Skills › Knowledge Work Plugins › incident-response
incident-response
The facts
Its description
Run an incident response workflow — triage, communicate, and write postmortem. Trigger with "we have an incident", "production is down", an alert that needs severity assessment, a status update mid-incident, or when writing a blameless postmortem after resolution.
The description the agent reads to decide when to use it.
From its settingsline 3
When it starts
The agent picks this skill when someone reports a live production problem — an outage, a degraded service, or an alert that needs a severity call — or when someone asks for a status update during an incident or a blameless postmortem after it is resolved. It is a person-triggered workflow, not something another skill loads.
Things a person might say (the model's guesses)
- “Production is down for all users, we need to triage this now”
- “Here's the alert that just fired — what severity is this?”
- “Can you write the blameless postmortem for yesterday's outage?”
A model's summary of when it is used.
A model's reading
What it takes when started
<incident description or alert>
What to type after its name when you start it.
From its settingsline 4
Licence
Apache-2.0, from LICENSE
The terms its author shares it under, which let it be shown here.
From the repositorylicence text
The text
Most marks come from matching words in the file, so treat them as pointers.
1---
2name: incident-response
3description: Run an incident response workflow — triage, communicate, and write postmortem. Trigger with "we have an incident", "production is down", an alert that needs severity assessment, a status update mid-incident, or when writing a blameless postmortem after resolution.
4argument-hint: "<incident description or alert>"
5---
7# /incident-response
9> If you see unfamiliar placeholders or need to check which tools are connected, see [CONNECTORS.md](../../CONNECTORS.md).
11Manage an incident from detection through postmortem.
/incident-response
If you see unfamiliar placeholders or need to check which tools are connected, see CONNECTORS.md.
Manage an incident from detection through postmortem.
Raw lines 1 to 12Boilerplate, lines 13 to 18. The same text appears in 24 other files here. Close
19## Modes
21```
22/incident-response new [description] # Start a new incident
23/incident-response update [status] # Post a status update
24/incident-response postmortem # Generate postmortem from incident data
25```
27If no mode is specified, ask what phase the incident is in.
Modes
/incident-response new [description] # Start a new incident
/incident-response update [status] # Post a status update
/incident-response postmortem # Generate postmortem from incident dataIf no mode is specified, ask what phase the incident is in.
Raw lines 19 to 2829## How It Works
31```
32┌─────────────────────────────────────────────────────────────────┐
33│ INCIDENT RESPONSE │
34├─────────────────────────────────────────────────────────────────┤
35│ Phase 1: TRIAGE │
36│ ✓ Assess severity (SEV1-4) │
37│ ✓ Identify affected systems and users │
38│ ✓ Assign roles (IC, comms, responders) │
39│ │
40│ Phase 2: COMMUNICATE │
41│ ✓ Draft internal status update │
42│ ✓ Draft customer communication (if needed) │
43│ ✓ Set up war room and cadence │
44│ │
45│ Phase 3: MITIGATE │
46│ ✓ Document mitigation steps taken │
47│ ✓ Track timeline of events │
48│ ✓ Confirm resolution │
49│ │
50│ Phase 4: POSTMORTEM │
51│ ✓ Blameless postmortem document │
52│ ✓ Timeline reconstruction │
53│ ✓ Root cause analysis (5 whys) │
54│ ✓ Action items with owners │
55└─────────────────────────────────────────────────────────────────┘
56```
How It Works
┌─────────────────────────────────────────────────────────────────┐
│ INCIDENT RESPONSE │
├─────────────────────────────────────────────────────────────────┤
│ Phase 1: TRIAGE │
│ ✓ Assess severity (SEV1-4) │
│ ✓ Identify affected systems and users │
│ ✓ Assign roles (IC, comms, responders) │
│ │
│ Phase 2: COMMUNICATE │
│ ✓ Draft internal status update │
│ ✓ Draft customer communication (if needed) │
│ ✓ Set up war room and cadence │
│ │
│ Phase 3: MITIGATE │
│ ✓ Document mitigation steps taken │
│ ✓ Track timeline of events │
│ ✓ Confirm resolution │
│ │
│ Phase 4: POSTMORTEM │
│ ✓ Blameless postmortem document │
│ ✓ Timeline reconstruction │
│ ✓ Root cause analysis (5 whys) │
│ ✓ Action items with owners │
└─────────────────────────────────────────────────────────────────┘58## Severity Classification
60| Level | Criteria | Response Time |
61|-------|----------|---------------|
62| SEV1 | Service down, all users affected | Immediate, all-hands |
63| SEV2 | Major feature degraded, many users affected | Within 15 min |
64| SEV3 | Minor feature issue, some users affected | Within 1 hour |
65| SEV4 | Cosmetic or low-impact issue | Next business day |
Severity Classification
| Level | Criteria | Response Time |
|---|---|---|
| SEV1 | Service down, all users affected | Immediate, all-hands |
| SEV2 | Major feature degraded, many users affected | Within 15 min |
| SEV3 | Minor feature issue, some users affected | Within 1 hour |
| SEV4 | Cosmetic or low-impact issue | Next business day |
67## Communication Guidance
69Provide clear, factual updates at regular cadence. Include: what's happening, who's affected, what we're doing, when the next update is.
Communication Guidance
Provide clear, factual updates at regular cadence. Include: what's happening, who's affected, what we're doing, when the next update is.
Raw lines 67 to 7071## Output — Status Update
73```markdown
74## Incident Update: [Title]
75**Severity:** SEV[1-4] | **Status:** Investigating | Identified | Monitoring | Resolved
76**Impact:** [Who/what is affected]
77**Last Updated:** [Timestamp]
79### Current Status
80[What we know now]
82### Actions Taken
83- [Action 1]
84- [Action 2]
86### Next Steps
87- [What's happening next and ETA]
89### Timeline
90| Time | Event |
91|------|-------|
92| [HH:MM] | [Event] |
93```
Output — Status Update
## Incident Update: [Title]
**Severity:** SEV[1-4] | **Status:** Investigating | Identified | Monitoring | Resolved
**Impact:** [Who/what is affected]
**Last Updated:** [Timestamp]
### Current Status
[What we know now]
### Actions Taken
- [Action 1]
- [Action 2]
### Next Steps
- [What's happening next and ETA]
### Timeline
| Time | Event |
|------|-------|
| [HH:MM] | [Event] |95## Output — Postmortem
97```markdown
98## Postmortem: [Incident Title]
99**Date:** [Date] | **Duration:** [X hours] | **Severity:** SEV[X]
100**Authors:** [Names] | **Status:** Draft
102### Summary
103[2-3 sentence plain-language summary]
105### Impact
106- [Users affected]
107- [Duration of impact]
108- [Business impact if quantifiable]
110### Timeline
111| Time (UTC) | Event |
112|------------|-------|
113| [HH:MM] | [Event] |
115### Root Cause
116[Detailed explanation of what caused the incident]
118### 5 Whys
1191. Why did [symptom]? → [Because...]
1202. Why did [cause 1]? → [Because...]
1213. Why did [cause 2]? → [Because...]
1224. Why did [cause 3]? → [Because...]
1235. Why did [cause 4]? → [Root cause]
125### What Went Well
126- [Things that worked]
128### What Went Poorly
129- [Things that didn't work]
131### Action Items
132| Action | Owner | Priority | Due Date |
133|--------|-------|----------|----------|
134| [Action] | [Person] | P0/P1/P2 | [Date] |
136### Lessons Learned
137[Key takeaways for the team]
138```
Output — Postmortem
## Postmortem: [Incident Title]
**Date:** [Date] | **Duration:** [X hours] | **Severity:** SEV[X]
**Authors:** [Names] | **Status:** Draft
### Summary
[2-3 sentence plain-language summary]
### Impact
- [Users affected]
- [Duration of impact]
- [Business impact if quantifiable]
### Timeline
| Time (UTC) | Event |
|------------|-------|
| [HH:MM] | [Event] |
### Root Cause
[Detailed explanation of what caused the incident]
### 5 Whys
1. Why did [symptom]? → [Because...]
2. Why did [cause 1]? → [Because...]
3. Why did [cause 2]? → [Because...]
4. Why did [cause 3]? → [Because...]
5. Why did [cause 4]? → [Root cause]
### What Went Well
- [Things that worked]
### What Went Poorly
- [Things that didn't work]
### Action Items
| Action | Owner | Priority | Due Date |
|--------|-------|----------|----------|
| [Action] | [Person] | P0/P1/P2 | [Date] |
### Lessons Learned
[Key takeaways for the team]140## If Connectors Available
142If **~~monitoring** is connected:
143- Pull alert details and metrics
144- Show graphs of affected metrics
146If **~~incident management** is connected:
147- Create or update incident in PagerDuty/Opsgenie
148- Page on-call responders
150If **~~chat** is connected:
151- Post status updates to incident channel
152- Create war room channel
If Connectors Available
If ~~monitoring is connected:
- Pull alert details and metrics
- Show graphs of affected metrics
If ~~incident management is connected:
- Create or update incident in PagerDuty/Opsgenie
- Page on-call responders
If ~~chat is connected:
- Post status updates to incident channel
- Create war room channel
Uses an outside tool ~~monitoring :142
Uses an outside tool ~~incident :146
Uses an outside tool ~~chat :150
154## Tips
1561. **Start writing immediately** — Don't wait for complete information. Update as you learn more.
1572. **Keep updates factual** — What we know, what we've done, what's next. No speculation.
1583. **Postmortems are blameless** — Focus on systems and processes, not individuals.
Tips
- Start writing immediately — Don't wait for complete information. Update as you learn more.
- Keep updates factual — What we know, what we've done, what's next. No speculation.
- Postmortems are blameless — Focus on systems and processes, not individuals.
From anthropics/knowledge-work-plugins at 2574e29, 2026-10-27. Skills read by DeepSeek V4.1 Flash on 2026-11-04. Summary and techniques by Claude Opus 5.5 on 2026-11-06.