Oncall
pigweed-project/pigweed
Pigweed oncall rotation runbooks and maintenance workflows (such as rolling CIPD client tools for b/315378787).
Protocolo de respuesta ante incidentes en produccion: triaje, mitigacion, causa raiz y postmortem.
Install Incident Response
$ npx skills add 686f6c61/alfred-dev --skill incident-response -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install 686f6c61/alfred-dev incident-response --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/686f6c61/alfred-dev.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/incident-response .claude/skills/incident-response && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "incident-response" agent skill from https://github.com/686f6c61/alfred-dev/tree/main/skills/incident-response into .claude/skills/incident-response/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "incident-response", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/686f6c61/alfred-dev/tree/main/skills/incident-responseType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add 686f6c61/alfred-dev --skill incident-response -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install 686f6c61/alfred-dev incident-response --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/686f6c61/alfred-dev.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/incident-response .agents/skills/incident-response && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "incident-response" agent skill from https://github.com/686f6c61/alfred-dev/tree/main/skills/incident-response into .agents/skills/incident-response/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "incident-response", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add 686f6c61/alfred-dev --skill incident-response -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install 686f6c61/alfred-dev incident-response --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/686f6c61/alfred-dev.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/incident-response .cursor/skills/incident-response && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "incident-response" agent skill from https://github.com/686f6c61/alfred-dev/tree/main/skills/incident-response into .cursor/skills/incident-response/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "incident-response", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/686f6c61/alfred-dev.git --path skills/incident-response--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add 686f6c61/alfred-dev --skill incident-response -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install 686f6c61/alfred-dev incident-response --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/686f6c61/alfred-dev.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/incident-response .gemini/skills/incident-response && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "incident-response" agent skill from https://github.com/686f6c61/alfred-dev/tree/main/skills/incident-response into .gemini/skills/incident-response/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "incident-response", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install 686f6c61/alfred-dev incident-responseInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add 686f6c61/alfred-dev --skill incident-response -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/686f6c61/alfred-dev.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/incident-response .github/skills/incident-response && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "incident-response" agent skill from https://github.com/686f6c61/alfred-dev/tree/main/skills/incident-response into .github/skills/incident-response/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "incident-response", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add 686f6c61/alfred-dev --skill incident-response -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install 686f6c61/alfred-dev incident-response --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/686f6c61/alfred-dev.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/incident-response .opencode/skills/incident-response && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "incident-response" agent skill from https://github.com/686f6c61/alfred-dev/tree/main/skills/incident-response into .opencode/skills/incident-response/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "incident-response", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
incident-response- GitHub stars
- 117
- Token cost
- ~1.1k tokens
- SKILL.md length
- 511 words
- Files
- 1
- Skills in repo
- 11
- Repo updated
- First seen
- Licence
- MIT
At a glance
Protocolo de respuesta ante incidentes en produccion: triaje, mitigacion, causa raiz y postmortem.
- Works in 4 steps: Clasificar la severidad del incidente… → Identificar el impacto: usuarios… → Recopilar evidencia: logs, trazas,… → …
- Tasks that involve Runbooks and postmortems
- SKILL.md covers Resumen, Proceso, Formato del postmortem and Criterios de exito, plus 1 more section
- Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
What it does
Incident Response is an agent skill from 686f6c61/alfred-dev. Protocolo de respuesta ante incidentes en produccion: triaje, mitigacion, causa raiz y postmortem. Usar ante caidas, errores criticos, incidentes de seguridad o degradacion de servicio.
Its SKILL.md is about 1.1k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in DevOps & Cloud, covering Runbooks and postmortems and Incident response. The repository describes itself as: Tu equipo de desarrolladores en un plugin. 10 agentes, 11 skills planas, 18 comandos /alfred-dev:. Memoria persistente, quality gates con evidencia y MCP local. The licence is MIT.
When your agent uses it
- Tasks that involve Runbooks and postmortems
- Tasks that involve Incident response
Example prompts
- “/incident-response”
Workflow steps
4 steps, taken from the first numbered list in SKILL.md.
- Clasificar la severidad del incidente (P0 critico, P1 alto, P2 medio, P3 bajo).
- Identificar el impacto: usuarios afectados, funcionalidad comprometida, datos en riesgo.
- Recopilar evidencia: logs, trazas, capturas, mensajes de error.
- Definir si hay workaround inmediato.
What it can do on your machine
Read from SKILL.md and the folder at commit be0b51e. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md (its code samples are markdown).
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Incident Response loads about 1.1k tokens when it runs. Until then it costs about 51 tokens; SKILL.md has 511 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from 686f6c61/alfred-dev at commit be0b51e, republished under its MIT licence (© 686f6c61). 511 words, ~1,065 tokens.
Download SKILL.mdSave it as
.claude/skills/incident-response/SKILL.md (or your agent's skills folder).- name
- incident-response
- description
- Protocolo de respuesta ante incidentes en produccion: triaje, mitigacion, causa raiz y postmortem. Usar ante caidas, errores criticos, incidentes de seguridad o degradacion de servicio.
- disable-model-invocation
- true
Respuesta ante incidentes
El usuario ha reportado o detectado un incidente en produccion. Sigue este protocolo paso a paso para gestionar la respuesta de forma estructurada, desde el triaje inicial hasta el postmortem final.
Resumen
Los incidentes en produccion requieren una respuesta rapida pero ordenada. La tentacion es saltar directamente al codigo, pero sin un triaje previo se pierde tiempo en diagnosticos erroneos. Este protocolo exige documentar cada paso y registrar las lecciones aprendidas para reducir recurrencias.
Proceso
Fase 1: Triaje (qa-engineer)
Usa la herramienta Agent para lanzar al agente qa-engineer con la siguiente mision:
- Clasificar la severidad del incidente (P0 critico, P1 alto, P2 medio, P3 bajo).
- Identificar el impacto: usuarios afectados, funcionalidad comprometida, datos en riesgo.
- Recopilar evidencia: logs, trazas, capturas, mensajes de error.
- Definir si hay workaround inmediato.
Artefacto: informe de triaje con severidad, impacto y evidencia.
Fase 2: Mitigacion (senior-dev)
Si el triaje indica P0 o P1, ejecutar mitigacion inmediata:
- Aplicar workaround si existe (rollback, feature flag, redirect de trafico).
- Si no hay workaround, desarrollar hotfix minimo con test de regresion.
- Desplegar la mitigacion y verificar que el impacto se reduce.
Artefacto: commit de mitigacion con test de regresion.
Fase 3: Analisis de causa raiz (senior-dev + security-officer)
Una vez mitigado el impacto, investigar la causa raiz:
- Trazar la cadena de eventos desde el trigger hasta el fallo.
- Identificar la causa raiz (no el sintoma).
- Si el incidente tiene componente de seguridad, el security-officer audita la cadena.
- Registrar la causa raiz como decision en la memoria del proyecto.
Artefacto: documento de RCA (Root Cause Analysis).
Fase 4: Postmortem
Generar un informe postmortem completo:
- Cronologia del incidente (cuando se detecto, cuando se mitigo, cuando se resolvio).
- Causa raiz confirmada.
- Acciones correctivas con responsable y fecha limite.
- Acciones preventivas para evitar recurrencia.
- Lecciones aprendidas.
Artefacto: documento postmortem en formato Markdown.
Show full SKILL.md (194 more words)Show less
Formato del postmortem
# Postmortem: [titulo del incidente]
**Fecha:** YYYY-MM-DD
**Severidad:** P0/P1/P2/P3
**Duracion:** X horas/minutos
**Impacto:** [descripcion del impacto]
## Cronologia
- HH:MM - [evento]
- HH:MM - [evento]
## Causa raiz
[Explicacion detallada]
## Acciones correctivas
- [ ] [accion] - Responsable: [nombre] - Fecha: YYYY-MM-DD
## Acciones preventivas
- [ ] [accion] - Responsable: [nombre] - Fecha: YYYY-MM-DD
## Lecciones aprendidas
1. [leccion]Criterios de exito
- El incidente tiene una severidad asignada con criterios objetivos.
- La mitigacion se aplica antes de investigar la causa raiz (primero apagar el fuego).
- Existe un documento de RCA que identifica la causa raiz real, no solo el sintoma.
- El postmortem esta completo con cronologia, acciones correctivas y preventivas.
- Las lecciones aprendidas quedan registradas en la memoria del proyecto.
- Las acciones correctivas tienen responsable y fecha limite asignados.
Que NO hacer
- No saltar el triaje para ir directamente al codigo. Sin un triaje previo se pierde tiempo en hipotesis equivocadas y se corre el riesgo de aplicar cambios que empeoren la situacion. El triaje estructura la respuesta y prioriza correctamente.
- No cerrar el incidente sin postmortem. Un incidente sin postmortem es una oportunidad perdida de aprendizaje. Aunque el fix sea trivial, documentar que fallo y por que evita recurrencias y genera conocimiento institucional.
- No culpar personas en el postmortem. El postmortem se enfoca en procesos y sistemas, no en individuos. La pregunta correcta es "que fallo en el sistema que permitio este error" y no "quien cometio el error". Un postmortem punitivo destruye la confianza y desincentiva la transparencia.
© 686f6c61, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
Just SKILL.md in skills/incident-response of 686f6c61/alfred-dev.
Open the folder on GitHubat commit be0b51e
Compare with similar skills
Incident Response next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Incident Response this skill686f6c61/alfred-dev | 117 | — | ~1.1k | Automated safety check: Pass | MIT | |
| Oncallpigweed-project/pigweed | 548 | — | ~963 | Automated safety check: Pass | Apache-2.0 | |
| Activation Governance Chaos RolloutAli-Marandi/DataSense | 107 | — | ~1.9k | Automated safety check: Pass | MIT | |
| Superset Incident Triagesuperset-sh/superset | 15k | — | ~1k | Automated safety check: Pass | Custom licence | |
| Post-Incident DebriefVeryGoodOpenSource/vgv-wingspan | 109 | — | ~1.9k | Automated safety check: Pass | MIT | |
| SRE EngineerJeffallan/claude-skills | 12k | — | ~1.7k | Automated safety check: Pass | MIT |
Similar skills
Activation Governance Chaos Rollout
Ali-Marandi/DataSense
Design, validate, and govern fail-closed customer-activation automations that use an Outbox/worker pattern.
Superset Incident Triage
superset-sh/superset
Does a read-only first pass on a possible production incident: gathers deploy, Sentry and health-check signals, proposes a severity and status message, then stops for human approval.
Post-Incident Debrief
VeryGoodOpenSource/vgv-wingspan
Produces a blameless post-incident debrief with timeline, root cause and follow-up actions after an outage, failed release or significant bug, while details are fresh.
SRE Engineer
Jeffallan/claude-skills
Defines SLIs, SLOs and error budgets, and sets up golden-signal monitoring, blameless postmortems, toil automation and chaos experiments for production systems.
Cascading Failure Interviewer
PrepLabsAI/InterviewMentor
An incident commander interviewer running a P0 outage war room.
More from 686f6c61/alfred-dev
All 11 skills in this repoMemory
686f6c61/alfred-dev
This skill should be used when the user asks to record a design decision, search past project decisions, inspect the Alfred memory timeline, or work with the alfred-memory MCP server.
PR Workflow
686f6c61/alfred-dev
Crear pull requests completas con descripcion, labels y reviewers
Sonarqube
686f6c61/alfred-dev
Levantar SonarQube con Docker, analizar el código y proponer mejoras.
Style Direction
686f6c61/alfred-dev
Abrir y operar el companion visual de Selina para elegir una direccion de estilo en proyectos con interfaz.
Sync Project Docs
686f6c61/alfred-dev
Usar para sincronizar la documentación viva del proyecto después de una fase.
Write Adr
686f6c61/alfred-dev
Usar para escribir o cerrar un Architecture Decision Record.
Related
Categories
Questions about Incident Response
What does Incident Response do?
Protocolo de respuesta ante incidentes en produccion: triaje, mitigacion, causa raiz y postmortem. Incident Response is an agent skill from 686f6c61/alfred-dev. Protocolo de respuesta ante incidentes en produccion: triaje, mitigacion, causa raiz y postmortem.
When should I use Incident Response?
Incident Response fits situations like: tasks that involve Runbooks and postmortems; tasks that involve Incident response.
How do I install Incident Response in Claude Code?
Run `npx skills add 686f6c61/alfred-dev --skill incident-response -a claude-code`. Or copy the skill folder (skills/incident-response in 686f6c61/alfred-dev) into .claude/skills/incident-response in your project. Claude Code loads it when a task matches its description.
How do I install Incident Response in Codex?
Run `npx skills add 686f6c61/alfred-dev --skill incident-response -a codex`. Or copy the skill folder (skills/incident-response in 686f6c61/alfred-dev) into .agents/skills/incident-response in your project. Codex loads it when a task matches its description.
Can I use Incident Response in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add 686f6c61/alfred-dev --skill incident-response -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/incident-response, .gemini/skills/incident-response, .github/skills/incident-response and .opencode/skills/incident-response in your project.
What does Incident Response need to run?
SKILL.md names no scripts, command-line tools or credentials: Incident Response is instructions for the agent only.
Does Incident Response access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Incident Response safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Incident Response use?
Incident Response is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Incident Response use?
About 1.1k tokens (SKILL.md is roughly 4.3k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Incident Response?
Skills that share tags, products or a category with Incident Response: Oncall (pigweed-project/pigweed, 548 stars), Activation Governance Chaos Rollout (Ali-Marandi/DataSense, 107 stars), Superset Incident Triage (superset-sh/superset, 15k stars) and Post-Incident Debrief (VeryGoodOpenSource/vgv-wingspan, 109 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Incident Response?
686f6c61 (a GitHub user) maintains it in 686f6c61/alfred-dev, which has 117 GitHub stars. The repository holds 11 skills in this directory. The repository was last updated on August 15, 2026.
Source: 686f6c61/alfred-dev on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.