Iac incident response

Skill selamy-labs/agent-skills/skills/iac-incident-response

Reusable public SKILL.md workflows for AI agents

Install

npx -y skills add selamy-labs/agent-skills --skill iac-incident-response

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Use during infrastructure outages when fixes must preserve declarative source of truth instead of leaving live manual drift behind.

SKILL.md

1.8 KB, as published. Nobody here has run it

IaC Incident Response

Use this when infrastructure is broken and there is pressure to fix it directly. The goal is fast recovery without creating hidden state that the next apply will destroy or fail to reproduce.

Rules

Prefer a source change, merge, and apply over direct mutation.
If an emergency manual resource exists, import it into state or replace it through a declared resource before declaring recovery complete.
Do not bridge a branch by hand-applying manifests that the main branch does not own.
Escalate the precise blocker rather than bypassing the source of truth.

Incident Workflow

Identify the failed declarative boundary:
- infrastructure plan/apply
- GitOps sync
- controller reconciliation
- CI secret/config propagation
Make the smallest source change that lets the normal reconciler fix the system.
If live state already changed, reconcile it:
- import hand-made resources into state, or
- remove them only after the declared replacement is ready.
Run a no-drift check after recovery:
- plan shows no unexpected changes, or expected changes are reviewed
- GitOps reports synced/healthy
- a real workload or workflow proves the path works
Capture the guard that would have caught the failure earlier.

Acceptable Diagnostics

Read-only cloud, cluster, and CI commands are fine. They become unsafe when they turn into live patching, deleting, scaling, or secret mutation without a matching source change.

Done

A fresh apply or sync can reproduce the recovered state.
Manual emergency resources are gone or imported.
The incident report names any remaining external blocker.

Gives 0 of the 12 instructions most incident response skills give

Counted across 224 of the 224 authors here whose files we hold, read 2026-08-06

Conduct a blameless postmortem within 48 hoursin 24 of 224, across 14 files
perform root cause analysis using five whysin 24 of 224, across 20 files
write a blameless postmortemin 22 of 224, across 19 files
Update stakeholders every 15 to 30 minutesin 19 of 224, across 9 files
assign an owner and due date to every action itemin 18 of 224
Classify incident severity within 5 minutesin 17 of 224, across 7 files
Create a post-mortem documentin 17 of 224, across 14 files
Assign all action items with deadlinesin 14 of 224, across 6 files
Implement immediate mitigation prioritizing user restorationin 13 of 224, across 3 files
assign one incident commanderin 12 of 224
Stop and ask for clarification if inputs are missingin 10 of 224, across 2 files
Escalate earlyin 10 of 224, across 2 files

Said here and by no other author read

prefer source changes over direct mutations
import emergency manual resources into state
do not hand-apply manifests missing from main
escalate precise blockers instead of bypassing truth
make the smallest source change needed
reconcile any changed live state

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once.