incident

Investigate production incidents and generate blameless postmortem documents from git and deploy history.

6|Updated Mar 27, 2026
One-click install
npx skills add https://github.com/greglas75/zuvo --skill incident-greglas75
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: incident
Source: https://github.com/greglas75/zuvo/tree/main/skills/incident
Command: npx skills add https://github.com/greglas75/zuvo --skill incident-greglas75

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? When production breaks, engineers lose time manually reconstructing what changed, which deploy caused it, and who was affected. This Skill automates incident triage, timeline reconstruction, root cause analysis, and postmortem writing so responders can focus on fixing the issue. ## Core Features & Use Cases - Timeline Construction: Builds a chronological timeline separating code commits from confirmed deploys using git history, GitHub Actions, Sentry, and platform deploy signals. - Root Cause Analysis: Ranks suspect commits by temporal proximity, code overlap, and risk area, assigning confidence levels (CONFIRMED, LIKELY, POSSIBLE, UNCONFIRMED) with revert safety checks. - Structured Postmortem: Generates a blameless postmortem document in docs/incidents/ with impact assessment, action items, and optional internal/customer communication templates. - Use Case: Payments start returning 500 errors. Run the skill with the symptom, a --since window, and --service flag to get a ranked suspect list, impact assessment, and a ready-to-share postmortem. ## Quick Start Ask the assistant to investigate the production incident where the payments endpoint returned 500 errors starting two hours ago, with severity 1 and communication templates included.

Frequently Asked Questions about incident

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I generate a postmortem from git history after a production incident?

Run the incident skill with a description of what broke and a --since window. It correlates commits, confirmed deploys, and Sentry errors into a timeline, ranks suspect commits, and writes a structured postmortem to docs/incidents/.

How does the skill identify which deploy caused an outage?

It builds a suspect window between the last known good deploy and the first error signal, then scores each commit on temporal proximity, code overlap with the affected service, and risk area match. Confidence levels range from CONFIRMED to UNCONFIRMED.

Does the incident skill work with Sentry error tracking?

Yes, if Sentry MCP tools are available it pulls recent issues, stack traces, affected user counts, and event frequency to correlate with the deploy timeline. Without Sentry it falls back to git history only.

Can the incident skill revert a bad commit automatically?

No. The skill is read-only and never executes git revert or modifies code. It suggests an exact revert command only when the suspect is a single non-merge commit with no dependents, and only when you pass --revert.

What flags does the incident response skill support?

Supported flags are --since for the incident start time, --service for the affected endpoint, --sev to override severity, --revert for revert suggestions, --comms for communication templates, and --dry-run to skip writing the postmortem file.