incident-responder skill

Overview

This skill provides a structured incident response workflow to manage production outages from detection through post-mortem. It guides responders through triage, containment, resolution, and documentation to minimize downtime and prevent recurrence. The skill emphasizes clear communication, rapid diagnosis, and actionable follow-ups.

How this skill works

The skill inspects incident context and walks teams through three core workflows: Triage, Resolution, and Post-Mortem. It prompts severity assessment, coordinates responders, suggests containment steps, and helps capture timelines and root-cause analysis. Outputs include status messages, verification checks, and a ready-to-share post-mortem draft.

When to use it

• A production service is degraded or unavailable
• Multiple users or customers report the same error or outage
• Unclear root cause after initial checks requiring coordinated responders
• When an incident must be documented for compliance or learning
• After resolution to conduct a formal post-mortem and assign action items

Best practices

• Confirm scope and impact before escalating to avoid unnecessary disruption
• Assign a single incident commander to coordinate communications and decisions
• Contain first, then fix: prioritize stopping customer impact over permanent changes
• Keep concise, timestamped timeline entries during the incident
• Create clear, actionable post-mortem items with owners and due dates

Example use cases

• Start triage when monitoring alerts indicate service latency or error spikes
• Assemble relevant engineers and stakeholders for a SEV1 outage
• Guide responders through containment when a database or cache is overwhelmed
• Draft a post-mortem with a 5 Whys root-cause section and tracked action items
• Run verification steps after a hotfix or rollback and publish status updates

FAQ