Incident
Manage incidents across 4 phases: Triage → Communicate → Mitigate → Postmortem.
Customization
Before executing, check for user customizations at:
${PAI_USER_DIR}/SKILLCUSTOMIZATIONS/Incident/
If this directory exists, load and apply:
PREFERENCES.md - Severity thresholds, escalation contacts, communication templates- Additional files specific to the skill
These define user-specific preferences. If the directory does not exist, proceed with skill defaults.
Workflow Routing
| Workflow |
Trigger |
File |
| New |
"new incident", "production down", "SEV1" |
Workflows/New.md |
| Update |
"incident update", "status update" |
Workflows/Update.md |
| Postmortem |
"postmortem", "blameless review", "root cause" |
Workflows/Postmortem.md |
Examples
Example 1: Start a new incident
User: "Production API is returning 500s for all users"
→ Invokes New workflow
→ Assesses severity, identifies affected systems
→ Produces triage summary + status update + communication draft
Example 2: Post a status update
User: "Update the incident — we identified the cause, it's a bad deploy"
→ Invokes Update workflow
→ Structures update with current status, actions taken, next steps
→ Outputs formatted status update ready to post
Example 3: Write postmortem
User: "Write the postmortem for yesterday's outage"
→ Invokes Postmortem workflow
→ Reconstructs timeline, runs 5 Whys analysis
→ Produces blameless postmortem with action items
Quick Reference
Severity Levels:
| Level |
Criteria |
Response Time |
| SEV1 |
Total outage, all users affected |
Immediate, all-hands |
| SEV2 |
Major degradation, many users affected |
< 15 min, on-call team |
| SEV3 |
Partial degradation, some users affected |
< 1 hour, assigned team |
| SEV4 |
Minor issue, workaround available |
Next business day |
Phases:
- Triage — Severity, impact, roles (IC, comms, responders)
- Communicate — Internal update, customer comms, war room cadence
- Mitigate — Steps taken, timeline tracking, resolution confirmation
- Postmortem — Blameless review, 5 Whys, action items with owners
1---2name: incident3description: Incident management from detection through postmortem. USE WHEN incident, outage, SEV1, SEV2, production down, postmortem, blameless review, incident response, war room, incident update, status page, root cause analysis, 5 whys, incident timeline, on-call.4---56# Incident78Manage incidents across 4 phases: Triage → Communicate → Mitigate → Postmortem.910## Customization1112**Before executing, check for user customizations at:**13`${PAI_USER_DIR}/SKILLCUSTOMIZATIONS/Incident/`1415If this directory exists, load and apply:16- `PREFERENCES.md` - Severity thresholds, escalation contacts, communication templates17- Additional files specific to the skill1819These define user-specific preferences. If the directory does not exist, proceed with skill defaults.2021## Workflow Routing2223| Workflow | Trigger | File |24|----------|---------|------|25| **New** | "new incident", "production down", "SEV1" | `Workflows/New.md` |26| **Update** | "incident update", "status update" | `Workflows/Update.md` |27| **Postmortem** | "postmortem", "blameless review", "root cause" | `Workflows/Postmortem.md` |2829## Examples3031**Example 1: Start a new incident**32```33User: "Production API is returning 500s for all users"34→ Invokes New workflow35→ Assesses severity, identifies affected systems36→ Produces triage summary + status update + communication draft37```3839**Example 2: Post a status update**40```41User: "Update the incident — we identified the cause, it's a bad deploy"42→ Invokes Update workflow43→ Structures update with current status, actions taken, next steps44→ Outputs formatted status update ready to post45```4647**Example 3: Write postmortem**48```49User: "Write the postmortem for yesterday's outage"50→ Invokes Postmortem workflow51→ Reconstructs timeline, runs 5 Whys analysis52→ Produces blameless postmortem with action items53```5455## Quick Reference5657**Severity Levels:**58| Level | Criteria | Response Time |59|-------|----------|---------------|60| SEV1 | Total outage, all users affected | Immediate, all-hands |61| SEV2 | Major degradation, many users affected | < 15 min, on-call team |62| SEV3 | Partial degradation, some users affected | < 1 hour, assigned team |63| SEV4 | Minor issue, workaround available | Next business day |6465**Phases:**661. **Triage** — Severity, impact, roles (IC, comms, responders)672. **Communicate** — Internal update, customer comms, war room cadence683. **Mitigate** — Steps taken, timeline tracking, resolution confirmation694. **Postmortem** — Blameless review, 5 Whys, action items with owners
mj-deving