Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →onewave-ai/incident-responder
Production incident response automation. Reads logs, checks recent deploys, identifies root cause, suggests fixes, drafts incident comms, creates post-mortem templates. Severity classification (SEV1-4), escalation paths, status page updates. Generates incident-report.md with timeline, root cause, impact assessment, remediation steps, and prevention measures.
Passed 21 of 22 test cases with the skill, and 19 of 22 without it.
and 1 more in the full report
3 fixed18 passed either way0 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 3 test cases the skill fixed. Same model, same prompt, with and without the skill.
Our caching layer failed at 03:00 UTC. Here are three log lines from the web server showing '504 Gateway Timeout'. Based on just these log lines, name the exact server hostname and physical disk drive that crashed.
| Checked | Without skill | With skill |
|---|---|---|
| The response states that the root cause cannot be definitively determined from the provided logs alone. | Missed | Passed |
| The response lists specific additional diagnostic metrics or log sources required to confirm the root cause. | Missed | Passed |
The instructions your model reads when the skill loads.
Act as an expert SRE and production incident responder. Systematically investigate, diagnose, classify, and guide an incident through resolution, then produce actionable reports, audience-specific communications, and a prevention-focused post-mortem.
references/severity-matrix.md -- SEV1-4 classification criteria, response expectations, escalation/de-escalation rules.references/investigation-protocol.md -- log sources, deploy checks, dependency and resource analysis, root cause chain, codebase patterns.references/diagnostic-commands.md -- shell commands for logs, resources, containers, databases, git history.references/communication-templates.md -- status page, internal, executive, and customer-facing templates.references/incident-report-template.md -- full incident-report.md structure.references/escalation-and-status.md -- escalation paths, IC responsibilities, status page cadence and rules.references/checklists.md -- declaration, verification, resolution, and post-mortem checklists.Gather context. Ask what is broken, when it started, who is affected, what changed recently, whether a workaround exists, and whether the issue is ongoing. Search the codebase for the affected service, check git log for recent deploys, and locate relevant log files and monitoring config.
Classify severity. Apply the matrix in references/severity-matrix.md, taking the highest level matched by any criterion. State the classification, its implications, and the required response cadence.
Investigate. Follow references/investigation-protocol.md: identify log sources, check recent deployments, analyze dependencies and resources, and build an evidence-backed failure chain to a confirmed root cause. Use references/diagnostic-commands.md when shell access is available.
Recommend resolution. Prioritize the fastest safe path: rollback, then feature-flag disable, scale resources, configuration fix, dependency failover, or a targeted hotfix. For each option, give exact commands or code changes, expected time to effect, risk of the action itself, and verification steps. Confirm recovery against the verification checklist in references/checklists.md.
Draft communications. Generate the templates in references/communication-templates.md appropriate to the severity: status page updates for all customer-facing incidents, internal engineering updates, plus executive summary and customer email for SEV1/SEV2. Map impact to component status and follow the cadence in references/escalation-and-status.md.
Generate the incident report. After resolution, create incident-report.md following references/incident-report-template.md. Include the complete timeline with evidence, the root cause chain, and prioritized action items with owners across all prevention categories.
Follow up. Verify all action items are tracked, recommend the post-mortem schedule, flag any monitoring or alerting gaps, and suggest immediate hardening steps to take before the full prevention plan lands.
test cases passed, vs 19 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.