Individual skill
responding-to-incidents
Runs a live incident the stabilize-first way — name a commander, separate facts from hypotheses, prefer reversible actions, communicate on a cadence, and drive corrective actions to closure. Use when production is broken, data is at risk, or an agent action caused harm. Do not use for routine non-incident work, or as a substitute for the post-incident learning record.
skills/responding-to-incidents/SKILL.md
Source commit e44af0e5811e11a3601625cf657d257915689deb
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- Yes
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Instructions only
- Last checked
- Nov 6, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 33
- Repository last updated
- Nov 6, 2026
- License
- MIT
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- agent-skills Repository topic
- ai-agents Repository topic
- ai-safety Repository topic
- coding-agents Repository topic
- configuration-management Repository topic
- developer-tools Repository topic
- prompt-engineering Repository topic
- software-engineering Repository topic
- data Derived category
- education Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Read excerpt
# Responding to Incidents
## Overview
In a casualty you stabilize first and analyze second. An incident is run by one named commander, keeps known facts separate from guesses, prefers reversible moves while the picture is unclear, communicates on a fixed cadence, and does not close until corrective actions are tracked to done. The goal is to stop the harm and preserve the truth of what happened, not to find blame in the moment.
## Decision contract
- **Claim checked:** the incident has one named commander, a timeline that keeps confirmed facts separate from hypotheses, and corrective actions that each carry an owner and a definition of done -- none left as "we should."
- **Artifact observed:** the current symptom, what changed, who can authorize rollbacks/failovers/comms, and the reversible actions available -> an `incident.md` (timeline, facts-vs-hypotheses, decisions, comms), owned corrective actions with closure triggers, and a handoff to learning and deficiency records.
- **Decision affected:** block -- whether the incident is stabilized and its corrective actions are owned with closure triggers (it stays open until then).
- **Failure class:** premature-incident-close (closed with unowned actions, or a hypothesis recorded as fact).
- **Next action:** stop a proposed irreversible fix until the cause is confirmed or risk is accepted by a named owner; keep the incident open until actions are owned.
