Incident Commander
Comprehensive incident response framework from detection through resolution and post-incident review.
Before & after
Same prompt, same agent — the only difference is the skill.
That's stressful — let's work through it. Here's a general approach to incident response: 1. **Assess impact** — how many users are affected, and what's the business impact? 2. **Communicate** — let stakeholders know you're investigating 3. **Investigate** — check recent deploys, error rates, dependencies, and infrastructure 4. **Mitigate** — if a recent deploy is the cause, consider rolling back 5. **Resolve** — apply a fix and verify 6. **Post-mortem** — document what happened and how to prevent recurrence Rolling back a recent deploy is often the fastest path to recovery, even before you understand the root cause. What have you checked so far?
SEV1. Revenue-impacting, no workaround. Work top to bottom, don't skip.
RIGHT NOW — first 5 minutes
1. You are Incident Commander. Say so in channel. IC does not debug —
the moment you're in the code you've stopped commanding.
2. Open #inc-checkout-<date>. One channel, all traffic.
3. Assign: one Ops lead (investigates), one Comms (status page,
stakeholders). If you're alone, IC + Ops and post to status page
yourself every 15 min regardless.
4. Status page NOW, before you know anything:
"We're investigating an issue with checkout. Next update in 15 min."
MITIGATE BEFORE YOU DIAGNOSE
Last deploy inside the window? Roll back. Do not wait to confirm
causation — a rollback that turns out to be unrelated costs you five
minutes; a diagnosis-first approach costs you the outage.
No recent deploy? Check in order: dependency status pages, DB
connection saturation, expired certs, upstream payment provider.
TIMELINE — start it now, not after
Every action, timestamped, in channel as it happens. Reconstructing
this tomorrow from memory is where post-mortems go wrong. The channel
IS the timeline if you keep the discipline.
CADENCE
Status page every 15 min even with nothing new. Silence reads as
worse than the outage.
RESOLVED CRITERIA — decide before you're tempted
Error rate under baseline for 15 consecutive minutes AND a successful
synthetic checkout. Not "looks fine now."
AFTER
Post-mortem within 5 business days. Blameless, timeline-driven,
action items with owners and dates. If it has no owner it won't happen
and the next incident is the same one.
What's the last deploy time?About this skill
name: incident-commander description: Use when Comprehensive incident response framework from detection through resolution and post-incident review.
Incident Commander
Comprehensive incident response framework from detection through resolution and post-incident review. Battle-tested SRE/DevOps practices: severity classification, timeline reconstruction, structured post-incident analysis. Use when declaring an incident, coordinating multi-team response during an outage, leading a post-mortem, or setting up on-call practices for a new service.
What you get
- Public GitHub repo (alirezarezvani/claude-skills)
- the incident-commander skill folder with SKILL.md. Part of a 337-skill / 30-agent / 70-command install.
Customize your output
- Fork the repo and adapt the skill's instructions and references to your workflow.
Example output
Activates automatically when your request matches Incident Commander; chains with the other skills, agents, and commands in the collection.
Best for
Creators, builders, and teams using Claude Code.
SKILL.md preview
---
name: incident-commander
description: Use when declaring an incident, coordinating multi-team response during an outage, leading a post-mortem, or setting up on-call practices.
version: 1.0.0
category: Development / Engineering
author: AgentVolt
license: proprietary
tags:
- development
- engineering
---
# Incident Commander
Runs a comprehensive incident response process from detection through resolution and post-incident review, using battle-tested SRE practices.
## When to use
… (sign up to view the full skill)Featured in
More development skills
View all Development skills →Generate
Scaffold code, tests, and boilerplate from a short spec.
Performance Profiler
Systematic performance profiling for Node.js, Python, and Go applications.
Threat Detection
Use when hunting for threats in an environment, analyzing IOCs, or detecting behavioral anomalies in telemetry.
Agent Harness
Turns a domain folder of skills into a bounded agentic loop: compile a goal into a task plan, execute with the domain's tools, verify every task, retry within a budget.