incident-response

Guides production incident triage, evidence gathering, mitigation, communication, and post-mortem writing.

Updated Apr 20, 2026
One-click install
npx skills add https://github.com/astroville/sprout --skill incident-response-astroville
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: incident-response
Source: https://github.com/astroville/sprout/tree/main/.claude/skills/incident-response
Command: npx skills add https://github.com/astroville/sprout --skill incident-response-astroville

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Production incidents demand fast, structured action, but under pressure teams often skip triage, lose evidence, conflate mitigation with fixes, or write incomplete post-mortems. This Skill provides a disciplined workflow for handling outages from detection through resolution and retrospective. ## Core Features & Use Cases - Severity-based triage: Classify incidents as Critical, High, Medium, or Low using impact and urgency criteria, then apply immediate mitigations like rollbacks, feature flags, or failovers before investigating root cause. - Systematic evidence gathering: Collect logs, metrics, traces, deployment timelines, and external factors, plus pattern recognition for deploy-correlated, load-correlated, cascade, and slow-bleed failure modes. - Communication and post-mortems: Templates for status updates, stakeholder notification, and a blameless post-mortem format with timeline, root cause, and assigned action items. - Use Case: Your payments API starts returning elevated errors after a deploy. Use this Skill to assess severity, revert the deployment, gather connection-pool metrics, notify stakeholders, and draft the post-mortem within 48 hours. ## Quick Start Help me triage and respond to a production incident where the payments API is showing elevated error rates after this morning's deployment.

Frequently Asked Questions about incident-response

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I triage a production incident?▼

Assess severity based on impact and urgency: Critical for outages or data loss, High for major feature breakage, Medium for impaired functionality, Low for cosmetic issues. Then mitigate immediately with rollbacks, feature flags, or failovers before investigating root cause.

What is the difference between mitigation and a fix?▼

Mitigation stops user impact fast, such as reverting a deploy or toggling a feature flag, and takes minutes. A fix addresses the root cause so the problem does not recur, taking hours to days. Always mitigate first, then fix.

What should a post-mortem include?▼

A blameless post-mortem includes a summary, chronological timeline, impact assessment, root cause distinguishing trigger from underlying cause, what went well and poorly, and concrete action items with owners, priorities, and due dates. Write it within 48 hours of resolution.

How do I recognize common incident patterns?▼

Match symptoms to patterns: deploy-correlated spikes suggest checking the diff, load-correlated errors suggest resource exhaustion, time-correlated errors suggest cron jobs or certificate expirations, and gradual slow bleeds suggest memory or connection leaks.

When should I notify stakeholders during an incident?▼

Send a first update within 15 minutes of detection acknowledging the issue and impact, then update every 30 minutes during active incidents. Notify engineering leadership on Critical and High severity, and business stakeholders when there is customer-facing impact.