Iac incident response

Skill selamy-labs/agent-skills/skills/iac-incident-response

Use during infrastructure outages when fixes must preserve declarative source of truth instead of leaving live manual drift behind.From its SKILL.md

Install

npx -y skills add selamy-labs/agent-skills --skill iac-incident-response

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

1.8 KB, 352 tokens by cl100k_base, as published. Nobody here has run it

IaC Incident Response

Use this when infrastructure is broken and there is pressure to fix it directly. The goal is fast recovery without creating hidden state that the next apply will destroy or fail to reproduce.

Rules

Prefer a source change, merge, and apply over direct mutation.
If an emergency manual resource exists, import it into state or replace it through a declared resource before declaring recovery complete.
Do not bridge a branch by hand-applying manifests that the main branch does not own.
Escalate the precise blocker rather than bypassing the source of truth.

Incident Workflow

Identify the failed declarative boundary:
- infrastructure plan/apply
- GitOps sync
- controller reconciliation
- CI secret/config propagation
Make the smallest source change that lets the normal reconciler fix the system.
If live state already changed, reconcile it:
- import hand-made resources into state, or
- remove them only after the declared replacement is ready.
Run a no-drift check after recovery:
- plan shows no unexpected changes, or expected changes are reviewed
- GitOps reports synced/healthy
- a real workload or workflow proves the path works
Capture the guard that would have caught the failure earlier.

Acceptable Diagnostics

Read-only cloud, cluster, and CI commands are fine. They become unsafe when they turn into live patching, deleting, scaling, or secret mutation without a matching source change.

Done

A fresh apply or sync can reproduce the recovered state.
Manual emergency resources are gone or imported.
The incident report names any remaining external blocker.

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.

Gives 0 of the 12 instructions most incident response skills give in 352 tokens

Counted across 209 of the 214 authors here whose files we hold, read 2026-09-06

Give each action item an owner and due datein 25 of 209, across 23 files
Conduct blameless postmortem within 48 hoursin 13 of 209, across 10 files
Mitigate impact before investigating root causein 11 of 209, across 10 files
Apply Five Whys to identify root causein 11 of 209, across 9 files
Try rollback first when a recent deploy caused itin 9 of 209, across 8 files
Keep post-mortems blamelessin 8 of 209, across 7 files
Write blameless postmortems for all incidentsin 8 of 209, across 6 files
Create a runbook for every new alertin 8 of 209
Track action items to completionin 7 of 209
Run automated enumeration scripts like linPEAS or winPEASin 7 of 209, across 2 files
Update stakeholders every 15-30 minutesin 7 of 209, across 5 files
Give every action item an owner and priorityin 7 of 209

Said here and by no other author read

Prefer a source change, merge, and apply over direct mutation
Make the smallest source change that lets the reconciler fix things
Import or replace emergency manual resources before declaring recovery complete
Run a no-drift check after recovery
Verify a real workload proves the recovered path
Capture the guard that would have caught the failure

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.