Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Incident Triage Runbook — measured AI agent skill | DecimalAI

bonaniibm/incident-triage

SkillScore91Maintained

Use to triage an incoming production incident report, classify its severity, and route it to the right on-call team. Use when someone reports an outage, degradation, or production error. Do NOT use for routine service requests, feature questions, or non-production environments.

by bonaniibm

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

DevOps & SRE pack

decimalai skills pull bonaniibm-incident-triage

Get this skill — curl · raw file

curl -fsSL https://app.decimal.ai/s/bonaniibm-incident-triage/SKILL.md

Raw file: /s/bonaniibm-incident-triage/SKILL.md ↗ · machine-readable summary at /s/bonaniibm-incident-triage.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

Runs

—

no usage data yet

Used when offered

—

offered 88 · activation not measurable for prompt-injection usage

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 7d ago

Yes — +27% lift-56% tokens0% turns91% of whole cases pass with skill (20/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-02	✗→✓	▲ Improved	-32%	0%
case-07	✗→✓	▲ Improved	-55%	0%
case-08	✗→✓	▲ Improved	-36%	0%
case-10	✗→✓	▲ Improved	-70%	0%
case-16	✗→✓	▲ Improved	-73%	0%

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/1/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

bonaniibm / skillforge

samples/skills/incident-triage/SKILL.md

View on GitHub ↗

License MITImported 8/1/2026Version v1Bundled 1 file

Skill contents

references/

SKILL.md

Incident Triage Runbook

When to use

A production incident is reported and must be classified and routed. Routine requests do not belong here.

Steps

Gather the symptom, blast radius, and first-observed time.
Classify severity using references/severity-matrix.md.
Page the owning on-call team for that service.
Open the incident channel and post the initial summary.

Failure handling

If the owning team cannot be determined, ALWAYS escalate to the incident commander rota.
NEVER close an incident without a documented resolution.

Example

A report arrives: "Checkout is returning 500s for ~30% of users." Classify against the severity matrix (high blast radius → Sev2), page the checkout on-call, and open the incident channel with the summary.

Want to see if bonaniibm/incident-triage would activate on your phrasing? Try it before you install — no LLM call, no signup.

Other measured skills in the registry, with their headline benchmark lift.