🚨Incident Response Skills
Browse the best Incident Response skills for Claude Code, Codex, Cursor and other AI agents.
226 skills · Page 1 of 10
sre-engineer
★ 21Expert Site Reliability Engineer balancing feature velocity with system stability through SLOs, automation, and operational excellence. Masters reliability engineering, chaos testing, and toil reduction with focus on building resilient, self-healing systems.
incident-response
★ 2Structured approach to handling production incidents, from detection through resolution and post-mortem analysis
incident-response
★ 3Use when designing incident management processes, creating runbooks, or establishing on-call practices. Covers incident lifecycle, communication, and postmortems.
incident-triage
★ 51Rapid incident classification, severity assessment, and response coordination. Use when relevant to the task.
must-gather-analyzer
★ 32Analyze OpenShift must-gather diagnostic data including cluster operators, pods, nodes,and network components. Use this skill when the user asks about cluster health, operator status,pod issues, node conditions, or wants diagnostic insights from must-gather data.Triggers: "analyze must-gather", "check cluster health", "operator status", "pod issues","node status", "failing pods", "degraded operators", "cluster problems", "crashlooping","network issues", "etcd health", "analyze clusteroperators", "analyze pods", "analyze nodes"
incident-responder
★ 21Expert incident responder specializing in security and operational incident management. Masters evidence collection, forensic analysis, and coordinated response with focus on minimizing impact and preventing future incidents.
k8s-troubleshooting
★ 4Comprehensive Kubernetes and OpenShift cluster health analysis and troubleshooting based on Popeye's issue detection patterns. Use this skill when:(1) Proactive cluster health assessment and security analysis(2) Analyzing pod/container logs for errors or issues(3) Interpreting cluster events (kubectl get events)(4) Debugging pod failures: CrashLoopBackOff, ImagePullBackOff, OOMKilled, etc.(5) Diagnosing networking issues: DNS, Service connectivity, Ingress/Route problems(6) Investigating storage issues: PVC pending, mount failures(7) Analyzing node problems: NotReady, resource pressure, taints(8) Troubleshooting OCP-specific issues: SCCs, Routes, Operators, Builds(9) Performance analysis and resource optimization(10) Security vulnerability assessment and RBAC validation(11) Configuration best practices validation(12) Reliability and high availability analysis
production-incident-responder
★ 2Crisis response skill for production system failures. Integrates with MCP resilience tools to detect, diagnose, and respond to critical system failures. Use when production system shows signs of failure or during emergency situations.
responding-to-security-incidents
★ 1Guide security incident response, investigation, and remediation processes.Use when you need to handle security breaches, classify incidents, develop response playbooks, gather forensic evidence, or coordinate remediation efforts.Trigger with phrases like "security incident response", "ransomware attack response", "data breach investigation", "incident playbook", or "security forensics".
k8s-troubleshooter
Use this skill when users report Kubernetes cluster issues, pod failures, or need incident response.Comprehensive troubleshooting for diagnosing cluster, workload, networking, storage, and Helm issues.Invoke for: pods not starting (Pending, CrashLoopBackOff, ImagePull), service connectivity problems,DNS resolution failures, storage/PVC issues, node health problems, CNI/Calico networking, Helm releasefailures, or cluster-wide performance degradation. Provides systematic diagnostic workflows, standardizedinvestigation reports with severity-based depth (Executive Triage Cards for rapid decision-making),and incident response playbooks with phased triage (baseline → inspect → correlate → deep dive).All commands are read-only by default for production safety.
investigate-incident
Investigate platform incidents, perform RCA, create incident documentation, and follow alert runbooks in the Kagenti platform
incident-response
Structured incident response workflow for production issues. Use when handling outages, performance degradation, or user-impacting problems. Covers triage, communication, mitigation, resolution, and post-incident review.
operating-production-services
SRE patterns for production service reliability: SLOs, error budgets, postmortems, and incident response.Use when defining reliability targets, writing postmortems, implementing SLO alerting, or establishingon-call practices. NOT for initial service development (use scaffolding skills instead).
memory-forensics
★ 25.0kMaster memory forensics techniques including memory acquisition, process analysis, and artifact extraction using Volatility and related tools. Use when analyzing memory dumps, investigating incidents, or performing malware analysis from RAM captures.
on-call-handoff-patterns
★ 24.2kMaster on-call shift handoffs with context transfer, escalation procedures, and documentation. Use when transitioning on-call responsibilities, documenting shift summaries, or improving on-call processes.
postmortem-writing
★ 24.2kWrite effective blameless postmortems with root cause analysis, timelines, and action items. Use when conducting incident reviews, writing postmortem documents, or improving incident response processes.
incident-runbook-templates
★ 24.2kCreate structured incident response runbooks with step-by-step procedures, escalation paths, and recovery actions. Use when building runbooks, responding to incidents, or establishing incident response procedures.
k8s-troubleshoot
★ 1.2kKubernetes troubleshooting toolkit - search pods by labels and execute diagnostic commands inside containers. Use when user reports service errors, exceptions, crashes, timeouts, or needs to check logs, processes, network, or resource usage in K8s pods.
deepgram-incident-runbook
★ 939Execute Deepgram incident response procedures for production issues.Use when handling Deepgram outages, debugging production failures,or responding to service degradation.Trigger with phrases like "deepgram incident", "deepgram outage","deepgram production issue", "deepgram down", "deepgram emergency".
juicebox-incident-runbook
★ 939Execute Juicebox incident response procedures.Use when responding to production incidents, troubleshooting outages,or following incident management protocols.Trigger with phrases like "juicebox incident", "juicebox outage","juicebox down", "juicebox emergency".
langchain-incident-runbook
★ 939Incident response procedures for LangChain production issues.Use when responding to production incidents, diagnosing outages,or implementing emergency procedures for LLM applications.Trigger with phrases like "langchain incident", "langchain outage","langchain production issue", "langchain emergency", "langchain down".
clerk-incident-runbook
★ 939Incident response procedures for Clerk authentication issues.Use when handling auth outages, security incidents,or production authentication problems.Trigger with phrases like "clerk incident", "clerk outage","clerk down", "auth not working", "clerk emergency".
gamma-incident-runbook
★ 939Incident response runbook for Gamma integration issues.Use when experiencing production incidents, outages,or need systematic troubleshooting procedures.Trigger with phrases like "gamma incident", "gamma outage","gamma down", "gamma emergency", "gamma runbook".
linear-incident-runbook
★ 939Production incident response procedures for Linear integrations.Use when handling production issues, diagnosing outages,or responding to Linear-related incidents.Trigger with phrases like "linear incident", "linear outage","linear production issue", "debug linear production", "linear down".