Use this skill when handling production incidents, outages, or critical bugs — from initial detection through resolution and post-mortem. Trigger on keywords: incident, outage, production down, on-call, P1, P2, critical bug, postmortem, root cause analysis, runbook, service disruption.
SkillScore86Maintained
Automatic
◆DevOps & SRE pack
Last verified 8/3/2026
What it changes
Passed 19 of 22 test cases with the skill, and 14 of 22 without it.
Without skill64%
With skill86%
Checks it passed that the model alone missed
States that the LEARN phase must never be skipped.
Specifies conducting the post-mortem within 48 hours.
Assigns log investigation and technical fixing to the Technical Lead.
and 3 more in the full report
5 fixed14 passed either way3 still failing0 broke
Pass-rate lift
+23 pp
Tokens
+7%
Agent turns
0%
Response time
-31%
Model gemini-3.6-flashMeasured 8/3/2026v119 of 22 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 5 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 5
Prompt
We are establishing standard operating procedures for incident response lifecycle management. What are the five core phases from initial symptom recognition to preventing recurrence, and what rule applies to the final phase?
What was checked, without and with the skill
Checked
Without skill
With skill
Lists the five sequential phases as DETECT, ASSESS, RESPOND, RESOLVE, and LEARN.
Missed
Passed
States that the LEARN phase must never be skipped.
Missed
Passed
case-08 · gemini-3.6-flash · 8/3/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md128 linessingle file
Incident Response
The Five Phases
DETECT → ASSESS → RESPOND → RESOLVE → LEARN
Every incident touches all five. Never skip LEARN — it's the only one that prevents recurrence.
Phase 1: Detect & Assess (First 5 Minutes)
1. What is broken? (specific service, feature, endpoint)
2. Who is affected? (all users, subset, specific region)
3. What is the impact? (data loss? revenue? user-facing?)
4. When did it start? (correlate with recent deploys/changes)
5. Severity: P1 (all users, data loss) / P2 (major feature) / P3 (minor)
Communicate immediately — even if you don't know the cause yet:
"We're investigating an issue with [service].
Impact: [who is affected].
We'll update in 15 minutes."
Phase 2: Respond (During Incident)
Incident Roles
Incident Commander — coordinates, communicates, makes calls