incident-response
Runs an incident workflow: triage and severity, status communication, and a blameless postmortem after resolution.
- Kind
- Skill
- Works with
- Claude Code
- Source
- Claude knowledge-work plugins @ 2574e29377c7
- Path
- engineering/skills/incident-response/SKILL.md
- Jobs
- Debugging, Documentation
- Topics
- Incidents & on-call
Credit
- Made by
- anthropics
- Original
- github.com/anthropics/knowledge-work-plugins/blob/2574e29377c…
- License
- Apache-2.0
Listed by Skill Manifest; not made by us.
InstallInstall it from a plugin marketplace.
claude plugin install engineering@knowledge-work-plugins
Install factsScanned 2 Nov 2026
- Adds
- .claude/skills/incident-response/ (the skill folder)
- 1 file(s) the skill refers to
- Runs scripts
- None found
- Uses the network
- None found
- Needs secrets
- None found
- Source revision
- 2574e29377c7
- Licence
- Apache-2.0
- Last activity
- 1 Nov 2026
- Review
- Reviewed
Found by a static scan of the stored text; nothing is run. “None found” is not a guarantee, so read what you install before you run it.
- Only the main file is read; other files in the folder are not scanned
# /incident-response > If you see unfamiliar placeholders or need to check which tools are connected, see [CONNECTORS.md](../../CONNECTORS.md). Manage an incident from detection through postmortem. ## Usage ``` /incident-response $ARGUMENTS ``` ## Modes ``` /incident-response new [description] # Start a new incident /incident-response update [status] # Post a status update /incident-response postmortem # Generate postmortem from incident data ``` If no mode is specified, ask what phase the incident is in. ## How It Works ``` ┌─────────────────────────────────────────────────────────────────┐ │ INCIDENT RESPONSE │ ├─────────────────────────────────────────────────────────────────┤ │ Phase 1: TRIAGE │ │ ✓ Assess severity (SEV1-4) │ │ ✓ Identify affected systems and users │ │ ✓ Assign roles (IC, comms, responders) │ │ │ │ Phase 2: COMMUNICATE │ …