菜单
Full incident-response pipeline — declare → stabilize → investigate in parallel → root-cause → permanent fix → resolve → postmortem. Use when production is broken, degraded, or under attack. Triggers on: incident, down, outage, prod is broken, sev1, sev2.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Full adversarial change pipeline for modifying existing code. Use when changing behavior, updating features, refactoring logic, restructuring, or any alteration to existing source code. Ensures impact analysis, regression safety, and full planning before any code is touched. Triggers on: change, modify, update, refactor, restructure, alter.
Full adversarial implementation pipeline for features, bug fixes, refactors, and enhancements. Use when implementing any non-trivial task that needs the complete plan-critique-implement cycle. Triggers on: implement, deep implement, build feature, full pipeline.
Full project onboarding pipeline: discover, document, audit, test, and plan improvements for an existing codebase. Use when onboarding a new project, integrating the template into an existing repo, or running a comprehensive audit. Triggers on: onboard, onboard project, onboard codebase, project audit.
Testing conventions, TDD rules, and test quality standards. Use when writing tests, reviewing test code, setting up test infrastructure, or discussing test strategy. Covers unit tests, integration tests, test pyramid, parameterization, fixtures, and coverage targets.
Full workflow for REST/GraphQL API design, OpenAPI spec generation, endpoint validation, and versioning strategy. Use when designing new APIs, reviewing existing endpoints, or migrating API versions. Triggers on: API, endpoint, REST, GraphQL, OpenAPI, swagger.
Full workflow for database schema design, migration planning, query optimization, and SQL security. Use when designing new schemas, writing migrations, optimizing queries, or auditing database code. Triggers on: database, schema, migration, SQL, query optimization, EXPLAIN.
| name | incident-response |
| description | Full incident-response pipeline — declare → stabilize → investigate in parallel → root-cause → permanent fix → resolve → postmortem. Use when production is broken, degraded, or under attack. Triggers on: incident, down, outage, prod is broken, sev1, sev2. |
This skill runs the Incident Response Pipeline as defined in AGENTS.md.
Load this skill when the user reports any of:
Do not use this skill for:
Follow the canonical 7-phase pipeline:
docs/incidents/{YYYY-MM-DD-HHMM}_{slug}.md → initial comms.| Severity | Definition | Update cadence | Observation window |
|---|---|---|---|
| SEV1 | Customer-facing outage, data loss, revenue impact | 15 min | 30 min |
| SEV2 | Major degradation, partial outage, critical path slow | 30 min | 1 h |
| SEV3 | Minor degradation, single-tenant, cosmetic | 1 h | 4 h |
Even in a SEV1, query the Librarian first — but in fast mode: cached briefs are acceptable, index refresh is deferred to post-incident. Do NOT skip the Librarian — investigators need an up-to-date code/infrastructure brief, not raw source.
A single gate runs after Phase 7 (postmortem). This is a deliberate SEV1 speed exception to the standard 3-gate pattern; mitigation correctness is verified by telemetry in real time, not by a static gate. SEV2 / SEV3 may opt into 3 gates at the Commander's discretion.
.github/agents/incident-commander.agent.md — the Commander's responsibilitiesdocs/incidents/ — historical postmortems and runbooks