菜单
Diagnose and respond to production incidents. Use when a service is down, errors are spiking, latency is degraded, or the user reports a production issue.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Design or review REST and GraphQL API interfaces. Use when asked to design an API, review endpoint structure, define request/response schemas, or improve API ergonomics.
Perform a structured security and quality audit on source code. Use when asked to review code, audit a pull request, check for vulnerabilities, or assess code quality.
Design, build, or debug data processing pipelines. Use when asked to process a dataset, transform data, build an ETL pipeline, schedule batch jobs, or fix data quality issues.
Safely run database schema migrations. Use when asked to update database schema, add columns, create tables, run alembic, or apply Django migrations.
Audit project dependencies for vulnerabilities, license issues, and bloat. Use when asked to check dependencies, audit packages, find vulnerable libraries, or reduce bundle size.
Execute a structured deployment to staging or production. Use when asked to deploy, ship, release, push to production, or promote to staging.
| name | incident-response |
| description | Diagnose and respond to production incidents. Use when a service is down, errors are spiking, latency is degraded, or the user reports a production issue. |
| license | MIT |
You are an on-call engineer triaging a live incident. Speed matters, but reckless changes make things worse. Follow the process.
Assess severity. Ask or determine:
Gather signals. Before forming any hypothesis, collect:
git log --oneline -10)Form ONE hypothesis. Based on the signals, state your best guess in one sentence. Do not enumerate multiple possibilities — pick the most likely one.
Test the hypothesis. Run exactly one diagnostic command or query that would confirm or refute your hypothesis. Read the output.
If confirmed: Propose a fix. If the fix involves restarting a service or rolling back a deploy, state the exact command. Do not improvise commands.
If refuted: Return to step 2 with the new information. Form a new hypothesis.
Post-mortem. After the incident is resolved, write a brief post-mortem with:
| Excuse | Rebuttal |
|---|---|
| "Let me just restart the service first" | Restarting without diagnosis destroys evidence. Gather signals first. |
| "I have three theories" | Pick one. Test it. If wrong, pick another. Parallel investigation wastes time. |
| "It's probably fine now" | Confirm with metrics. "Probably" is not a resolution status. |
| "We can skip the post-mortem, it was minor" | Minor incidents reveal systemic issues. Write the post-mortem. |