homepage": "https://github.com/OpenHands/extensions",
+  "repository": "https://github.com/OpenHands/extensions",
+  "license": "MIT",
+  "keywords": [
+    "datadog",
+    "monitoring",
+    "errors",
+    "logs",
+    "alerting",
+    "cron",
+    "automation",
+    "slack",
+    "investigation"
+  ]
+}

skills/datadog-error-monitor/README.md

@@ -0,0 +1,92 @@
+# datadog-error-monitor
+
+An OpenHands skill that creates an automated Datadog error monitoring loop.
+
+## What it does
+
+A cron automation runs every 15 minutes, querying Datadog logs with a
+pre-configured filter. It maintains a library of known error patterns (regex-based)
+and their historical hit counts. When something new or anomalous is detected, it
+starts an OpenHands investigation conversation that diagnoses the problem,
+optionally creates a PR fix, and posts a summary to Slack.
+
+```
+Every 15 min
+     │
+     ▼
+Query Datadog ──► Match against known patterns ──► Update run_history
+     │
+     ├── Unknown logs? ──────────────────────────────────────────────┐
+     │                                                               │
+     └── Any pattern spiked (count > 3× baseline)?──────────────────┤
+                                                                     │
+                                                               Start one
+                                                           investigation
+                                                            conversation
+                                                                     │
+                                                    ┌────────────────┘
+                                                    │
+                                          Agent categorizes errors,
+                                        investigates code, creates PR
+                                        if confident, posts to Slack
+```
+
+## Prerequisites
+
+- OpenHands running in local mode
+- Datadog credentials: `DD_API_KEY` + `DD_APP_KEY` + `DD_SITE`
+- Slack bot token: `SLACK_BOT_TOKEN` with `chat:write` scope
+- Local code repositories (already cloned) for root-cause investigation
+- Git host token (`GITHUB_PERSONAL_ACCESS_TOKEN`, `GITLAB_TOKEN`, or `BITBUCKET_TOKEN`) for PR creation
+
+## Setup
+
+Load this skill in OpenHands and it will guide you through a setup conversation:
+
+1. Verify Datadog credentials and confirm your site region
+2. Define the log query (tested live against your Datadog org)
+3. Configure the Slack channel for summaries
+4. Register local repository paths and git host tokens
+5. Tune optional parameters (max log samples, examples per pattern, spike threshold)
+6. Dry-run the query and confirm before deploying
+
+The skill then packages and deploys the automation automatically.
+
+## How patterns work
+
+The pattern library is empty on first run — the system builds it organically:
+
+- **First run:** All logs are uncategorized. The investigation agent groups them
+  into named patterns with regex matchers and writes these to the state file.
+- **Subsequent runs:** Logs are matched against known patterns. Only spikes or
+  genuinely new error types trigger an investigation.
+- **Over time:** The pattern library grows and stabilises. Investigations become
+  rarer and more targeted.
+
+Patterns are stored in the state file at:
+```
+~/.openhands/workspaces/automation-state/dd_monitor_{automation_id}.json
+```
+
+You can inspect and edit this file at any time to rename patterns, fix regexes,
+or remove stale entries. Deleting the file resets the system.
+
+## Token efficiency
+
+The script itself is deterministic — no LLM calls on quiet runs. An OpenHands
+conversation is only started when one of these conditions is met:
+- At least one log event matched no known pattern
+- At least one pattern's count exceeded `mean(last 3 runs) × spike_multiplier`
+
+One conversation handles all triggers from a given run. A second conversation
+cannot start until the first finishes.
+
+## Files
+
+| File | Purpose |
+|---|---|
+| `SKILL.md` | Step-by-step setup workflow for the OpenHands agent |
+| `scripts/main.py` | Cron script template (customised at automation-creation time) |
+| `references/state-schema.md` | State file JSON schema and agent write protocol |
+| `references/datadog-api.md` | Datadog API reference (auth, log search, rate limits) |
+| `references/agent-prompt-template.md` | Investigation prompt structure and token budget notes |