# Incident Firefighter

> Investigate production incidents using multiple tools and produce structured reports. Use when responding to alerts, correlating logs with metrics, running diagnostic commands, or documenting incident findings.

- Skill: `lurui1997/incident-firefighter` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add lurui1997/incident-firefighter`
- Raw SKILL.md: https://api.skillmd.com/api/skills/lurui1997/incident-firefighter/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: lurui1997 (https://skillmd.com/u/lurui1997)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/lurui1997/incident-firefighter

---


# OnCall Runner

Systematically investigate symptoms and produce a clear incident report.

## Triage

- Confirm the alert scope: which service, region, and time range are affected.
- Check recent deployments, configuration changes, or traffic anomalies.

## Investigation Flow

1. **Metrics**: query dashboards for latency, error rate, throughput shifts.
2. **Logs**: search for error spikes or stack traces in the affected window.
3. **Traces**: identify slow or failing requests and trace downstream calls.
4. **System state**: run `kubectl`, `curl`, or shell commands to inspect running workloads.

## Correlation

- Align timestamps across metrics, logs, and deployment events.
- Look for common labels (host, pod, version, endpoint) linking anomalies.

## Report Template

- **Symptom**: what users or monitors observed.
- **Root cause**: the underlying trigger and contributing factors.
- **Impact**: affected services, user segments, and duration.
- **Resolution**: steps taken to mitigate or fix.
- **Follow-up**: prevention items and monitoring gaps to address.

## Communication

- Provide regular updates to stakeholders during the incident.
- Keep language factual and avoid speculation in written reports.