agentsclimarketplace

Agent incident response team

Skill Amey-Thakur/AI-SKILLS/skills/multi-agent-teams/agent-incident-response-team

Plug-and-play skills and prompts for every AI coding agent

Install
npx -y skills add Amey-Thakur/AI-SKILLS --skill agent-incident-response-team

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

  • 19 days oldThe repository was created 19 days ago. New is not bad, but a brand new repository carrying a familiar-sounding name is the shape a typosquat arrives in, and there has been no time for anyone else to find a problem with it.
  • 4 stars4 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Replicate a live incident team as agents with a commander, parallel investigators, comms, and a scribe, coordinated on a fixed cadence. Use when you want an outage worked by a coordinated agent team instead of one agent debugging alone.

SKILL.md

3.5 KB, as published. Nobody here has run it

Incident response team of agents

An outage worked by one agent is five hypotheses chased in series with no record of what was ruled out. A real incident team splits the work: one agent commands, several investigate in parallel, one narrates to stakeholders, one writes the timeline. The commander coordinates and never touches the fix, so investigators stay heads-down and the decisions survive the night.

Team

  • Commander (incident-commander-role): sets severity, assigns, holds go/no-go.
  • Investigators (site-reliability-engineer): chase separate hypotheses in parallel.
  • Comms (technical-writer-role): drafts status updates on a cadence.
  • Scribe: timestamps every action and finding.

Shape: a coordinating hub with parallel investigation and a cadence loop; see war-room-protocol.

Method

  1. Spawn the commander first, exactly one. It scores severity from user-visible impact (SEV1 full outage, SEV2 major degraded path, SEV3 contained), opens incident.md, and assigns surfaces. One named commander ends the "someone else owns it" gap.
  2. Fan investigators out on disjoint hypotheses. No two chase the same graph. Each returns a hypothesis card: symptom, hypothesis, test run, result. The commander reassigns as cards come back.
  3. Run the scribe as a passive logger. It subscribes to every agent's output and appends a timestamped line to timeline.md: "14:32 rolled back deploy 4471, error rate flat." This is the postmortem's raw material.
  4. Hold a fixed comms cadence. Comms drafts a status every 15 to 30 minutes by severity, even when it reads "still investigating, next update 14:50." A human approves before anything posts to a public status page.
  5. Drive to mitigation before root cause. The commander picks the fastest safe stop: roll back, fail over, flip the flag, shed load. Forensics wait; the customer's minutes do not.
  6. Declare resolved against written criteria, then hand off. Metrics normal for a set window with no manual mitigation holding them up. The commander names a postmortem owner and date and closes the channel.

Run it

In Claude Code, launch investigators as parallel subagents in one orchestrator turn, each with the incident brief and a distinct hypothesis; the commander agent (or you as orchestrator) reads their cards and the scribe's timeline to pick the next move, and comms output routes to a human gate before external posting. Port it to CrewAI as a hierarchical crew with the commander as manager, to AutoGen as a GroupChat with a manager agent, or to LangGraph as a supervisor routing to investigator nodes over a shared state object.

Signals it works

  • Any agent's output names the current commander and severity without scrolling.
  • The timeline lets someone joining at hour two catch up in two minutes.
  • Mitigation is the fastest safe option, not the most satisfying root-cause fix.

Boundaries

This coordinates the live response, not the retrospective, which a postmortem skill owns, nor the code fix, which stays with the owning engineers. Severity ladders and paging policy are company convention: match your on-call runbook. A security breach or data-disclosure event pulls in human security and legal, who make those calls.

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.