incident-triage

Structure the first fifteen minutes of a production incident with severity declaration, role assignment, and mitigation-first workflow.

1|Updated Jul 3, 2026
One-click install
npx skills add https://github.com/Nandansai08/skillz --skill incident-triage-nandansai08
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: incident-triage
Source: https://github.com/Nandansai08/skillz/tree/main/skills/sre-incident-response/incident-triage
Command: npx skills add https://github.com/Nandansai08/skillz --skill incident-triage-nandansai08

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? When production breaks, teams lose critical minutes to chaos: everyone debugs at once, nobody declares severity, and root-cause hunting delays the rollback that would have restored users immediately. This Skill replaces adrenaline with structure for the first fifteen minutes of an incident. ## Core Features & Use Cases - Severity Declaration Ladder: Assess impact in user terms and declare SEV1/SEV2/SEV3, with a bias toward declaring high and downgrading later. - Role Assignment: Split the Incident Commander (coordination, communication) from Ops leads (hands on keyboards) so coordination never stops. - Mitigation-First Stabilization: Check levers in order of speed — rollback recent deploys, kill feature flags, drain bad nodes — before any root-cause diagnosis. - Timeline Logging and Communication Cadence: Timestamped channel notes from minute one, plus scheduled status updates even when there is nothing new to report. - Use Case: An alert fires showing checkout errors at 40%. Use this Skill to declare SEV1 within minutes, assign an IC and ops lead, roll back the suspect deploy before diagnosing, confirm recovery in the user-facing metric, and schedule the postmortem. ## Quick Start Use the incident-triage skill to help me assess severity, assign roles, and stabilize this production outage where users are reporting checkout errors.

Frequently Asked Questions about incident-triage

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I triage a production incident in the first 15 minutes?▼

Assess impact in user terms (who, what, since when, how many), declare a severity level, assign an Incident Commander and ops lead, then mitigate before diagnosing. Roll back recent deploys or kill feature flags before investigating root cause.

How do I decide between SEV1, SEV2, and SEV3 severity levels?▼

SEV1 is a core user journey down or data loss with no workaround; SEV2 is major degradation or a core journey down for a subset with a workaround; SEV3 is a minor feature broken. When unsure, declare high and downgrade later — downgrades cost nothing.

Should I roll back a deploy before confirming it caused the incident?▼

Yes. Rollback is cheap and reversible while downtime is not, so roll back on correlation with the incident window rather than waiting for proof of causation. Confirm the actual cause afterward from a working system.

Can the incident commander also do hands-on debugging?▼

No. The moment the IC opens a terminal, coordination, updates, and joiner onboarding stop. Even on a team of two, keep the IC and ops roles on two separate people.

When should I not use incident triage?▼

Do not use it for deep root-cause diagnosis during or after the incident — that belongs to production-debugging — or for the post-resolution writeup, which belongs to blameless-postmortem. Triage covers only assessment, declaration, roles, and stabilization.