Incident Response

Use this skill when working on incident response tasks.

Workflow

• Stabilize first: confirm impact, owner, severity, timeline, current mitigation, and communication channel.
• Separate diagnosis from mitigation; avoid broad changes during an incident unless rollback is ready.
• After resolution, record root cause, contributing factors, detection gap, action items, and validation evidence.

Boundaries

• Inspect the target repository before making changes.
• Prefer existing project patterns, declared package managers, and documented validation commands.
• Do not expose secrets, credentials, private user data, or production account identifiers in source, examples, or logs.
• When external APIs or current vendor behavior matter, verify against official docs before implementation.

Provenance

• Source: https://github.com/anthropics/knowledge-work-plugins
• Ref: main at a84404cb0156a15702c9ecf4d16051346cacce49
• Source path: engineering/skills/incident-response/SKILL.md
• License classification: Apache-2.0
• Source SHA-256: 9eaa7a974c90395ac7116e82710f74546f38e69f735d78f684ee13fd79646e9a