incident-response

Manage incidents through triage, status communication, and blameless postmortem generation.

Updated Jul 10, 2026
One-click install
npx skills add https://github.com/Kaleb-Rupe/aurora --skill incident-response-kaleb-rupe
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: incident-response
Source: https://github.com/Kaleb-Rupe/aurora/tree/main/claude/skills/incident-response
Command: npx skills add https://github.com/Kaleb-Rupe/aurora --skill incident-response-kaleb-rupe

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? When production goes down or an alert fires, teams scramble to assess severity, coordinate responders, communicate status, and later reconstruct what happened. This Skill provides a structured workflow covering the full incident lifecycle so nothing falls through the cracks. ## Core Features & Use Cases - Severity Triage: Classify incidents as SEV1 through SEV4 with defined response-time expectations and role assignments (incident commander, comms, responders). - Status Communication: Generate structured status updates covering current state, actions taken, next steps, and an event timeline for internal and customer audiences. - Blameless Postmortems: Produce postmortem documents with timeline reconstruction, 5-whys root cause analysis, and prioritized action items with owners. - Use Case: Your monitoring system fires an alert that the checkout API is returning 500s. Invoke the skill with the alert description to classify severity, draft a status update for stakeholders, and later generate the postmortem once resolved. ## Quick Start Ask the assistant to start an incident response for the production outage affecting the checkout API and classify its severity.

Frequently Asked Questions about incident-response

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I write a blameless postmortem after an incident?

Use the postmortem mode to generate a document with summary, impact, timeline, root cause, and a 5-whys analysis. It focuses on systems and processes rather than individuals, and ends with action items assigned to owners with priorities and due dates.

How do I classify incident severity as SEV1 through SEV4?

Severity is based on user impact: SEV1 means service down for all users requiring immediate all-hands response, SEV2 is major feature degradation, SEV3 is minor feature issues, and SEV4 covers cosmetic or low-impact problems handled next business day.

What should an incident status update include?

A status update includes the severity level, current status (investigating, identified, monitoring, or resolved), who is affected, actions taken, next steps with ETA, and a timestamped event timeline. Updates should be factual and posted at a regular cadence.

Can this skill integrate with PagerDuty or monitoring tools?

Yes, when monitoring, incident management, or chat connectors are connected, it can pull alert details and metrics, create or update incidents in PagerDuty or Opsgenie, page on-call responders, and post updates to incident channels.

When should I start writing incident documentation?

Start writing immediately at detection rather than waiting for complete information. Document mitigation steps and timeline events as they happen, then update the record as you learn more throughout the incident.