incident-response — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited incident-response (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Incidents demand disciplined response, not heroic fixes. Rushed patches mask problems and create new ones.
Core principle: ALWAYS triage, communicate, and contain before attempting fixes. Technical investigation follows organizational response.
Violating the letter of this process is violating the spirit of incident response.
Use this when alerts fire. Don't think, follow the list.
| Minute | Action | Output |
|---|---|---|
| 0-1 | Acknowledge alert | incident_acknowledged |
| 1-2 | Screenshot dashboards NOW | Evidence preserved |
| 2-3 | Assess: >50% users? Critical function? | Severity (P1-P4) |
| 3-4 | Post in incident channel: severity + impact + trace_id | stakeholders_notified |
| 4-5 | If P1/P2: Open war room, page on-call | Responders engaged |
After 5 minutes: Proceed to Phase 4 (Mitigate) - you've completed Detect, Triage, Communicate.
NO FIXES WITHOUT TRIAGE AND COMMUNICATION FIRSTIf you haven't classified severity and notified stakeholders, you cannot propose fixes.
Use for ANY production incident:
Use this ESPECIALLY when:
Don't skip when:
This skill is for organizational incident response. Don't use it for:
Key distinction: This skill manages the organizational response (communication, escalation, coordination). For technical root cause analysis, hand off to superpowers:systematic-debugging at Phase 5.
You MUST complete each phase before proceeding to the next.
digraph incident_response {
rankdir=TB;
node [shape=box];
"1. Detect" -> "2. Triage";
"2. Triage" -> "3. Communicate";
"3. Communicate" -> "4. Mitigate";
"4. Mitigate" -> "5. Diagnose";
"5. Diagnose" -> "6. Fix/Rollback";
"6. Fix/Rollback" -> "7. Verify";
"7. Verify" -> "8. Document";
"Skip Phase?" [shape=diamond];
"2. Triage" -> "Skip Phase?" [style=dashed, label="tempted?"];
"Skip Phase?" -> "STOP" [label="NO"];
"STOP" [shape=doublecircle, color=red];
}Acknowledge the incident:
Completion criteria:
incident_acknowledged - Alert confirmed and loggedClassify severity BEFORE taking action:
See severity-classification.md for detailed criteria.
Completion criteria:
severity_classified - P1/P2/P3/P4 assignedimpact_assessed - Users affected and scope documentedNotify stakeholders BEFORE attempting fixes:
See communication-templates.md for notification formats.
Completion criteria:
stakeholders_notified - Team/leadership informedcommunication_cadence_set - Update schedule establishedContain the blast radius:
Completion criteria:
rollback_evaluated - Rollback option assessedcontainment_verified - Blast radius limitedevidence_preserved - Logs/traces captured before actionNow investigate the root cause:
HANDOFF: Use superpowers:systematic-debugging for technical investigation.
Completion criteria:
root_cause_identified - Cause confirmed with evidenceescalated_for_help - Fresh eyes requested after 3+ failed hypothesesApply the resolution:
Completion criteria:
fix_deployed - Forward fix applied and reviewedrollback_completed - Previous state restoredConfirm the incident is resolved:
HANDOFF: Use superpowers:verification-before-completion for thorough verification.
Completion criteria:
service_restored - Users can complete flows normallyslo_compliant - Error rates and latency within SLOThe incident is NOT resolved until documentation exists:
See postmortem-template.md for the blameless RCA framework.
Completion criteria:
postmortem_scheduled - Meeting booked within required windowincident_closed - Stakeholders notified, status page updatedIf you catch yourself thinking:
ALL of these mean: STOP. Return to the current phase.
| Excuse | Reality |
|---|---|
| "This is obviously a P1" | Every incident feels urgent. Triage takes 2 minutes, wrong classification causes chaos. |
| "Fix first, communicate later" | Silent outages create panic. 30-second update prevents 30-minute escalation. |
| "Rollback is too risky" | Known state > uncertain forward fix. Rollback buys time to fix properly. |
| "We can investigate after fixing" | Evidence disappears after restart. Capture now, analyze later. |
| "It's a one-off, skip the postmortem" | All incidents feel unique. Patterns emerge only from documentation. |
| "I know this system, trust me" | Expert intuition fails under pressure. Protocol beats intuition. |
| "Communication slows us down" | Coordinated response > heroic solo effort. Communication accelerates resolution. |
| "Previous fix worked, try another" | 3+ fixes = wrong diagnosis. Stop guessing, investigate properly. |
| Phase | Key Activities | Verification Key |
|---|---|---|
| 1. Detect | Acknowledge, capture evidence, record time, capture trace_id | incident_acknowledged |
| 2. Triage | Assess impact, classify P1-P4, check SLO | severity_classified |
| 3. Communicate | Notify team, update status, set cadence, include trace_id | stakeholders_notified |
| 4. Mitigate | Evaluate rollback, contain blast radius | containment_verified |
| 5. Diagnose | Form hypothesis, test systematically | root_cause_identified |
| 6. Fix/Rollback | Apply resolution, get review | fix_deployed |
| 7. Verify | Confirm resolution, check SLO | service_restored |
| 8. Document | Schedule postmortem, capture timeline, correlate via trace_id | postmortem_scheduled |
🔑 trace_id: Include in ALL internal communications - enables instant context jumping across logs, traces, and metrics.
These files provide detailed guidance for specific phases:
From incident response data:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.