incident-response
Manage active production incidents through detection, triage, mitigation, communication, and resolution with structured roles and decision-making. Use this skill whenever the user has an active incident, a production issue, a service outage, a security incident, or needs to plan incident response procedures. Triggers on incident response, production incident, outage, service down, site down, P0, P1, severity, downtime, on-call, incident commander, status page, postmortem prep. Also triggers when something is actively broken in production and the user is figuring out what to do.
Profile →npx skills add rampstackco/claude-skills --skill incident-response --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Incident Response Manage active production incidents from detection to resolution. Stack-agnostic. Tool-agnostic. This skill is for active incidents and incident process. For after-the-fact analysis, use `after-action-report`. For planned launches, use `launch-runbook`. --- ## When to use - An active incident is happening - Building incident response procedures - Defining severity levels - Setting up on-call rotations - Training a team on incident response ## When NOT to use - Post-incident retrospective (use `after-action-report`) - Planned launches (use `launch-runbook`) - Pre-launch issue triage (use `qa-testing`) --- ## Required inputs - Awareness of the incident (alert, customer report, internal observation) - Access to production systems and monitoring - Roles and authorities clearly defined - Communication channels operational --- ## The framework: 5 phases ### 1. Detection How the incident becomes known. **Detection sources:** - Automated alerts (monitoring, SLO violations, error rate spikes) - Customer reports (support tickets, social media, status page subscribers) - Internal observation (engineer notices something off) - Third-party (security researchers, partners) **O
- When to use
- When NOT to use
- Required inputs
- The framework: 5 phases
- 1. Detection
- 2. Triage
- 3. Mitigation
- 4. Communication
- 5. Resolution
- Roles during an incident
- Decision-making during an incident
- Status page communication patterns
- Workflow
- Failure patterns
What does the incident-response skill do?
Manage active production incidents through detection, triage, mitigation, communication, and resolution with structured roles and decision-making. Use this skill whenever the user has an active incident, a production issue, a service outage, a security incident, or needs to plan incident response procedures. Triggers on incident response, production incident, outage, service down, site down, P0, P1, severity, downtime, on-call, incident commander, status page, postmortem prep. Also triggers when something is actively broken in production and the user is figuring out what to do.
How do I install it?
Run `npx skills add rampstackco/claude-skills --skill incident-response --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From rampstackco/claude-skills, a repository with 515 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.