AutoGineer
Generated banner for Incident Response
Generated logo for Incident Response

Incident Response

AnthropicOfficialPublished by Anthropic

  • Skill
  • Workflow
  • Software development
  • Apache-2.0
  • No issues found
Download ZIP

From the author

Run an incident response workflow — triage, communicate, and write postmortem. Trigger with "we have an incident", "production is down", an alert that needs severity assessment, a status update mid-incident, or when writing a blameless postmortem after resolution.
— the description by Anthropic

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

The incident-response skill provides a standardized framework for handling service disruptions. It guides teams through the critical phases of incident management: triage and severity assessment, communication, mitigation tracking, and post-incident analysis. By enforcing a consistent structure for status updates and postmortem reports, it helps teams maintain clarity, accountability, and a blameless culture during high-pressure situations.

What it does

  • Assesses incident severity based on predefined impact criteria
  • Generates structured status updates for internal and external stakeholders
  • Facilitates the creation of blameless postmortem reports
  • Guides root cause analysis using the 5 Whys technique
  • Tracks incident timelines and mitigation actions
  • Supports integration with monitoring, chat, and incident management tools

When to use it

  • When a production service experiences downtime or degradation
  • When you need to perform a severity assessment on a new alert
  • When providing regular status updates during an active incident
  • When conducting a post-incident review to identify process improvements

Advantages

  • Reduces cognitive load during high-stress incidents
  • Ensures consistent communication across all stakeholders
  • Promotes a blameless culture focused on system improvements
  • Standardizes the documentation of root causes and action items

Usage examples

“/incident-response new Production API is returning 500 errors for all users.”
The agent initiates a new incident, assesses the severity as SEV1, and prompts for role assignments and initial mitigation steps.
“/incident-response update We have identified the database connection pool exhaustion and are restarting the services.”
The agent generates a formatted status update with the current status, actions taken, and next steps.
“/incident-response postmortem”
The agent compiles the collected incident data into a structured postmortem document, including the timeline, 5 Whys analysis, and action items.

Install

  1. Download the skill as a ZIP:

    https://autogineer.com/agent-skills/anthropics/incident-response/download

  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip incident-response.zip -d .agents/skills

Documentation by Anthropic

/incident-response

If you see unfamiliar placeholders or need to check which tools are connected, see CONNECTORS.md.

Manage an incident from detection through postmortem.

Usage

/incident-response $ARGUMENTS

Modes

/incident-response new [description]     # Start a new incident
/incident-response update [status]       # Post a status update
/incident-response postmortem            # Generate postmortem from incident data

If no mode is specified, ask what phase the incident is in.

How It Works

┌─────────────────────────────────────────────────────────────────┐
│                    INCIDENT RESPONSE                               │
├─────────────────────────────────────────────────────────────────┤
│  Phase 1: TRIAGE                                                  │
│  ✓ Assess severity (SEV1-4)                                     │
│  ✓ Identify affected systems and users                          │
│  ✓ Assign roles (IC, comms, responders)                         │
│                                                                    │
│  Phase 2: COMMUNICATE                                              │
│  ✓ Draft internal status update                                  │
│  ✓ Draft customer communication (if needed)                     │
│  ✓ Set up war room and cadence                                   │
│                                                                    │
│  Phase 3: MITIGATE                                                 │
│  ✓ Document mitigation steps taken                               │
│  ✓ Track timeline of events                                      │
│  ✓ Confirm resolution                                            │
│                                                                    │
│  Phase 4: POSTMORTEM                                               │
│  ✓ Blameless postmortem document                                 │
│  ✓ Timeline reconstruction                                       │
│  ✓ Root cause analysis (5 whys)                                  │
│  ✓ Action items with owners                                      │
└─────────────────────────────────────────────────────────────────┘

Severity Classification

LevelCriteriaResponse Time
SEV1Service down, all users affectedImmediate, all-hands
SEV2Major feature degraded, many users affectedWithin 15 min
SEV3Minor feature issue, some users affectedWithin 1 hour
SEV4Cosmetic or low-impact issueNext business day

Communication Guidance

Provide clear, factual updates at regular cadence. Include: what's happening, who's affected, what we're doing, when the next update is.

Output — Status Update

## Incident Update: [Title]
**Severity:** SEV[1-4] | **Status:** Investigating | Identified | Monitoring | Resolved
**Impact:** [Who/what is affected]
**Last Updated:** [Timestamp]

### Current Status
[What we know now]

### Actions Taken
- [Action 1]
- [Action 2]

### Next Steps
- [What's happening next and ETA]

### Timeline
| Time | Event |
|------|-------|
| [HH:MM] | [Event] |

Output — Postmortem

## Postmortem: [Incident Title]
**Date:** [Date] | **Duration:** [X hours] | **Severity:** SEV[X]
**Authors:** [Names] | **Status:** Draft

### Summary
[2-3 sentence plain-language summary]

### Impact
- [Users affected]
- [Duration of impact]
- [Business impact if quantifiable]

### Timeline
| Time (UTC) | Event |
|------------|-------|
| [HH:MM] | [Event] |

### Root Cause
[Detailed explanation of what caused the incident]

### 5 Whys
1. Why did [symptom]? → [Because...]
2. Why did [cause 1]? → [Because...]
3. Why did [cause 2]? → [Because...]
4. Why did [cause 3]? → [Because...]
5. Why did [cause 4]? → [Root cause]

### What Went Well
- [Things that worked]

### What Went Poorly
- [Things that didn't work]

### Action Items
| Action | Owner | Priority | Due Date |
|--------|-------|----------|----------|
| [Action] | [Person] | P0/P1/P2 | [Date] |

### Lessons Learned
[Key takeaways for the team]

If Connectors Available

If ~~monitoring is connected:

  • Pull alert details and metrics

  • Show graphs of affected metrics

If ~~incident management is connected:

  • Create or update incident in PagerDuty/Opsgenie

  • Page on-call responders

If ~~chat is connected:

  • Post status updates to incident channel

  • Create war room channel

Tips

  1. Start writing immediately — Don't wait for complete information. Update as you learn more.

  2. Keep updates factual — What we know, what we've done, what's next. No speculation.

  3. Postmortems are blameless — Focus on systems and processes, not individuals.

Files

Requirements and compatibility

Written for: Claude Code, Claude apps

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Claude Code frontmatter

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Published by
Anthropic
Publisher
Anthropic (Official)
Source
anthropics/knowledge-work-plugins · engineering/skills/incident-response · commit e050c2e
Licence
Apache License 2.0 (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced

AutoGineer is not affiliated with or endorsed by Anthropic or Anthropic.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download incident-response.zip