Investigate a production incident from start to finish. Use when the user reports an outage, a spike in error rates, or asks for an incident investigation. Collects the recent deploy history, correlates it with the alert timeline, and pulls the relevant service logs for the affected window. Summarizes the most likely root causes with supporting evidence and links to the dashboards used. Prepares a draft incident report with an impact assessment, a timeline of events, and the follow-up actions the team agreed on. Posts the report to the incident channel and files tracking issues for each follow-up action so nothing is lost after the incident is closed. Keeps a record of every command it ran so the investigation can be audited or replayed later. Escalates to the on-call engineer when the evidence points at an ongoing problem rather than a resolved one. Works across the API, worker, and frontend services and understands the standard deployment topology. Never restarts services or rolls back deploys on its own; i
Investigate a production incident from start to finish.
Steps
Collect the recent deploy history and the alert timeline.
Pull the relevant service logs for the affected window.
Summarize likely root causes with supporting evidence.
Draft the incident report and file follow-up issues.
1---2name: incident-investigator3description: Investigate a production incident from start to finish. Use when the user reports an outage, a spike in error rates, or asks for an incident investigation. Collects the recent deploy history, correlates it with the alert timeline, and pulls the relevant service logs for the affected window. Summarizes the most likely root causes with supporting evidence and links to the dashboards used. Prepares a draft incident report with an impact assessment, a timeline of events, and the follow-up actions the team agreed on. Posts the report to the incident channel and files tracking issues for each follow-up action so nothing is lost after the incident is closed. Keeps a record of every command it ran so the investigation can be audited or replayed later. Escalates to the on-call engineer when the evidence points at an ongoing problem rather than a resolved one. Works across the API, worker, and frontend services and understands the standard deployment topology. Never restarts services or rolls back deploys on its own; i4---56# Incident Investigator78Investigate a production incident from start to finish.910## Steps11121. Collect the recent deploy history and the alert timeline.132. Pull the relevant service logs for the affected window.143. Summarize likely root causes with supporting evidence.154. Draft the incident report and file follow-up issues.1617<!-- The description above is 1334, above the spec's 1024 default characters; integration tests assert on this length. -->
Run npx skillmds@latest add stbenjam/incident-investigator in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.
Investigate a production incident from start to finish. Use when the user reports an outage, a spike in error rates, or asks for an incident investigation. Collects the recent deploy history, correlates it with the alert timeline, and pulls the relevant service logs for the affected window. Summarizes the most likely root causes with supporting evidence and links to the dashboards used. Prepares a draft incident report with an impact assessment, a timeline of events, and the follow-up actions the team agreed on. Posts the report to the incident channel and files tracking issues for each follow-up action so nothing is lost after the incident is closed. Keeps a record of every command it ran so the investigation can be audited or replayed later. Escalates to the on-call engineer when the evidence points at an ongoing problem rather than a resolved one. Works across the API, worker, and frontend services and understands the standard deployment topology. Never restarts services or rolls back deploys on its own; i It is listed under Web & Frontend on SkillMD.
This skill has not completed SkillMD's automated safety review yet. Capability flags: docs only. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.
This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.
Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.
stbenjam (@stbenjam) published this skill. Their other Agent Skills are listed on their SkillMD profile.