| name | incident-response |
| description | Handle active incidents — failing CI, production issues, runtime breakage, security alerts, agent failures. Stabilize first, diagnose second, fix third. Trigger on /incident-response, or when something is actively broken, CI is red, or emergency fixes are needed. |
| user-invocable | true |
| allowed-tools | Read, Grep, Glob, Bash, Edit |
Incident Response
Handle active incidents. Different from post-mortem — this is for during the incident, not after.
Workflow
1. Stabilize
- Stop the bleeding first. Rollback if needed.
- If the incident is ongoing, can you contain it? (disable feature, block traffic, revert deploy)
- Document what you know so far — timestamp, symptom, affected scope.
- Communicate status to stakeholders if applicable.
2. Diagnose
- What changed recently? (deploy, config, dependency, infrastructure)
- Is this a recurrence of a known issue?
- Gather evidence: logs, metrics, traces, error reports.
- Form a hypothesis and test it with the smallest possible experiment.
3. Fix or mitigate
- Fix — if root cause is clear and fix is safe, apply it.
- Mitigate — if root cause is unclear, apply temporary mitigation (rollback, disable, rate limit).
- Label mitigations clearly as temporary.
- Verify the fix/mitigation resolves the symptom.
4. Document
- Timeline: when detected, when stabilized, when resolved.
- Impact: what was affected, how many users, duration.
- Root cause (if known), fix applied, follow-up items.
- Link to post-mortem after incident is fully resolved.
5. Follow-up
- Create tickets for root cause fix (if only mitigation was applied).
- Schedule post-mortem if the incident was significant.
- Update runbooks, monitoring, or alerts based on lessons learned.
Rules
- Stabilize before deep diagnosis. Stop the bleeding first.
- Do not make the incident worse — prefer rollback over forward fix in uncertainty.
- Document in real-time, not from memory after the fact.
- Distinguish between mitigation and root cause fix in all communication.
Experience Log
This skill learns from experience. Mechanism:
- Read
.claude/experience/'"$s"'.md at skill start to benefit from past lessons.
- Write to
.claude/experience/'"$s"'.md after use if you learned something new.
- Format:
YYYY-MM-DD: <lesson> — one line per entry.
- Evolve: If the same issue repeats 3+ times, update this SKILL.md itself.
