incident-management

name	incident-management
version	0.1.0
description	Use this skill when managing production incidents, designing on-call rotations, writing runbooks, conducting post-mortems, setting up status pages, or running war rooms. Triggers on incident response, incident commander, on-call schedule, pager escalation, runbook authoring, post-incident review, blameless retro, status page updates, war room coordination, severity classification, and any task requiring structured incident lifecycle management.
category	operations
tags	["incidents","on-call","runbooks","post-mortems","status-pages","war-rooms"]
recommended_skills	["observability","site-reliability","security-incident-response","project-execution"]
platforms	["claude-code","gemini-cli","openai-codex"]
license	MIT
maintainers	[{"github":"maddhruv"}]

When this skill is activated, always start your first response with the 🧢 emoji.

Incident Management

Incident management is the structured practice of detecting, responding to, resolving, and learning from production failures. It spans the full incident lifecycle - from the moment an alert fires through war room coordination, customer communication via status pages, and the post-mortem that prevents recurrence. This skill provides actionable frameworks for each phase: on-call rotation design, runbook authoring, severity classification, war room protocols, status page communication, and blameless post-mortems. Built for engineering teams that want to move from chaotic firefighting to repeatable, calm incident response.

---

When to use this skill

Trigger this skill when the user:

• Needs to design or improve an on-call rotation or escalation policy
• Wants to write, review, or templatize a runbook for an alert or service
• Is conducting, writing, or facilitating a post-mortem / post-incident review
• Needs to set up or improve a status page and customer communication strategy
• Is running or setting up a war room for an active incident
• Wants to define severity levels or incident classification criteria
• Needs an incident commander playbook or role definitions
• Is building incident response tooling or automation

Do NOT trigger this skill for:

• Defining SLOs, SLIs, or error budgets without an incident context (use site-reliability skill)
• Infrastructure provisioning or deployment pipeline design (use CI/CD or cloud skills)

---

Key principles

1. Incidents are system failures, not people failures - Every incident reflects a gap in the system: missing automation, insufficient monitoring, unclear runbooks, or architectural fragility. Blaming individuals guarantees that problems get hidden instead of fixed. Design every process around surfacing systemic issues.

2. Preparation beats reaction - The quality of incident response is determined before the incident starts. Well-written runbooks, practiced war room protocols, pre-drafted status page templates, and clearly defined roles reduce mean-time-to-resolve far more than heroic debugging during the incident.

3. Communication is a first-class concern - Customers, stakeholders, and other engineering teams need timely, honest updates. A status page update every 30 minutes during an outage builds trust. Silence destroys it. Assign a dedicated communications role in every major incident.

4. Every incident must produce learning - An incident without a post-mortem is a wasted failure. The post-mortem is not paperwork - it is the mechanism that converts a bad experience into a durable improvement. Action items without owners and deadlines are wishes, not commitments.