Incident triage

Guides incident triage by establishing severity, ownership, and a testable first hypothesis.

49|11|Updated Jul 31, 2026
One-click install
npx skills add https://github.com/vstorm-co/agenticos --skill incident-triage-vstorm-co
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: Incident triage
Source: https://github.com/vstorm-co/agenticos/tree/main/backend/app/core/catalog/skill_gallery/software/incident-triage
Command: npx skills add https://github.com/vstorm-co/agenticos --skill incident-triage-vstorm-co

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? When an alert fires, teams often waste the critical first minutes debating causes instead of assessing impact. This Skill provides a structured triage method that turns an alert into a severity level, a named owner, and a disprovable first hypothesis within minutes. ## Core Features & Use Cases - Ordered impact assessment: Answers four questions in sequence — who is affected, what is broken, since when, and whether it is getting worse — to establish blast radius before cause. - Impact-based severity setting: Assigns severity from user impact rather than from a known cause, with a single named owner instead of a team. - Testable first hypothesis: Names the most recent change touching the failing path and defines how to disprove it in under five minutes. - Use Case: An on-call engineer receives a latency alert for one region. The Skill walks them through scoping the impact, declaring a severity with reasoning, identifying the last deployment on that path as the hypothesis, and posting a status update with a committed next update time. ## Quick Start Triage this alert: error rate spiked on the payments endpoint in eu-west starting 20 minutes ago, right after deploy 1.4.2.

Frequently Asked Questions about Incident triage

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I triage a production incident quickly?▼

Answer four questions in order: who is affected, what is broken, since when, and whether it is getting worse. Establish blast radius before investigating cause, then set severity from impact and assign one named owner.

How to set incident severity when the cause is unknown?▼

Set severity from user impact, never from cause. An unknown cause is not a reason to hold severity down. State the severity, the reason for it, and the single person who owns the incident now.

What makes a good first hypothesis during incident response?▼

Name the most recent change touching the failing path and state how to disprove it in under five minutes. A hypothesis that nobody can test quickly is a distraction and should be discarded.

What should an incident status update include?▼

Post what is known, what is not known, what is being tried, and the next update time. Missing a committed update time costs more trust than the outage itself.

When should you not speculate about incident cause?▼

Never speculate about cause in a customer-facing channel, and never close an incident before the follow-up items have owners. Keep causal discussion in internal channels until confirmed.