Incident Commander Skill
A comprehensive incident response framework for availability and reliability incidents, covering severity classification, timeline reconstruction, post-incident reviews, communication templates, and runbook generation. It provides tools and structured processes to manage incidents from detection through resolution and learning.
✨ What it does
- Automated severity classification (SEV1-SEV4) based on impact and urgency.
- Timeline reconstruction from scattered logs and events with gap analysis.
- Post-incident review generation with multiple RCA frameworks (5 Whys, Fishbone, Timeline).
- Pre-built communication templates for stakeholder updates and escalations.
- Runbook generation framework with detection, response, and recovery playbooks.
🎯 When to use it
- When declaring an incident or coordinating a multi-team response during an outage or service degradation.
- When leading a post-incident review (post-mortem) to analyze root causes and generate action items.
- When setting up on-call practices or incident response procedures for a new service.
- When needing to classify the severity of an operational incident and determine appropriate response actions.
🚀 How to use
Trigger by describing an incident or requesting incident management assistance, e.g., 'Classify this incident: ...' or 'Help me run a post-incident review.' The skill expects incident details such as description, affected users, business impact, and timestamped events. It provides command-line tools (incident_classifier.py, timeline_reconstructor.py, pir_generator.py) for automated analysis. Example prompts:
Classify this incident: Users reporting 500 errors, database connections timing out, 80% affected.
Generate a post-incident review for the database outage using the fishbone method.
📄 Output: Deliverables include severity classifications, incident timelines, post-incident review documents, communication templates, and runbooks.
📦 Add this skill to Claude Code
# 1. Get the skills repo
git clone --depth 1 https://github.com/alirezarezvani/claude-skills /tmp/claude-skills
# 2. Copy this skill into your project (or ~/.claude/skills for all projects)
mkdir -p .claude/skills
cp -r /tmp/claude-skills/engineering-team/skills/incident-commander .claude/skills/incident-commanderSkill source: engineering-team/skills/incident-commander/SKILL.md
⚠️ Good to know
This skill is for operational incidents only; security incidents should be routed to the incident-response skill.
❓ FAQ
What severity levels does this skill use?
It uses SEV1 through SEV4, where SEV1 is a critical outage and SEV4 is low impact or cosmetic.
Can I use this skill for security incidents?
No, it is specifically for availability/reliability incidents. Security events should be handled by the incident-response skill.
What tools are included?
It includes three Python scripts: incident_classifier.py, timeline_reconstructor.py, and pir_generator.py.
🤖 Overview, features, install steps and FAQ were generated from the project's SKILL.md on Sep 4, 2026. Always check the original source before running commands.