skills.rest
karenrebecag
karenrebecagCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

incident

Guides live incident response through triage, mitigation, timeline, and follow-up.

Updated Sep 17, 2026
Search Tags:#rollback#incident response#postmortem#triage#mitigation#severity#blameless
One-click install
npx skills add https://github.com/karenrebecag/spec-driven-standards --skill incident-karenrebecag
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: incident
Source: https://github.com/karenrebecag/spec-driven-standards/tree/main/plugins/reliability/skills/incident
Command: npx skills add https://github.com/karenrebecag/spec-driven-standards --skill incident-karenrebecag

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? When production breaks, teams often panic, chase root causes too early, and lose evidence. This Skill structures the live incident response so impact is contained first and learning happens after. ## Core Features & Use Cases - Severity triage: Declares SEV1-SEV4 levels based on impact to set urgency and staffing. - Structured response flow: Covers communication with an incident commander, evidence capture before logs rotate, mitigation via rollback or feature flags, and timeline reconstruction. - Blameless follow-up: Closes the loop by turning the postmortem into corrective actions with owners. - Use Case: Your API starts returning 500s after a deploy. Invoke the skill to declare a SEV2, capture logs and traces, roll back the release, and build the timeline for the postmortem. ## Quick Start Invoke /incident when something breaks in production and follow the guided triage, mitigation, and postmortem flow.

Frequently Asked Questions about incident

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I handle a production incident step by step?▼

Start with triage and severity declaration (SEV1-SEV4), assign an incident commander, capture logs and metrics before they rotate, then mitigate impact via rollback or feature flags. Reconstruct the timeline and convert the postmortem into owned corrective actions.

What severity levels should I use for incident triage?▼

Use four levels: SEV1 for total outage or data loss, SEV2 for severe degradation, SEV3 for partial impact, and SEV4 for minor issues. The severity defines urgency and who joins the response.

When should I investigate root cause during an incident?▼

Only after mitigation. The guiding principle is mitigate first, understand later: stop the bleeding with rollback or flags before investigating why the system failed.

What is a blameless postmortem?▼

A blameless postmortem analyzes the system that failed rather than the person involved. Well-run incidents produce improvements; poorly run ones produce fear of reporting problems.

When does an incident actually close?▼

An incident does not close when mitigation succeeds. It closes when the postmortem is converted into corrective actions with assigned owners, ensuring the failure leads to concrete improvements.

Related Skills

Explore More Software Engineering Skills→
DevelopersGlobalDevelopersGlobal
65

observability

Implement structured logging, distributed tracing, and alerting with OpenTelemetry.

Official
Advanced
timequitytimequity
6

postmortem-writing

Create blameless postmortems documenting root-cause analyses with structured markdown templates.

Official
Basic
bordenetbordenet
8

timeline-trace-investigator

Reconstruct incident timelines from distributed traces, logs, deployments, and metrics.

Community
Advanced
timequitytimequity
6

incident-response

Automate incident response with severity levels and runbooks for on-call teams.

Official
Intermediate