agentleFS
Sign inStart free
harshsinghmpharshsinghmp/muse-skills/skills/agency-delivery/incident-response/SKILL.md

incident-response

Skill1 starsChanged 18 days agoMITView on GitHub

Live incident command: severity triage with first-15-minutes checklist, stop-the-bleeding mitigation playbooks for outage breach data-loss and perf-collapse, severity-linked status-page and client communication, and blameless postmortem with tracked actions, routed through five modes. Use when production is down, breached, losing data, or collapsing in performance. Not for planned QA (qa-launch), security audits (audit/code-review), routine client status (client-comms), or infra builds (devops).

We split this skill into the rules it gives an agent

3 rules. 0 are common, 3 are distinctive, and 0 are very specific to this project.

  • 0

    Common

    Most of the 61 edited versions we read keep these.

  • 3

    Distinctive

    This author's own choices. Worth a look.

  • 0

    Very specific

    Tied to their project's names, files or tools. Probably skip.

  • Common
  • Distinctive
  • Very specific
  1. Distinctive:

    Every invocation resolves to exactly one mode.

    line 38
  2. Distinctive:

    Only the resolved mode's reference is loaded — the rest stay on disk, saving tokens on every run.

    line 48
  3. Distinctive:

    Every external claim matches the internal timeline.

    line 86

“Common” is measured: kept by at least 6 in 10 of the 61 edited versions of this file we could read. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.
Files
SKILL.md

🚨 incident-response — Live Incident Command

One head skill for live incidents. Triage the severity, stop the bleeding, tell the truth on a cadence, then learn without blame. Every mode runs handsfree — defaults are stated inline, assumptions recorded in the deliverable, zero questions asked.

Modes

Every invocation resolves to exactly one mode. Match the request, then load only the matched reference:

ModeTrigger phrasesBehaviorReference
triage"production is down", "sev-1", "severity", "first 15 minutes", "is this an incident"Severity classification, escalation spine, first-15-minutes checklistreferences/triage.md
mitigate"stop the bleeding", "mitigate the outage", "roll back", "site is down", "data loss"Stop-the-bleeding playbooks per incident classreferences/mitigate.md
communicate"status page update", "tell the client", "incident comms", "draft the update"Status-page and client comms with severity-linked cadencereferences/communicate.md
retro"postmortem", "blameless retro", "what went wrong", "action items"Blameless postmortem feeding ops/retro with tracked actionsreferences/retro.md
audit"IR readiness audit", "audit incident response", "post-incident controls audit"NIST 800-61r3 readiness: policy, playbooks, exercises, authority boundaries; improvement actions verified landed.references/audit.md

Only the resolved mode's reference is loaded — the rest stay on disk, saving tokens on every run.

When to Use

  • Production is down, degraded, breached, losing data, or collapsing in performance.
  • Severity needs classifying and an escalation spine needs standing up fast.
  • A live incident needs mitigation before root cause is known.
  • Stakeholders need truthful updates during a live incident.
  • A blameless postmortem with tracked action items is due after the incident.

Anti-Triggers

  • Planned QA before launch → qa-launch (incident-response owns live fire, never the release gate).
  • Security audits and code-level review → audit / code-review (this skill mitigates a live breach; audits assess posture when nothing is burning).
  • Status-as-usual client updates → client-comms (incident-response owns comms only during live incidents; hand the summary back to client-comms when resolved).
  • Infra builds and deploy pipelines → devops (mitigation may call devops mechanics; builds stay there).

Quick Reference

Routing ladder (decide before any mode)

QuestionMode
'How bad is it, who owns it, what happens in the first 15 minutes?'triage
'How do we stop the bleeding right now?'mitigate
'What do we tell stakeholders, and how often?'communicate
'What did we learn, and what changes so it never recurs?'retro

Order: triage → mitigate → communicate → retro. Classify, stabilize, narrate, then learn. Communicate runs in parallel with mitigate from minute one — silence is the second outage.

Verification gate (every mode)

  • Severity is stated (SEV-1 through SEV-4) with blast radius and incident commander named.
  • Mitigation precedes root cause — service restored first, diagnosis second.
  • Every external claim matches the internal timeline; no cause stated before evidence.
  • The retro names process fixes with owners and dates, never people to blame.

Suite contracts

  • Fixes to product code → webdev / mobile; infra mechanics (rollback, failover) → devops.
  • Routine client voice after resolution → client-comms; process retro storage → ops retro mode.
  • Release-gate proof the fix holds → qa-launch regression.

Procedure

  1. Intake. establish what is broken, who is affected, and when it started before touching anything — an incident without a blast radius gets the wrong severity.
  2. Resolve the mode. Match the request against the mode table; exactly one mode. Ambiguous during live fire → default to triage, state the assumption, proceed.
  3. Execute the mode playbook. Load references/<mode>.md and follow its Intake → Deliverable → Procedure → Quality gate in order.
  4. Gate and deliver. Pass this file's Verification checklist plus the mode's quality gate, then deliver the artifact where responders expect it.

Pitfalls

  • Debugging root cause before mitigating — users stay down while you investigate.
  • Severity inflation or deflation — SEV-everything pages everyone; SEV-nothing pages no one.
  • Silent response — no comms for 30 minutes reads as abandonment, whatever the fix state.
  • Declaring cause before evidence — the first theory is usually wrong and always quoted.
  • Blameful retro — names in the doc mean silence in the next incident.
  • Action items with no owner or date — the same incident recurs on schedule.

Verification

  • Exactly one mode resolved and its reference playbook followed end to end.
  • Severity stated with blast radius, commander, and escalation path.
  • Mitigation attempted or documented before root-cause work.
  • Comms cadence matched severity; external claims match the internal timeline.
  • Retro is blameless with owned, dated action items routed to ops.

Download now (ZIP)

  • Other versions72 projects use a version of this.

    Word for word · 0

    None found.

    Edited · 0

    None found.

    Wrote their own version · 72

    1. anthropics/knowledge-work-plugins★ 34ksame name
    2. microsoft/hve-core★ 1.6ksame name
    3. hypnguyen1209/offensive-claude★ 401same name
    4. duyet/clickhouse-monitoring★ 305same name
    5. kid-sid/claude-spellbook★ 190same name
    6. irahardianto/awesome-agv★ 157same name
    7. harness/harness-skills★ 127same name
    8. nahid-sparktales/agent-dispatcher★ 59same name
    9. Happy-Technologies-LLC/happy-platform-skills★ 41same name
    10. drafthq/draft★ 40same name

    62 more not listed

    How matches are found. Word for word: the exact same text. Edited: shares passages with this file (“99% same” means 99% of its five-word phrases also appear here; 10% or more counts). Their own version: similar meaning, or, weakest, the same name. We can’t tell which project had it first. Projects are counted among the 200 most-starred candidates, and mentions are links to the repository we found, up to 50 per site, so both counts are a floor.

  • Used alongsideProjects with it also use cli-development, documentation-site and 10 more.

    Other files people use alongside this one.

    Files found in the same public projects as a version of this one, more often than they turn up anywhere else. Each project counts once, large collections count for less, and this file's own repository is left out.
    • cashew-labsSkill

      cli-development

      Design and implement command-line interfaces with subcommand-scoped help, actionable success output, and debuggable failure output. Use when creating or modifying CLI commands, argument parsing, help and usage text, exit codes, or command UX for humans and agents.

      Also in 5 projects that use this

    • fmindSkill

      documentation-site

      Build Zensical docs sites: navigation, API docs, Pages, MkDocs/Hugo migration.

      Also in 3 projects that use this

    • jholhewresSkill

      dora-metrics

      Calculate DORA metrics from git + deploy logs

      Also in 3 projects that use this

    • MicrosoftSkill

      data-modeling

      Use when the app needs to store or read data — records, a database, entities, CRUD, lists, "save/remember X", or per-user data with row-level security. This app's data layer is Rayfin's: you declare entities as TypeScript classes with decorators in rayfin/data/, register them in the schema, and read/write them through the typed rayfin-client. Covers: defining an @entity, field decorators, registering it, per-entity access with @role, owner-only row-level security, and the client query/mutation API. Triggers: data, database, model, entity, schema, table, record, CRUD, create, read, update, delete, list, store, save, persist, per-user, row-level security, RLS, access control, ownership.

      Also in 6 projects that use this

    • YepAPISkill

      background-jobs

      Queue workers with BullMQ/Inngest/Trigger.dev, job retries, dead letter queues, concurrency.

      Also in 3 projects that use this

    • MasriyanSkill

      exploit-development

      Authorized exploit development and vulnerability research skill for lab environments, CTFs, owned software, crash analysis, memory corruption, exploitability assessment, fuzzing results, proof-of-concept design, and remediation. Use for defensive validation and education; avoid real-world weaponization, stealth, persistence, evasion, or unauthorized targets.

      Also in 3 projects that use this

  • In this repository49 other files it gives its agents.

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

Reviews can't be read right now.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free