| name | incident |
| description | Document what happened during an incident. Creates a factual record of WHAT happened, not WHY. Use when an incident occurs and needs documentation. |
| disable-model-invocation | false |
| argument-hint | [description] |
| allowed-tools | Read, Grep, Glob, Write, Bash |
| effort | high |
| wrought | {"version":"1.0","tools":{"capabilities":["read_file","search_content","find_files","write_file","run_command"]},"platforms":{"claude-code":{"allowed-tools":"Read, Grep, Glob, Write, Bash","disable-model-invocation":false}},"agent":{"role":"Incident Documenter","expertise":["factual incident recording","chronological event documentation"],"non_goals":["root cause analysis","investigation","bug fixing"]},"execution":{"default_mode":"react","stop_conditions":["Incident report written to docs/incidents/","User instructed to stop"]},"output":{"format":"markdown","template":"docs/incidents/{YYYY-MM-DD_HHMM}_{name}.md","required_sections":["Incident title","Timeline","Impact","Current Status"],"prohibited_content":["speculation","blame","root cause claims"]},"pipeline":{"track":"reactive","standalone":true,"prerequisites":[],"produces":["docs/incidents/*.md"],"suggested_next":["investigate"]}} |
Incident Report Skill
Trigger: Use /incident {brief description} to document what happened during an incident.
Purpose: Create a factual record of WHAT happened. Not WHY — that's for /investigate and /rca-bugfix.
Pre-flight Check
This skill is standalone — it can be invoked at any time without prerequisites.
It is a pipeline entry point: it creates the incident report that downstream skills require.
If this invocation is part of an active workflow, check docs/findings/*_FINDINGS_TRACKER.md
for a relevant tracker and note it for context, but do not enforce stage requirements.
Instructions
- Gather facts from logs, user input, and system state
- Write a short, factual incident report to
docs/incidents/{YYYY-MM-DD_HHMM}_{name}.md
- Output the incident summary for use with
/investigate
- STOP and await further instructions
Do NOT proceed with investigation or root cause analysis — that is the job of /investigate and /rca-bugfix.
Incident Report Rules
- Factual only — describe what you observed, not what you assume
- Neutral language — no blame, no speculation, no opinions
- Chronological — events in order they occurred
- Specific — exact times (UTC), exact error messages, exact numbers
DO: "Backend returned 429 at 14:02:15 UTC"
DON'T: "Backend was overwhelmed" or "Rate limiting was misconfigured"
Report Template
Write to: docs/incidents/{YYYY-MM-DD_HHMM}_{name}.md
Example: docs/incidents/2026-01-22_1630_extraction_hung.md
# Incident: {Brief Title}
**Date**: {YYYY-MM-DD}
**Time**: {HH:MM} - {HH:MM} UTC
**Reported by**: {User / System / Monitoring}
**Status**: Open
---
## What Happened
{Chronological, factual description of events}
- {HH:MM:SS UTC}: {Event 1}
{HH:MM:SS UTC}: {Event 2}
{HH:MM:SS UTC}: {Event 3}
---
{Symptom 1}
{Symptom 2}
---
{System/component 1}
{System/component 2}
---
| Metric | Value |
|--------|-------|
| Records processed | X |
| Error count | X |
| Duration | X min |
---
