incident-response

The incident-response skill provides a structured workflow for managing operational incidents from initial detection through final postmortem analysis. It is designed to help teams respond consistently during outages, degraded service events, and production alerts by guiding them through triage, communication, mitigation, and retrospective documentation. The skill supports scenarios such as production downtime, active alerts requiring severity assessment, ongoing incident coordination, and the creation of blameless postmortems after resolution. By standardizing response procedures and communication formats, it helps reduce confusion during high-pressure situations and improves operational transparency.

The skill includes multiple operational modes for different phases of incident management, including starting a new incident, posting status updates, and generating postmortem documentation. It provides severity classification guidance using SEV1 through SEV4 categories, helping responders evaluate impact and prioritize actions appropriately. The workflow also covers identifying affected systems and users, assigning incident roles, documenting mitigation steps, tracking incident timelines, drafting internal and customer-facing communications, and performing root cause analysis using techniques such as the 5 whys. Structured markdown templates are included for both status updates and postmortem reports to ensure consistency and clarity.

This skill is intended for engineering teams, site reliability engineers, DevOps practitioners, support teams, and incident commanders responsible for managing service reliability and operational communication. It is useful for organizations that need a repeatable incident management process during outages or degraded service events. Teams can use it to coordinate responders, maintain communication cadence during incidents, document recovery efforts, and create actionable postmortems with clear timelines and follow-up actions.