Incident Response

by anthropicsae1513ea94dcNo license27K starsListed Oct 8, 2026Updated Oct 8, 2026Repository updated today

Run an incident response workflow — triage, communicate, and write postmortem. Trigger with "we have an incident", "production is down", an alert that needs severity assessment, a status update mid-incident, or when writing a blameless postmortem after resolution.

FeaturedInstructions onlyDevOps & Cloud Communication

AI-generated overview

Guides an incident response workflow: severity triage, status updates, mitigation tracking, and blameless postmortems.

What it does: This skill walks an agent through managing an incident across four phases: triage, communicate, mitigate, and postmortem. It provides severity classification criteria (SEV1-4), communication guidance, and markdown templates for status updates and blameless postmortem documents including timelines, 5 Whys root cause analysis, and action items with owners. It also describes optional connector integrations for monitoring, incident management, and chat tools.
When to use it: Use it when an incident is declared, such as production being down or an alert needing severity assessment, or when posting a mid-incident status update. It is also intended for writing a blameless postmortem after resolution.
Requirements: No scripts are shipped; it is instructions only. Optional connectors for monitoring, incident management (e.g. PagerDuty/Opsgenie), and chat are referenced but not required.

/incident-response

If you see unfamiliar placeholders or need to check which tools are connected, see CONNECTORS.md.

Manage an incident from detection through postmortem.

Usage

Modes

/incident-response new [description]     # Start a new incident/incident-response update [status]       # Post a status update/incident-response postmortem            # Generate postmortem from incident data

/incident-response new [description]     # Start a new incident/incident-response update [status]       # Post a status update/incident-response postmortem            # Generate postmortem from incident data

If no mode is specified, ask what phase the incident is in.

How It Works

┌─────────────────────────────────────────────────────────────────┐│                    INCIDENT RESPONSE                               │├─────────────────────────────────────────────────────────────────┤│  Phase 1: TRIAGE                                                  ││  ✓ Assess severity (SEV1-4)                                     ││  ✓ Identify affected systems and users                          ││  ✓ Assign roles (IC, comms, responders)                         ││                                                                    ││  Phase 2: COMMUNICATE                                              ││  ✓ Draft internal status update                                  ││  ✓ Draft customer communication (if needed)                     ││  ✓ Set up war room and cadence                                   ││                                                                    ││  Phase 3: MITIGATE                                                 ││  ✓ Document mitigation steps taken                               ││  ✓ Track timeline of events                                      ││  ✓ Confirm resolution                                            ││                                                                    ││  Phase 4: POSTMORTEM                                               ││  ✓ Blameless postmortem document                                 ││  ✓ Timeline reconstruction                                       ││  ✓ Root cause analysis (5 whys)                                  ││  ✓ Action items with owners                                      │└─────────────────────────────────────────────────────────────────┘

┌─────────────────────────────────────────────────────────────────┐│                    INCIDENT RESPONSE                               │├─────────────────────────────────────────────────────────────────┤│  Phase 1: TRIAGE                                                  ││  ✓ Assess severity (SEV1-4)                                     ││  ✓ Identify affected systems and users                          ││  ✓ Assign roles (IC, comms, responders)                         ││                                                                    ││  Phase 2: COMMUNICATE                                              ││  ✓ Draft internal status update                                  ││  ✓ Draft customer communication (if needed)                     ││  ✓ Set up war room and cadence                                   ││                                                                    ││  Phase 3: MITIGATE                                                 ││  ✓ Document mitigation steps taken                               ││  ✓ Track timeline of events                                      ││  ✓ Confirm resolution                                            ││                                                                    ││  Phase 4: POSTMORTEM                                               ││  ✓ Blameless postmortem document                                 ││  ✓ Timeline reconstruction                                       ││  ✓ Root cause analysis (5 whys)                                  ││  ✓ Action items with owners                                      │└─────────────────────────────────────────────────────────────────┘

Severity Classification

Level	Criteria	Response Time
SEV1	Service down, all users affected	Immediate, all-hands
SEV2	Major feature degraded, many users affected	Within 15 min
SEV3	Minor feature issue, some users affected	Within 1 hour
SEV4	Cosmetic or low-impact issue	Next business day

Communication Guidance

Provide clear, factual updates at regular cadence. Include: what's happening, who's affected, what we're doing, when the next update is.

Output — Status Update

markdown

## Incident Update: [Title]**Severity:** SEV[1-4] | **Status:** Investigating | Identified | Monitoring | Resolved**Impact:** [Who/what is affected]**Last Updated:** [Timestamp]
### Current Status[What we know now]
### Actions Taken- [Action 1]- [Action 2]
### Next Steps- [What's happening next and ETA]
### Timeline| Time | Event ||------|-------|| [HH:MM] | [Event] |

## Incident Update: [Title]**Severity:** SEV[1-4] | **Status:** Investigating | Identified | Monitoring | Resolved**Impact:** [Who/what is affected]**Last Updated:** [Timestamp]
### Current Status[What we know now]
### Actions Taken- [Action 1]- [Action 2]
### Next Steps- [What's happening next and ETA]
### Timeline| Time | Event ||------|-------|| [HH:MM] | [Event] |

Output — Postmortem

markdown

## Postmortem: [Incident Title]**Date:** [Date] | **Duration:** [X hours] | **Severity:** SEV[X]**Authors:** [Names] | **Status:** Draft
### Summary[2-3 sentence plain-language summary]
### Impact- [Users affected]- [Duration of impact]- [Business impact if quantifiable]
### Timeline| Time (UTC) | Event ||------------|-------|| [HH:MM] | [Event] |
### Root Cause[Detailed explanation of what caused the incident]
### 5 Whys1. Why did [symptom]? → [Because...]2. Why did [cause 1]? → [Because...]3. Why did [cause 2]? → [Because...]4. Why did [cause 3]? → [Because...]5. Why did [cause 4]? → [Root cause]
### What Went Well- [Things that worked]
### What Went Poorly- [Things that didn't work]
### Action Items| Action | Owner | Priority | Due Date ||--------|-------|----------|----------|| [Action] | [Person] | P0/P1/P2 | [Date] |
### Lessons Learned[Key takeaways for the team]

## Postmortem: [Incident Title]**Date:** [Date] | **Duration:** [X hours] | **Severity:** SEV[X]**Authors:** [Names] | **Status:** Draft
### Summary[2-3 sentence plain-language summary]
### Impact- [Users affected]- [Duration of impact]- [Business impact if quantifiable]
### Timeline| Time (UTC) | Event ||------------|-------|| [HH:MM] | [Event] |
### Root Cause[Detailed explanation of what caused the incident]
### 5 Whys1. Why did [symptom]? → [Because...]2. Why did [cause 1]? → [Because...]3. Why did [cause 2]? → [Because...]4. Why did [cause 3]? → [Because...]5. Why did [cause 4]? → [Root cause]
### What Went Well- [Things that worked]
### What Went Poorly- [Things that didn't work]
### Action Items| Action | Owner | Priority | Due Date ||--------|-------|----------|----------|| [Action] | [Person] | P0/P1/P2 | [Date] |
### Lessons Learned[Key takeaways for the team]

If Connectors Available

If ~~monitoring is connected:

Pull alert details and metrics
Show graphs of affected metrics

If ~~incident management is connected:

Create or update incident in PagerDuty/Opsgenie
Page on-call responders

If ~~chat is connected:

Post status updates to incident channel
Create war room channel

Tips

Start writing immediately — Don't wait for complete information. Update as you learn more.
Keep updates factual — What we know, what we've done, what's next. No speculation.
Postmortems are blameless — Focus on systems and processes, not individuals.

Source and attribution

Source:anthropics/knowledge-work-pluginsinengineering/skills/incident-responseat commitae1513e

License: No license

Content belongs to its original authors. SourceWeft indexes it from a public repository.

Report or request removal

More from anthropics/knowledge-work-plugins

Ticket Deflector

anthropics

Featured

Reads a forwarded customer email or ticket, pulls order and refund status from a payments connector (PayPal, Square, or Stripe) or Shopify, account history from the CRM, and open tickets from a support desk (Zoho Desk), drafts a tone-matched reply in the owner's writing voice, and can issue a refund through the payments connector with explicit owner approval. With Shopify connected it also runs a proactive order-triage mode that surfaces orders needing attention — unfulfilled past the promised window, payment problems, pending refunds, stuck shipments — and drafts the next action for each before the customer has to ask. Use when the user says "draft a response," "answer this customer," "where's my order," "I want a refund," "check my orders," or "anything about to blow up."

Awaiting classification27Kupdated today

Tax Season Organizer

anthropics

Featured

Prepares tax-season materials for the owner's accountant, not tax advice. US federal tax; a non-US business gets its closed-books packet instead. Two modes: (1) quarterly estimated tax from YTD net income in the ledger (MYOB, NetSuite, QuickBooks, Xero, or Zoho Books); (2) year-end 1099 prep, scanning the ledger, PayPal, and Stripe for contractors paid over USD 600 into a 1099-NEC list with missing W-9 flags. Any tax request routes first to /tax-prep, which confirms the books are closed and reconciled before running this skill. Use this skill directly only when the owner says the period's books are already closed: "books are closed, now do the 1099s," "run the quarterly estimate off the closed numbers," or "just the contractor W-9 list."

Awaiting classification27Kupdated today

Tax Prep

anthropics

Featured

Prepares tax materials from closed books: a quarterly estimated payment breakdown or a year-end 1099-NEC list and accountant packet.

Business & Finance27Kupdated today

Smb Onboard

anthropics

Featured

Guides a small-business owner through first-time setup: connecting tools, running a value-proof recipe, capturing business context, and setting a weekly…

Productivity & Workflow27Kupdated today

Smb Router

anthropics

Featured

Routes a small-business owner's request to the right plugin skill or command and explains what is available.

Productivity & Workflow27Kupdated today

Month End Prep

anthropics

Featured

Reconciles the accounting ledger (MYOB, NetSuite, QuickBooks, Xero, or Zoho Books) against PayPal, Shopify, Square, and Stripe settlements, flags transactions that need attention, suspicious duplicates, and missing receipts, then writes a plain-English P&L narrative and exports a close packet (xlsx + one-page PDF). This is the first link of the /close-month command; a request to close the month or the books routes there, and the command runs this skill before refreshing the forecast and distributing the packet. Use this skill directly only when the owner wants the reconciliation alone, with no forecast refresh and no distribution: "just reconcile, no packet," "what's missing from the books," "flag the duplicates and missing receipts," or "write the P&L narrative for this month."

Awaiting classification27Kupdated today

Incident Response

/incident-response

Usage

Modes

How It Works

Severity Classification

Communication Guidance

Output — Status Update

Output — Postmortem

If Connectors Available

Tips

Source and attribution

More from anthropics/knowledge-work-plugins

Ticket Deflector

Tax Season Organizer

Tax Prep

Smb Onboard

Smb Router

Month End Prep

More in DevOps & Cloud

M5 Onboard

Runbook

Deploy Checklist

Spanner Basics

Secops Cases

Managed Airflow Migrations