Individual skill

incident-commander

Use when declaring or running a production incident or outage, or writing its post-incident review. Classifies severity with incident_classifier.py, rebuilds the timeline with timeline_reconstructor.py and drafts the PIR with pir_generator.py. Security incidents: incident-response.

engineering-team/skills/incident-commander/SKILL.md

Read pinned source

Source commit 8f082544116fc0d014188e521ca40304cdfc86b0

What was checked

Matches the observed repository HEAD: Yes
Scanner rules are current: Yes
Repository scan complete: No
Skill scan complete: No
Observed behavior: Network or broad shell
Last checked: Nov 10, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings): 29,593
Repository last updated: Nov 5, 2026
License: MIT

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

agentic-ai Repository topic
anthropic-claude Repository topic
claude-ai Repository topic
claude-code Repository topic
claude-skills Repository topic
claude-code-skills Repository topic
ai-coding-agent Repository topic
claude-code-plugins Repository topic
developer-tools Repository topic
openai-codex Repository topic
writing Derived category
security Derived category

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files

README.mddoc · 7,541 bytes
SKILL.mdcore · 15,842 bytes
SKILL.mdcore · 15,842 bytes
SKILL.mdcore · 15,842 bytes
assets/incident_report_template.mddoc · 4,649 bytes
assets/runbook_template.mddoc · 9,709 bytes
assets/sample_incident_classification.jsonasset · 610 bytes
assets/sample_incident_data.jsonasset · 11,233 bytes
assets/sample_incident_pir_data.jsonasset · 3,253 bytes
assets/sample_timeline_events.jsonasset · 7,766 bytes
assets/simple_incident.jsonasset · 161 bytes
assets/simple_timeline_events.jsonasset · 734 bytes
expected_outputs/incident_classification_text_output.txtdoc · 1,557 bytes
expected_outputs/pir_markdown_output.mddoc · 3,302 bytes
expected_outputs/simple_incident_classification.txtdoc · 1,373 bytes
expected_outputs/timeline_reconstruction_text_output.txtdoc · 3,235 bytes
references/communication_templates.mddoc · 14,928 bytes
references/incident-response-framework.mddoc · 26,142 bytes
references/incident_severity_matrix.mddoc · 8,952 bytes
references/rca_frameworks_guide.mddoc · 15,641 bytes
references/reference-information.mddoc · 6,905 bytes
references/sla-management-guide.mddoc · 23,537 bytes
scripts/incident_classifier.pyruns · 34,889 bytes
scripts/pir_generator.pyruns · 69,566 bytes
scripts/timeline_reconstructor.pyruns · 40,229 bytes

Read excerpt


# Incident Commander Skill

**Category:** Engineering Team  
**Tier:** POWERFUL  
**Author:** Claude Skills Team  
**Version:** 1.0.0  
**Last Updated:** February 2026

## Overview

Incident response framework for **availability/reliability incidents** (outages, degradations, failed deploys): severity classification, timeline reconstruction, and post-incident review.

**This is NOT security incident triage.** For security events (ransomware, intrusion, data exfiltration, IOC analysis, NIST SP 800-61 forensics), route to `incident-response`. Both skills use SEV1-SEV4 labels; this one scores operational impact (users, revenue, SLA), while `incident-response` classifies attack types and forensic handling.