{
  "schema": "https://ai-atoms.com/schemas/skill-v1.json",
  "type": "skill",
  "id": "skill/incident-response",
  "version": "1.0.0",
  "name": "incident-response",
  "description": "Run an incident response workflow — triage, communicate, and write postmortem. Trigger with \"we have an incident\", \"production is down\", an alert that needs severity assessment, a status update mid-incident, or when writing a blameless postmortem after resolution.",
  "system_prompt_fragment": "# /incident-response\n\n> If you see unfamiliar placeholders or need to check which tools are connected, see [CONNECTORS.md](../../CONNECTORS.md).\n\nManage an incident from detection through postmortem.\n\n## Usage\n\n```\n/incident-response $ARGUMENTS\n```\n\n## Modes\n\n```\n/incident-response new [description]     # Start a new incident\n/incident-response update [status]       # Post a status update\n/incident-response postmortem            # Generate postmortem from incident data\n```\n\nIf no mode is specified, ask what phase the incident is in.\n\n## How It Works\n\n```\n┌─────────────────────────────────────────────────────────────────┐\n│                    INCIDENT RESPONSE                               │\n├─────────────────────────────────────────────────────────────────┤\n│  Phase 1: TRIAGE                                                  │\n│  ✓ Assess severity (SEV1-4)                                     │\n│  ✓ Identify affected systems and users                          │\n│  ✓ Assign roles (IC, comms, responders)                         │\n│                                                                    │\n│  Phase 2: COMMUNICATE                                              │\n│  ✓ Draft internal status update                                  │\n│  ✓ Draft customer communication (if needed)                     │\n│  ✓ Set up war room and cadence                                   │\n│                                                                    │\n│  Phase 3: MITIGATE                                                 │\n│  ✓ Document mitigation steps taken                               │\n│  ✓ Track timeline of events                                      │\n│  ✓ Confirm resolution                                            │\n│                                                                    │\n│  Phase 4: POSTMORTEM                                               │\n│  ✓ Blameless postmortem document                                 │\n│  ✓ Timeline reconstruction                                       │\n│  ✓ Root cause analysis (5 whys)                                  │\n│  ✓ Action items with owners                                      │\n└─────────────────────────────────────────────────────────────────┘\n```\n\n## Severity Classification\n\n| Level | Criteria | Response Time |\n|-------|----------|---------------|\n| SEV1 | Service down, all users affected | Immediate, all-hands |\n| SEV2 | Major feature degraded, many users affected | Within 15 min |\n| SEV3 | Minor feature issue, some users affected | Within 1 hour |\n| SEV4 | Cosmetic or low-impact issue | Next business day |\n\n## Communication Guidance\n\nProvide clear, factual updates at regular cadence. Include: what's happening, who's affected, what we're doing, when the next update is.\n\n## Output — Status Update\n\n```markdown\n## Incident Update: [Title]\n**Severity:** SEV[1-4] | **Status:** Investigating | Identified | Monitoring | Resolved\n**Impact:** [Who/what is affected]\n**Last Updated:** [Timestamp]\n\n### Current Status\n[What we know now]\n\n### Actions Taken\n- [Action 1]\n- [Action 2]\n\n### Next Steps\n- [What's happening next and ETA]\n\n### Timeline\n| Time | Event |\n|------|-------|\n| [HH:MM] | [Event] |\n```\n\n## Output — Postmortem\n\n```markdown\n## Postmortem: [Incident Title]\n**Date:** [Date] | **Duration:** [X hours] | **Severity:** SEV[X]\n**Authors:** [Names] | **Status:** Draft\n\n### Summary\n[2-3 sentence plain-language summary]\n\n### Impact\n- [Users affected]\n- [Duration of impact]\n- [Business impact if quantifiable]\n\n### Timeline\n| Time (UTC) | Event |\n|------------|-------|\n| [HH:MM] | [Event] |\n\n### Root Cause\n[Detailed explanation of what caused the incident]\n\n### 5 Whys\n1. Why did [symptom]? → [Because...]\n2. Why did [cause 1]? → [Because...]\n3. Why did [cause 2]? → [Because...]\n4. Why did [cause 3]? → [Because...]\n5. Why did [cause 4]? → [Root cause]\n\n### What Went Well\n- [Things that worked]\n\n### What Went Poorly\n- [Things that didn't work]\n\n### Action Items\n| Action | Owner | Priority | Due Date |\n|--------|-------|----------|----------|\n| [Action] | [Person] | P0/P1/P2 | [Date] |\n\n### Lessons Learned\n[Key takeaways for the team]\n```\n\n## If Connectors Available\n\nIf **~~monitoring** is connected:\n- Pull alert details and metrics\n- Show graphs of affected metrics\n\nIf **~~incident management** is connected:\n- Create or update incident in PagerDuty/Opsgenie\n- Page on-call responders\n\nIf **~~chat** is connected:\n- Post status updates to incident channel\n- Create war room channel\n\n## Tips\n\n1. **Start writing immediately** — Don't wait for complete information. Update as you learn more.\n2. **Keep updates factual** — What we know, what we've done, what's next. No speculation.\n3. **Postmortems are blameless** — Focus on systems and processes, not individuals.",
  "applicable_domains": [
    "code",
    "engineering",
    "architecture"
  ],
  "invocation": [
    "/incident-response",
    "/incident-response <incident description or alert>"
  ],
  "tags": [
    "engineering",
    "anthropics",
    "knowledge-work"
  ],
  "authored_by": "anthropics",
  "source_url": "https://github.com/anthropics/knowledge-work-plugins/blob/main/engineering/skills/incident-response/SKILL.md",
  "lifecycle": "stable",
  "category": "operations",
  "provenance": {
    "source": "anthropics/knowledge-work-plugins",
    "source_url": "https://github.com/anthropics/knowledge-work-plugins/blob/main/engineering/skills/incident-response/SKILL.md",
    "author": "Anthropic",
    "license": "Apache-2.0",
    "notes": "Imported by scripts/import-anthropic-skills.py."
  }
}