Results for “post-incident-review”

Guide a team through writing a structured, blameless post-mortem after a production incident, covering timeline reconstruction, root cause analysis, impact quantification, and action item generation.

Incident Report (Blameless RCA)

Post-epic review to extract lessons and assess success. Use when the user says "run a retrospective" or "lets retro the epic [epic]"

Guides a blameless post-mortem process for incidents, covering templates, root-cause analysis, action items, and prevention.

Incident Post-Mortem Builder

Responding to incidents: identifies impact scope, formulates recovery procedures, creates postmortems. Use when incident response or disaster recovery is needed. Delegates fixes to Builder.

Conduz investigação de incidentes com método: triagem, hipóteses, mitigação, RCA e postmortem, priorizando evidências e confirmação humana.

Use when detecting, responding to, or recovering from system failures, outages, security breaches, or critical errors. This skill provides a structured incident response process for any type of failure, ensuring consistent handling, communication, and post-incident learning.

Classify, triage, and manage declared security incidents from initial triage through forensic evidence collection and escalation routing.

Runs a post-launch review of a shipped PRD against its success metrics, interviewing the user on metric movement, assumptions, and decisions, then publishing an outcome-review page to Confluence and updating linked artifacts.

Facilitates and documents a team retrospective capturing what went well, what to improve, and action items. Use at the end of sprints, projects, or milestones to reflect and improve team practices.

Composite skill — runs the postmortem chain after any production incident (`/hotfix`, rollback, or prod outage acknowledged). Chains adt-research (root-cause learning) → adr-write (decision capture) → generate-tests (regression test) → security-sweep (conditional, only if root cause is auth/input/secret-related) → knowledge-loop (memory + RAG curation) → handoff. Stops the silent-postmortem failure mode where a hotfix ships and the lessons evaporate. Auto-queues after `/hotfix` Phase 10 completes; also fires when user says "postmortem", "what did we learn", "write up the incident".

Designs and executes tabletop breach simulation exercises for testing organizational breach response capabilities. Covers scenario creation with realistic inject timelines, participant role assignment, communication testing across internal and external channels, decision-point evaluation, and after-action report generation. Keywords: tabletop exercise, breach simulation, incident response testing, scenario design, after-action report.

OI-3 spike harness — heavy consumer skill, BASELINE arm. Builds an incident post-mortem and sources the readability standard mid-workflow by reading a file directly, with NO Skill-tool call. Use only when explicitly invoked by the spike harness with a TRIAL_ID and data path.

Runbook skill for failures: cron error, PA failure, cascade, gateway disconnect, semantic DB stale. Walks: detect → classify → diagnose → notify → log. Replaces ad-hoc failure handling. Triggers: "cron failed", "X is broken", "cascade", "incident", "gateway down", "PA failure".

当一段改动已经写完、要在收尾或合并前对它做一次独立审查时使用——如"审一遍这条分支、review 这次改动、这批代码有没有问题、帮我把关再合"。先把 BASE..HEAD 生成一份审查包一次读完，再按 correctness / readability / architecture / security / performance 五轴加测试质量逐项判定，输出带 file:line 的 Critical / Important / Minor 分级 findings。composable 层能力单元，通常由 execute-task 在整体验收时调用。不要用于：改动还没写完、只想跑测试、要的是动手修复而不是审查、评审需求或技术方案本身。

Build collaborative forensic incident timelines using Timesketch to ingest, normalize, and analyze multi-source event data for attack chain reconstruction and investigation documentation.

Runs a post-batch analysis pipeline after an eval completes: verifies results, executes analysis scripts, refreshes dashboards, and writes a summary report.

Conducts structured post-breach remediation using a lessons learned framework covering root cause remediation, control gap closure, policy updates, training modifications, monitoring enhancements, and regulatory follow-up. Provides a systematic approach to preventing breach recurrence and demonstrating accountability to supervisory authorities. Keywords: post-breach, remediation, lessons learned, root cause, control gap, policy update, training.

Incident response mode — diagnose a production issue, write a postmortem, add follow-up tasks to TODO.md. Use when user says "/incident [description]".

Post-implementation quality gate that reviews changes, fixes small issues (scout rule), creates tasks for medium issues, and generates analysis for large issues.

Use after NEJM reviews arrive — often including a dedicated statistical reviewer and an editor letter — to triage the decision, answer statistical comments rigorously, and draft a point-by-point response that quotes each comment, the response, and the revised manuscript text. Do not run before the main text is actually revised.

Security vulnerability assessment identifying OWASP risks, injection vectors, authentication issues, and data exposure with severity classification.

Facilitates discussion-based tabletop exercises for SOC teams to test incident response procedures, communication workflows, and decision-making under pressure without impacting production systems.

Generates a structured post-task reflection capturing surprises, patterns, prompt improvements, and gotchas, writing it to a markdown file without modifying project rules.

**Server Logs:**

Reviews authorized diffs for auth, input, filesystem, network, secrets, parsers, injection, CI/CD, and supply-chain regressions.

Perform a Cynical Review and produce a findings report. Use when the user requests a critical review of something

Post-implementation quality gate that reviews changes, fixes small issues (scout rule), creates tasks for medium issues, and generates analysis for large issues.

Capture delivery evidence, commands, changed files, blockers, and standards feedback after a work session.

针对 Modular RAG MCP Server 项目的老师式复习 Agent。按章节带领用户系统复习项目知识点，每道题互动问答、给出参考答案，复习结束后记录掌握进度，每次开始时回顾上次进度并建议继续或复习。Use when user says '复习项目', '帮我复习', '带我复习', '开始复习', '项目复习', 'review project', 'study review', '学习复习', '复盘', or wants to systematically review and study the project.

Perform a Cynical Review and produce a findings report. Use when the user requests a critical review of something

Simulates a NeurIPS/SC/ICSE-style peer review with five reviewer personas (HPC, ML, Stats, Reproducibility, Devil's Advocate) that verify every claim against actual result data before submission.

Use the retrospective skill to generate a post-release blameless