$ loading_
Run incident response workflows for triage, updates, coordination, and postmortems.
Copy the install command and let the AI configure it · recommended for beginners
Please install the "incident-response" skill from askskill: 1. Download https://raw.githubusercontent.com/anthropics/knowledge-work-plugins/main/engineering/skills/incident-response/SKILL.md 2. Save it as ~/.claude/skills/incident-response/SKILL.md 3. Reload skills and tell me it's ready
We have an incident and production is throwing widespread errors. Assess the initial severity, list immediate mitigation steps, who should be pulled in, and the response cadence for the next 30 minutes.
A structured incident response plan with severity, priorities, roles, and short-term actions.
Draft an incident status update based on this progress: the issue is traced to database connection pool exhaustion, service is partially restored, 15% of requests still fail, and the next update is in 20 minutes. Provide both an internal update and a customer-facing version.
Two clear, aligned status updates covering current state, impact, actions taken, and next update time.
The incident is resolved. Write a blameless postmortem from the following: start time 10:12, recovery time 11:03, root cause was a misconfiguration causing cache stampede, and the payment API experienced timeouts. Include timeline, impact assessment, root cause analysis, response steps, action items, and suggested owners.
A complete blameless postmortem document for team learning and follow-up actions.
If you see unfamiliar placeholders or need to check which tools are connected, see CONNECTORS.md.
Manage an incident from detection through postmortem.
/incident-response $ARGUMENTS
/incident-response new [description] # Start a new incident
/incident-response update [status] # Post a status update
/incident-response postmortem # Generate postmortem from incident data
If no mode is specified, ask what phase the incident is in.
┌─────────────────────────────────────────────────────────────────┐
│ INCIDENT RESPONSE │
├─────────────────────────────────────────────────────────────────┤
│ Phase 1: TRIAGE │
│ ✓ Assess severity (SEV1-4) │
│ ✓ Identify affected systems and users │
│ ✓ Assign roles (IC, comms, responders) │
│ │
│ Phase 2: COMMUNICATE │
│ ✓ Draft internal status update │
│ ✓ Draft customer communication (if needed) │
│ ✓ Set up war room and cadence │
│ │
│ Phase 3: MITIGATE │
│ ✓ Document mitigation steps taken │
│ ✓ Track timeline of events │
│ ✓ Confirm resolution │
│ │
│ Phase 4: POSTMORTEM │
│ ✓ Blameless postmortem document │
│ ✓ Timeline reconstruction │
│ ✓ Root cause analysis (5 whys) │
│ ✓ Action items with owners │
└─────────────────────────────────────────────────────────────────┘
| Level | Criteria | Response Time |
|---|---|---|
| SEV1 | Service down, all users affected | Immediate, all-hands |
| SEV2 | Major feature degraded, many users affected | Within 15 min |
| SEV3 | Minor feature issue, some users affected | Within 1 hour |
| SEV4 | Cosmetic or low-impact issue | Next business day |
Provide clear, factual updates at regular cadence. Include: what's happening, who's affected, what we're doing, when the next update is.
## Incident Update: [Title]
**Severity:** SEV[1-4] | **Status:** Investigating | Identified | Monitoring | Resolved
**Impact:** [Who/what is affected]
**Last Updated:** [Timestamp]
### Current Status
[What we know now]
### Actions Taken
- [Action 1]
- [Action 2]
### Next Steps
- [What's happening next and ETA]
### Timeline
| Time | Event |
|------|-------|
| [HH:MM] | [Event] |
## Postmortem: [Incident Title]
**Date:** [Date] | **Duration:** [X hours] | **Severity:** SEV[X]
**Authors:** [Names] | **Status:** Draft
### Summary
[2-3 sentence plain-language summary]
### Impact
- [Users affected]
- [Duration of impact]
- [Business impact if quantifiable]
### Timeline
| Time (UTC) | Event |
|------------|-------|
| [HH:MM] | [Event] |
### Root Cause
[Detailed explanation of what caused the incident]
### 5 Whys
1. Why did [symptom]? → [Because...]
2. Why did [cause 1]? → [Because...]
3. Why did [cause 2]? → [Because...]
4. Why did [cause 3]? → [Because...]
5. Why did [cause 4]? → [Root cause]
### What Went Well
- [Things that worked]
### What Went Poorly
- [Things that didn't work]
### Action Items
…
Review an analysis for methodology, accuracy, bias, and evidence support.
Generate people analytics reports on headcount, attrition, diversity, and org health.
Identify, categorize, and prioritize technical debt for smarter refactoring decisions.
Choose the right Zoom surface for a product use case with clear tradeoffs.
Turn an approved brief into social assets, copy, and a staged campaign.
Create stakeholder updates tailored to audience, cadence, and communication goals.
Safely triage incidents with evidence retrieval, ticket workflows, and notifications.
Triages issues with label-driven state transitions and durable, resumable records.
Helps users triage workspace content items for next-step handling.
Triage support tickets by priority, ownership, and duplicate or known issue checks.
Triage inbox messages, route intents, track replies, and generate follow-up summaries.
Create or update repeatable operational runbooks and incident response procedures.