Agent skill · operations · borghei
incident-commander
Production incident response. Use when handling incidents, classifying severity, reconstructing timelines, writing postmortems, generating comms templates, or building response playbooks with severity scoring and RCA frameworks.
Why this skill is useful
Adds 5 executable Python scripts for incident response automation that enhance the AI's capabilities in severity classification, timeline reconstruction, and postmortem generation.
What it needs
Requires python installed locally. About 3k tokens when loaded. Last updated 2026-07-21. 462 stars on the source repository.
What this skill does
Incident Commander Classify incident severity, reconstruct timelines from heterogeneous event sources, and generate structured post-incident reviews with root cause analysis and action items. Codifies PagerDuty, Google SRE, and Atlassian incident-management practices into severity scoring, escalation matrices, communication templates, RCA frameworks, and SLA/error-budget tracking. Core Capabilities Severity classification — multi-dimensional scoring (revenue, user scope, data/security risk, service criticality, blast radius) into SEV-1 to SEV-4 with confidence and escalation paths. Timeline reconstruction — chronological timelines from logs, alerts, Slack, and deploy events with phase detection and gap analysis. Post-incident review — PIRs with 5 Whys, Fishbone, Timeline, or Bow Tie RCA plus categorized action items (owner, priority, deadline). Postmortem quality — coverage-gap detection, action-item quality scoring, MTTD/MTTR benchmarking. Communication & escalation — severity-specific internal/executive/customer/status-page templates; technical (L1-L4) and business escalation matrices with time-based triggers. SLA / error-budget tracking — SLI/SLO/SLA hierarchy, error budgets, burn-rate alerting, and breach handling. When to Use Handling an active incident — classify severity, establish command, mitigate, communicate. Running a post-incident review — reconstruct timeline, perform RCA, assign action items. Managing escalation — apply technical and business escalation paths by severity and elapsed time. Building or auditing response playbooks, comms templates, or SLA/error-budget policy. Clarify First Before producing the artifact, confirm these inputs. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills borghei/incident-commander