New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Incident Commander

by alirezarezvani in alirezarezvani/claude-skills

Comprehensive incident response framework from detection through resolution and post-incident review.

MITAuto-check passedDevOps & Cloud

Install Incident Commander

skills CLI
$ npx skills add alirezarezvani/claude-skills --skill incident-commander -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install alirezarezvani/claude-skills incident-commander --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/alirezarezvani/claude-skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/engineering-team/skills/incident-commander .claude/skills/incident-commander && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
incident-commander
GitHub stars
28k
Token cost
~3.8k tokens
SKILL.md length
1,085 words
Files
24 (incl. scripts, references, assets)
Skills in repo
342
Repo updated
First seen
Licence
MIT

At a glance

Comprehensive incident response framework from detection through resolution and post-incident review.

  • Works in 3 steps: Incident Classifier… → Timeline Reconstructor… → PIR Generator (pir_generator.py)
  • Declaring an incident
  • SKILL.md covers Overview, Key Features, Skills Included and Incident Response Framework, plus 2 more sections
  • Calls python

What it does

Incident Commander is an agent skill from alirezarezvani/claude-skills. Comprehensive incident response framework from detection through resolution and post-incident review. Battle-tested SRE/DevOps practices: severity classification, timeline reconstruction, structured post-incident analysis. Use when declaring an incident, coordinating multi-team response during an outage, leading a post-mortem, or setting up on-call practices for a new service.

Its SKILL.md is about 3.8k tokens, which your agent loads only when the skill is triggered. The skill folder holds 26 other files, including scripts, reference files and assets (for example `README.md`, `assets/incident_report_template.md` and `assets/runbook_template.md`).

It sits in DevOps & Cloud, covering Incident response. The repository describes itself as: 380 Claude Code skills & agent skills & plugins (30+ Agents, 70+ custom commands, 380+ skills, customizable references, scripts)for Claude Code, Codex, Gemini CLI, Cursor, and 8… The licence is MIT.

When your agent uses it

  • Declaring an incident
  • Coordinating multi-team response during an outage
  • Leading a post-mortem
  • Setting up on-call practices for a new service

Example prompts

  • “/incident-commander”

Workflow steps

3 steps, taken from the first numbered list in SKILL.md.

  1. Incident Classifier (incident_classifier.py)
  2. Timeline Reconstructor (timeline_reconstructor.py)
  3. PIR Generator (pir_generator.py)

What it can do on your machine

Read from SKILL.md and the folder at commit 19392f7. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Ships 1 file in scripts/, which the agent can run.

    Shell commands in SKILL.md call:

    • python

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Incident Commander loads about 3.8k tokens when it runs, and up to ~28k if it reads all its reference files. Until then it costs about 100 tokens; SKILL.md has 1,085 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~100
When it runs · the whole SKILL.md, loaded when a task matches
~3.8k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~28k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from alirezarezvani/claude-skills at commit 19392f7, republished under its MIT licence (© alirezarezvani). 1,085 words, ~3,819 tokens.

Download SKILL.mdSave it as .claude/skills/incident-commander/SKILL.md (or your agent's skills folder). This skill also uses 23 other files; get the full folder from GitHub.
name
incident-commander
description
Comprehensive incident response framework from detection through resolution and post-incident review. Battle-tested SRE/DevOps practices: severity classification, timeline reconstruction, structured post-incident analysis. Use when declaring an incident, coordinating multi-team response during an outage, leading a post-mortem, or setting up on-call practices for a new service.

Incident Commander Skill

Category: Engineering Team
Tier: POWERFUL
Author: Claude Skills Team
Version: 1.0.0
Last Updated: February 2026

Overview

Incident response framework for availability/reliability incidents (outages, degradations, failed deploys): severity classification, timeline reconstruction, and post-incident review.

This is NOT security incident triage. For security events (ransomware, intrusion, data exfiltration, IOC analysis, NIST SP 800-61 forensics), route to incident-response. Both skills use SEV1-SEV4 labels; this one scores operational impact (users, revenue, SLA), while incident-response classifies attack types and forensic handling.

Key Features

  • Automated Severity Classification - Intelligent incident triage based on impact and urgency metrics
  • Timeline Reconstruction - Transform scattered logs and events into coherent incident narratives
  • Post-Incident Review Generation - Structured PIRs with multiple RCA frameworks
  • Communication Templates - Pre-built templates for stakeholder updates and escalations
  • Runbook Integration - Generate actionable runbooks from incident patterns

Skills Included

Core Tools

  1. Incident Classifier (incident_classifier.py)

    • Analyzes incident descriptions and outputs severity levels
    • Recommends response teams and initial actions
    • Generates communication templates based on severity

  2. Timeline Reconstructor (timeline_reconstructor.py)

    • Processes timestamped events from multiple sources
    • Reconstructs chronological incident timeline
    • Identifies gaps and provides duration analysis

  3. PIR Generator (pir_generator.py)

    • Creates comprehensive Post-Incident Review documents
    • Applies multiple RCA frameworks (5 Whys, Fishbone, Timeline)
    • Generates actionable follow-up items

Incident Response Framework

Severity Classification System
SEV1 - Critical Outage

Definition: Complete service failure affecting all users or critical business functions

Characteristics:

  • Customer-facing services completely unavailable
  • Data loss or corruption affecting users
  • Security breaches with customer data exposure
  • Revenue-generating systems down
  • SLA violations with financial penalties

Response Requirements:

  • Immediate escalation to on-call engineer
  • Incident Commander assigned within 5 minutes
  • Executive notification within 15 minutes
  • Public status page update within 15 minutes
  • War room established
  • All hands on deck if needed

Communication Frequency: Every 15 minutes until resolution

SEV2 - Major Impact

Definition: Significant degradation affecting subset of users or non-critical functions

Characteristics:

  • Partial service degradation (>25% of users affected)
  • Performance issues causing user frustration
  • Non-critical features unavailable
  • Internal tools impacting productivity
  • Data inconsistencies not affecting user experience

Response Requirements:

  • On-call engineer response within 15 minutes
  • Incident Commander assigned within 30 minutes
  • Status page update within 30 minutes
  • Stakeholder notification within 1 hour
  • Regular team updates

Communication Frequency: Every 30 minutes during active response

SEV3 - Minor Impact

Definition: Limited impact with workarounds available

Characteristics:

  • Single feature or component affected
  • <25% of users impacted
  • Workarounds available
  • Performance degradation not significantly impacting UX
  • Non-urgent monitoring alerts

Response Requirements:

  • Response within 2 hours during business hours
  • Next business day response acceptable outside hours
  • Internal team notification
  • Optional status page update

Communication Frequency: At key milestones only

SEV4 - Low Impact

Definition: Minimal impact, cosmetic issues, or planned maintenance

Characteristics:

  • Cosmetic bugs
  • Documentation issues
  • Logging or monitoring gaps
  • Performance issues with no user impact
  • Development/test environment issues

Response Requirements:

  • Response within 1-2 business days
  • Standard ticket/issue tracking
  • No special escalation required

Communication Frequency: Standard development cycle updates

Incident Commander Role
Primary Responsibilities

  1. Command and Control

    • Own the incident response process
    • Make critical decisions about resource allocation
    • Coordinate between technical teams and stakeholders
    • Maintain situational awareness across all response streams

  2. Communication Hub

    • Provide regular updates to stakeholders
    • Manage external communications (status pages, customer notifications)
    • Facilitate effective communication between response teams
    • Shield responders from external distractions

  3. Process Management

    • Ensure proper incident tracking and documentation
    • Drive toward resolution while maintaining quality
    • Coordinate handoffs between team members
    • Plan and execute rollback strategies if needed

  4. Post-Incident Leadership

    • Ensure thorough post-incident reviews are conducted
    • Drive implementation of preventive measures
    • Share learnings with broader organization
Decision-Making Framework

Emergency Decisions (SEV1/2):

  • Incident Commander has full authority
  • Bias toward action over analysis
  • Document decisions for later review
  • Consult subject matter experts but don't get blocked

Resource Allocation:

  • Can pull in any necessary team members
  • Authority to escalate to senior leadership
  • Can approve emergency spend for external resources
  • Make call on communication channels and timing

Technical Decisions:

  • Lean on technical leads for implementation details
  • Make final calls on trade-offs between speed and risk
  • Approve rollback vs. fix-forward strategies
  • Coordinate testing and validation approaches
Show full SKILL.md (428 more words)Show less
Communication Templates
Initial Incident Notification (SEV1/2)
Subject: [SEV{severity}] {Service Name} - {Brief Description}

Incident Details:
- Start Time: {timestamp}
- Severity: SEV{level}
- Impact: {user impact description}
- Current Status: {investigating/mitigating/resolved}

Technical Details:
- Affected Services: {service list}
- Symptoms: {what users are experiencing}
- Initial Assessment: {suspected root cause if known}

Response Team:
- Incident Commander: {name}
- Technical Lead: {name}
- SMEs Engaged: {list}

Next Update: {timestamp}
Status Page: {link}
War Room: {bridge/chat link}

---
{Incident Commander Name}
{Contact Information}
Executive Summary (SEV1)
Subject: URGENT - Customer-Impacting Outage - {Service Name}

Executive Summary:
{2-3 sentence description of customer impact and business implications}

Key Metrics:
- Time to Detection: {X minutes}
- Time to Engagement: {X minutes} 
- Estimated Customer Impact: {number/percentage}
- Current Status: {status}
- ETA to Resolution: {time or "investigating"}

Leadership Actions Required:
- [ ] Customer communication approval
- [ ] PR/Communications coordination  
- [ ] Resource allocation decisions
- [ ] External vendor engagement

Incident Commander: {name} ({contact})
Next Update: {time}

---
This is an automated alert from our incident response system.
Customer Communication Template
We are currently experiencing {brief description of issue} affecting {scope of impact}. 

Our engineering team was alerted at {time} and is actively working to resolve the issue. We will provide updates every {frequency} until resolved.

What we know:
- {factual statement of impact}
- {factual statement of scope}
- {brief status of response}

What we're doing:
- {primary response action}
- {secondary response action}

Workaround (if available):
{workaround steps or "No workaround currently available"}

We apologize for the inconvenience and will share more information as it becomes available.

Next update: {time}
Status page: {link}
Stakeholder Management
Stakeholder Classification

Internal Stakeholders:

  • Engineering Leadership - Technical decisions and resource allocation
  • Product Management - Customer impact assessment and feature implications
  • Customer Support - User communication and support ticket management
  • Sales/Account Management - Customer relationship management for enterprise clients
  • Executive Team - Business impact decisions and external communication approval
  • Legal/Compliance - Regulatory reporting and liability assessment

External Stakeholders:

  • Customers - Service availability and impact communication
  • Partners - API availability and integration impacts
  • Vendors - Third-party service dependencies and support escalation
  • Regulators - Compliance reporting for regulated industries
  • Public/Media - Transparency for public-facing outages
Communication Cadence by Stakeholder
StakeholderSEV1SEV2SEV3SEV4
Engineering LeadershipReal-time30min4hrsDaily
Executive Team15min1hrEODWeekly
Customer SupportReal-time30min2hrsAs needed
Customers15min1hrOptionalNone
Partners30min2hrsOptionalNone
Runbook Generation Framework
Dynamic Runbook Components

  1. Detection Playbooks

    • Monitoring alert definitions
    • Triage decision trees
    • Escalation trigger points
    • Initial response actions

  2. Response Playbooks

    • Step-by-step mitigation procedures
    • Rollback instructions
    • Validation checkpoints
    • Communication checkpoints

  3. Recovery Playbooks

    • Service restoration procedures
    • Data consistency checks
    • Performance validation
    • User notification processes
Runbook Template Structure
markdown
# {Service/Component} Incident Response Runbook

## Quick Reference
- **Severity Indicators:** {list of conditions for each severity level}
- **Key Contacts:** {on-call rotations and escalation paths}
- **Critical Commands:** {list of emergency commands with descriptions}

## Detection
### Monitoring Alerts
- {Alert name}: {description and thresholds}
- {Alert name}: {description and thresholds}

### Manual Detection Signs
- {Symptom}: {what to look for and where}
- {Symptom}: {what to look for and where}

## Initial Response (0-15 minutes)
1. **Assess Severity**
   - [ ] Check {primary metric}
   - [ ] Verify {secondary indicator}
   - [ ] Classify as SEV{level} based on {criteria}

2. **Establish Command**
   - [ ] Page Incident Commander if SEV1/2
   - [ ] Create incident tracking ticket
   - [ ] Join war room: {link/bridge info}

3. **Initial Investigation**
   - [ ] Check recent deployments: {deployment log location}
   - [ ] Review error logs: {log location and queries}
   - [ ] Verify dependencies: {dependency check commands}

## Mitigation Strategies
### Strategy 1: {Name}
**Use when:** {conditions}
**Steps:**
1. {detailed step with commands}
2. {detailed step with expected outcomes}
3. {validation step}

**Rollback Plan:**
1. {rollback step}
2. {verification step}

### Strategy 2: {Name}
{similar structure}

## Recovery and Validation
1. **Service Restoration**
   - [ ] {restoration step}
   - [ ] Wait for {metric} to return to normal
   - [ ] Validate end-to-end functionality

2. **Communication**
   - [ ] Update status page
   - [ ] Notify stakeholders
   - [ ] Schedule PIR

## Common Pitfalls
- **{Pitfall}:** {description and how to avoid}
- **{Pitfall}:** {description and how to avoid}

## Reference Information
→ See references/reference-information.md for details

## Usage Examples

### Example 1: Database Connection Pool Exhaustion

```bash
# Classify the incident
echo '{"description": "Users reporting 500 errors, database connections timing out", "affected_users": "80%", "business_impact": "high"}' | python scripts/incident_classifier.py

# Reconstruct timeline from logs
python scripts/timeline_reconstructor.py --input assets/sample_timeline_events.json --output timeline.md

# Generate PIR after resolution
python scripts/pir_generator.py --incident assets/sample_incident_data.json --timeline timeline.md --output pir.md
Example 2: API Rate Limiting Incident
bash
# Quick classification from stdin
echo "API rate limits causing customer API calls to fail" | python scripts/incident_classifier.py --format text

# Build timeline from multiple sources
python scripts/timeline_reconstructor.py --input assets/simple_timeline_events.json --detect-phases --gap-analysis

# Generate comprehensive PIR
python scripts/pir_generator.py --incident assets/sample_incident_pir_data.json --rca-method fishbone --action-items

Best Practices

During Incident Response

  1. Maintain Calm Leadership

    • Stay composed under pressure
    • Make decisive calls with incomplete information
    • Communicate confidence while acknowledging uncertainty

  2. Document Everything

    • All actions taken and their outcomes
    • Decision rationale, especially for controversial calls
    • Timeline of events as they happen

  3. Effective Communication

    • Use clear, jargon-free language
    • Provide regular updates even when there's no new information
    • Manage stakeholder expectations proactively

  4. Technical Excellence

    • Prefer rollbacks to risky fixes under pressure
    • Validate fixes before declaring resolution
    • Plan for secondary failures and cascading effects
Post-Incident

  1. Blameless Culture

    • Focus on system failures, not individual mistakes
    • Encourage honest reporting of what went wrong
    • Celebrate learning and improvement opportunities

  2. Action Item Discipline

    • Assign specific owners and due dates
    • Track progress publicly
    • Prioritize based on risk and effort

  3. Knowledge Sharing

    • Share PIRs broadly within the organization
    • Update runbooks based on lessons learned
    • Conduct training sessions for common failure modes

  4. Continuous Improvement

    • Look for patterns across multiple incidents
    • Invest in tooling and automation
    • Regularly review and update processes

Integration with Existing Tools

Monitoring and Alerting
  • PagerDuty/Opsgenie integration for escalation
  • Datadog/Grafana for metrics and dashboards
  • ELK/Splunk for log analysis and correlation
Communication Platforms
  • Slack/Teams for war room coordination
  • Zoom/Meet for video bridges
  • Status page providers (Statuspage.io, etc.)
Documentation Systems
  • Confluence/Notion for PIR storage
  • GitHub/GitLab for runbook version control
  • JIRA/Linear for action item tracking
Change Management
  • CI/CD pipeline integration
  • Deployment tracking systems
  • Feature flag platforms for quick rollbacks

© alirezarezvani, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 23 other files (scripts, references, assets) in engineering-team/skills/incident-commander of alirezarezvani/claude-skills.

  • SKILL.md
  • README.md
  • assets/incident_report_template.md
  • assets/runbook_template.md
  • assets/sample_incident_classification.json
  • assets/sample_incident_data.json
  • assets/sample_incident_pir_data.json
  • assets/sample_timeline_events.json
  • assets/simple_incident.json
  • assets/simple_timeline_events.json
  • expected_outputs/incident_classification_text_output.txt
  • expected_outputs/pir_markdown_output.md
  • expected_outputs/simple_incident_classification.txt
  • expected_outputs/timeline_reconstruction_text_output.txt
  • references/communication_templates.md
  • references/incident-response-framework.md
  • references/incident_severity_matrix.md
  • references/rca_frameworks_guide.md
  • … and 6 more

Open the folder on GitHubat commit 19392f7

Compare with similar skills

Incident Commander next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Incident Commander compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Incident Commander this skillalirezarezvani/claude-skills28k—~3.8kAutomated safety check: PassMIT
Kubernetes Network Root Cause Analysiskubeshark/kubeshark12k—~5.3kAutomated safety check: PassApache-2.0
UModel Root Cause Analysisalibaba/UnifiedModel415—~1.9kAutomated safety check: PassCustom licence
Learningskortix-ai/suna20k—~1.1kAutomated safety check: PassCustom licence
Oncallpigweed-project/pigweed548—~992Automated safety check: PassApache-2.0
Loop Triage Reportcobusgreyling/loop-engineering11k—~500Automated safety check: PassMIT

Similar skills

  • Kubernetes Network Root Cause Analysis

    kubeshark/kubeshark

    Investigates past Kubernetes incidents from Kubeshark traffic snapshots: takes captures, dissects API calls, extracts PCAPs and compares traffic over time.

    12k GitHub stars~5.3k tokensUpdated 2 days ago
    DevOps & CloudAuto-check passed

  • UModel Root Cause Analysis

    alibaba/UnifiedModel

    Investigates a service incident to its root cause by querying a UModel object graph alongside metrics, logs, topology and recent deployments.

    415 GitHub stars~1.9k tokensUpdated 15 days ago
    DevOps & CloudAuto-check passed

  • Learnings

    kortix-ai/suna

    The project's episodic memory: a timestamped ledger of rules paid for with real outages and near-misses, one entry per incident.

    20k GitHub stars~1.1k tokensUpdated today
    DevOps & CloudAuto-check passed

  • Oncall

    pigweed-project/pigweed

    Pigweed oncall rotation runbooks and maintenance workflows (such as rolling CIPD client tools for b/315378787).

    548 GitHub stars~992 tokensUpdated today
    DevOps & CloudAuto-check passed

  • Loop Triage Report

    cobusgreyling/loop-engineering

    Turns CI failures, open issues, recent commits and chat threads into a prioritized markdown report that an automation loop can act on without inventing architecture work.

    11k GitHub stars~500 tokensUpdated today
    DevOps & CloudAuto-check passed

  • Axiom SRE Investigator

    openclaw/clawhub

    Investigates incidents and production problems with hypothesis-driven debugging, queries Axiom observability data when available, and keeps secrets out of commands and output.

    9.5k GitHub stars~7.1k tokensUpdated today
    DevOps & CloudAuto-check passed

More from alirezarezvani/claude-skills

All 342 skills in this repo

  • Agile Product Owner

    alirezarezvani/claude-skills

    Writes INVEST-checked user stories with acceptance criteria, splits epics, plans sprints from velocity and ranks the backlog with a weighted score.

    28k GitHub starsUsed in 3 repos~3.2k tokens
    Auto-check passed

  • Product Strategist

    alirezarezvani/claude-skills

    OKR cascade toolkit for product leaders: generates aligned company-to-team OKRs from five strategy types and scores how well they line up.

    28k GitHub starsUsed in 2 repos~1.8k tokens
    Auto-check passed

  • App Store Optimization

    alirezarezvani/claude-skills

    App Store Optimization (ASO) toolkit for researching keywords, analyzing competitor rankings, generating metadata suggestions, and improving app visibility on Apple App Store and Google Play Store.

    28k GitHub starsUsed in 1 repo~4.2k tokens
    Auto-check passed

  • AWS Solution Architect

    alirezarezvani/claude-skills

    Design AWS architectures for startups using serverless patterns and IaC templates.

    28k GitHub starsUsed in 1 repo~2.5k tokens
    Auto-check passed

  • Campaign Analytics

    alirezarezvani/claude-skills

    Calculates attribution, funnel and ROI figures for marketing campaigns with three Python scripts that need only the standard library.

    28k GitHub starsUsed in 1 repo~2.1k tokens
    Auto-check passed

  • Code to PRD

    alirezarezvani/claude-skills

    Reverse-engineers a frontend, backend or fullstack codebase into a product requirements document with per-page docs, an enum dictionary and an API inventory.

    28k GitHub starsUsed in 1 repo~4.9k tokens
    Auto-check passed

Categories

Questions about Incident Commander

What does Incident Commander do?

Comprehensive incident response framework from detection through resolution and post-incident review. Incident Commander is an agent skill from alirezarezvani/claude-skills. Comprehensive incident response framework from detection through resolution and post-incident review.

When should I use Incident Commander?

Incident Commander fits situations like: declaring an incident; coordinating multi-team response during an outage; leading a post-mortem; setting up on-call practices for a new service.

How do I install Incident Commander in Claude Code?

Run `npx skills add alirezarezvani/claude-skills --skill incident-commander -a claude-code`. Or copy the skill folder (engineering-team/skills/incident-commander in alirezarezvani/claude-skills) into .claude/skills/incident-commander in your project. Claude Code loads it when a task matches its description.

How do I install Incident Commander in Codex?

Run `npx skills add alirezarezvani/claude-skills --skill incident-commander -a codex`. Or copy the skill folder (engineering-team/skills/incident-commander in alirezarezvani/claude-skills) into .agents/skills/incident-commander in your project. Codex loads it when a task matches its description.

Can I use Incident Commander in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add alirezarezvani/claude-skills --skill incident-commander -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/incident-commander, .gemini/skills/incident-commander, .github/skills/incident-commander and .opencode/skills/incident-commander in your project.

What does Incident Commander need to run?

Going by SKILL.md and its folder, Incident Commander needs the command-line tools its instructions call (python).

Does Incident Commander access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Incident Commander safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.

What licence does Incident Commander use?

Incident Commander is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Incident Commander use?

About 3.8k tokens (SKILL.md is roughly 15k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 24k tokens, read only when the agent opens those files.

What are the alternatives to Incident Commander?

Skills that share tags, products or a category with Incident Commander: Kubernetes Network Root Cause Analysis (kubeshark/kubeshark, 12k stars), UModel Root Cause Analysis (alibaba/UnifiedModel, 415 stars), Learnings (kortix-ai/suna, 20k stars) and Oncall (pigweed-project/pigweed, 548 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Incident Commander?

alirezarezvani (a GitHub user) maintains it in alirezarezvani/claude-skills, which has 27,891 GitHub stars. The repository holds 342 skills in this directory. The repository was last updated on August 30, 2026.

Source: alirezarezvani/claude-skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.