Incident comms

Skill shinzoxD/knackbox/skills/writing/incident-comms

Curated, auditable, benchmark-ready Agent Skills library for Claude Code, Codex, OpenCode, Cursor, and more.

Install

npx -y skills add shinzoxD/knackbox --skill incident-comms

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

28 days oldThe repository was created 28 days ago. New is not bad, but a brand new repository carrying a familiar-sounding name is the shape a typosquat arrives in, and there has been no time for anyone else to find a problem with it.
0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Write customer and stakeholder communications during incidents. Use whenever the user needs a status page update, outage notice, customer incident email, or internal incident broadcast — separate from the engineering postmortem write-up.

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.0 KB, as published. Nobody here has run it

Incident Communications

During an incident, communications reduce uncertainty. Be honest, frequent enough, and free of blame and speculation presented as fact.

Channels

Channel	Traits
Status page	short, timestamped, impact + next update time
Customer email	clearer narrative, who is affected, what to do
Internal	more detail, war-room links, roles

Workflow

Confirmed facts only: impact, start time, scope, workaround.
Separate known vs investigating.
Next update time commitment.
Customer actions (if any).
Resolve message when mitigated; promise post-incident follow-up without fake RCAs.

Output format

## Status update — <timestamp UTC>
**Impact:** …
**Current status:** investigating | identified | monitoring | resolved
**What we know:** …
**What we are doing:** …
**Workaround:** …
**Next update by:** …

Rules

Never invent root cause; "under investigation" is valid.
No humor that minimizes customer pain.
Security incidents: minimize exploit detail in public channels.
Match severity cadence (more frequent when impact is high).
Align public wording with legal/support guidance when provided.
Engineering postmortems are a different skill (incident-postmortems).

Edge cases

Partial degradation: be specific about who is affected.
False alarm: brief resolve with apology for noise if customers saw it.
Prolonged incident: rolling updates without repeating empty filler.

Gives 0 of the 12 instructions most incident response skills give

Counted across 224 of the 224 authors here whose files we hold, read 2026-08-06

Conduct a blameless postmortem within 48 hoursin 24 of 224, across 14 files
perform root cause analysis using five whysin 24 of 224, across 20 files
write a blameless postmortemin 22 of 224, across 19 files
Update stakeholders every 15 to 30 minutesin 19 of 224, across 9 files
assign an owner and due date to every action itemin 18 of 224
Classify incident severity within 5 minutesin 17 of 224, across 7 files
Create a post-mortem documentin 17 of 224, across 14 files
Assign all action items with deadlinesin 14 of 224, across 6 files
Implement immediate mitigation prioritizing user restorationin 13 of 224, across 3 files
assign one incident commanderin 12 of 224
Stop and ask for clarification if inputs are missingin 10 of 224, across 2 files
Escalate earlyin 10 of 224, across 2 files

Said here and by no other author read

Use confirmed facts only
Separate known facts from active investigation
Commit to a next update time
State customer actions if any exist
Send resolve message when mitigated
Promise post-incident follow-up without fake root causes

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once.