Agent skill

Slack Incident Workflow

by automateyournetwork in automateyournetwork/netclaw

Manage network incident response workflows in Slack - incident channels, status updates, escalation, resolution tracking, and post-incident review coordination.

Apache-2.0Auto-check passedDevOps & Cloud

Install Slack Incident Workflow

skills CLI
$ npx skills add automateyournetwork/netclaw --skill slack-incident-workflow -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install automateyournetwork/netclaw slack-incident-workflow --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/automateyournetwork/netclaw.git skills-src && mkdir -p .claude/skills && cp -r skills-src/workspace/skills/slack-incident-workflow .claude/skills/slack-incident-workflow && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
slack-incident-workflow
GitHub stars
676
Token cost
~2.1k tokens
SKILL.md length
380 words
Files
1
Skills in repo
120
Repo updated
First seen
Licence
Apache-2.0

At a glance

Manage network incident response workflows in Slack - incident channels, status updates, escalation, resolution tracking, and post-incident review coordination.

  • Works in 6 steps: Detection & Declaration → Triage & Assignment → Automated Investigation → …
  • Declaring a network incident
  • SKILL.md covers Slack OAuth Scopes Used, Incident Lifecycle in Slack, Escalation Matrix and Reaction-Based Status Tracking, plus 3 more sections
  • Calls python3

What it does

Slack Incident Workflow is an agent skill from automateyournetwork/netclaw. Manage network incident response workflows in Slack - incident channels, status updates, escalation, resolution tracking, and post-incident review coordination. Use when declaring a network incident, coordinating outage response in Slack, tracking incident status, or running a post-incident review.

Its SKILL.md is about 2.1k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in DevOps & Cloud, covering Incident response. It works with Slack and ServiceNow. The repository describes itself as: An AI agent that claws through your network. The licence is Apache-2.0.

When your agent uses it

  • Declaring a network incident
  • Coordinating outage response in Slack
  • Tracking incident status
  • Running a post-incident review

Example prompts

  • “/slack-incident-workflow”

Requirements

  • Python 3

Workflow steps

6 steps, taken from the step headings in SKILL.md.

  1. Detection & Declaration
  2. Triage & Assignment
  3. Automated Investigation
  4. Status Updates
  5. Resolution
  6. Post-Incident Review

What it can do on your machine

Read from SKILL.md and the folder at commit aa90e7d. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • python3

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Slack Incident Workflow loads about 2.1k tokens when it runs. Until then it costs about 81 tokens; SKILL.md has 380 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~81
When it runs · the whole SKILL.md, loaded when a task matches
~2.1k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from automateyournetwork/netclaw at commit aa90e7d, republished under its Apache-2.0 licence (© automateyournetwork). 380 words, ~2,125 tokens.

Download SKILL.mdSave it as .claude/skills/slack-incident-workflow/SKILL.md (or your agent's skills folder).
name
slack-incident-workflow
description
Manage network incident response workflows in Slack - incident channels, status updates, escalation, resolution tracking, and post-incident review coordination. Use when declaring a network incident, coordinating outage response in Slack, tracking incident status, or running a post-incident review.
license
Apache-2.0
user-invocable
true

Slack Incident Workflow

Slack OAuth Scopes Used

ScopePurpose
assistant:writeAct as App Agent in incident threads
chat:writePost incident updates
channels:joinJoin incident channels
channels:historyRead channel context for investigation
groups:historyAccess private incident channels
groups:readView private channel info
pins:readReference pinned runbooks/procedures
bookmarks:readAccess saved incident resources
bookmarks:writeSave incident artifacts
files:writeAttach logs, configs, diagrams
reactions:writeTrack incident status via reactions
users:readIdentify on-call engineers
users.profile:readCheck engineer availability
dnd:readRespect Do Not Disturb before paging

Incident Lifecycle in Slack

Phase 1: Detection & Declaration

When a critical alert triggers (from slack-network-alerts skill or human report):

:rotating_light: *INCIDENT DECLARED — Network Outage*
*Severity:* P1 — Service Impacting
*Detected:* 2024-02-21 14:32 UTC
*Reporter:* NetClaw (automated) / @engineer1 (manual)

*Symptoms:*
• R1 unreachable (ping 0%)
• 47 downstream routes lost
• 3 OSPF adjacencies down
• BGP peer to ISP: IDLE

*Impact:*
• Site A has no WAN connectivity
• Estimated affected users: ~200

*Incident Commander:* [awaiting claim — react with :raised_hand: to take IC]
*ServiceNow:* [CR/INC pending]

━━━ *All investigation updates in this thread* ━━━
Phase 2: Triage & Assignment

When an engineer reacts with :raised_hand::

:busts_in_silhouette: *Incident Team Formed*
*IC:* @engineer1 (claimed at 14:35 UTC)
*NetClaw:* Automated investigation assistant

*Triage Checklist:*
:white_check_mark: Alert generated and posted
:white_check_mark: Incident declared (P1)
:white_large_square: IC assigned → :white_check_mark: @engineer1
:white_large_square: ServiceNow incident created
:white_large_square: Upstream device checked
:white_large_square: Blast radius confirmed
:white_large_square: Customer communication sent

_NetClaw beginning automated investigation..._
Phase 3: Automated Investigation

NetClaw runs diagnostics and posts results in the thread:

:mag: *Automated Investigation — Step 1/4*
_Checking upstream device R2 for connectivity to R1..._

PYATS_TESTBED_PATH=$PYATS_TESTBED_PATH python3 $MCP_CALL \
  "${PYATS_PYTHON:-python3} -u $PYATS_MCP_SCRIPT" pyats_ping_from_network_device \
  '{"device_name":"R2","command":"ping 10.1.1.1 repeat 10"}'

Post each step result:

:mag: *Investigation Results — Step 1/4*
*Ping from R2 to R1 (10.1.1.1):* 0% success — R1 unreachable from upstream

:mag: *Investigation Results — Step 2/4*
*R2 interface Gi1 (toward R1):* up/up, 0 CRC errors, last input 4 min ago
→ Physical layer looks OK from R2 side

:mag: *Investigation Results — Step 3/4*
*R2 OSPF neighbors:* R1 missing from neighbor table (was FULL)
→ OSPF adjacency lost, DR election may be in progress

:mag: *Investigation Results — Step 4/4*
*R2 logs (last 30 min):*

14:31:47: %OSPF-5-ADJCHG: Nbr 1.1.1.1 on Gi1 from FULL to DOWN 14:31:48: %LINEPROTO-5-UPDOWN: Line protocol on Gi1, changed to down 14:32:01: %LINEPROTO-5-UPDOWN: Line protocol on Gi1, changed to up 14:32:15: %OSPF-5-ADJCHG: Nbr 1.1.1.1 on Gi1 from DOWN to INIT


*Analysis:* R2 saw Gi1 flap at 14:31. Line protocol came back up but OSPF hasn't re-converged. Likely physical issue on R1 side causing interface bounce.
Phase 4: Status Updates

Post periodic status updates:

:hourglass_flowing_sand: *Status Update — 14:50 UTC (18 min elapsed)*
*Status:* Investigating
*Finding:* R1 appears to have reloaded unexpectedly. R2 sees the link recover but R1 is not responding to OSPF hellos yet. Possible crash or power event.
*Next Step:* Waiting for R1 to complete boot sequence. Checking console access.
*ETA:* Unknown — dependent on R1 recovery

_ServiceNow INC0012345 updated_
Phase 5: Resolution
:white_check_mark: *INCIDENT RESOLVED*
*Duration:* 34 minutes (14:32 — 15:06 UTC)
*Resolution:* R1 experienced a software crash (Traceback in logs). Device auto-reloaded and recovered. All OSPF adjacencies re-established. Full routing restored.

*Post-Resolution Verification:*
• R1 reachable: :white_check_mark: 100% ping success
• OSPF neighbors: :white_check_mark: 3/3 FULL
• BGP peer: :white_check_mark: Established
• Route count: :white_check_mark: 47 routes (matches baseline)
• Connectivity: :white_check_mark: 100% to all targets

*Root Cause:* Software crash — Traceback found in logs indicating bug CSCxx12345. TAC case recommended.

*ServiceNow:* INC0012345 resolved
*GAIT:* Session abc123 closed
Phase 6: Post-Incident Review
:clipboard: *Post-Incident Review — Scheduled*
*Incident:* Network Outage — R1 crash
*Date:* 2024-02-22 10:00 UTC
*Channel:* This thread

*Review Artifacts (attached):*
1. :page_facing_up: Timeline of events
2. :page_facing_up: R1 show logging output
3. :page_facing_up: R1 show version (confirms reload reason)
4. :page_facing_up: GAIT audit trail (full session)
5. :page_facing_up: Pre/post health check comparison

*Discussion Topics:*
• Was detection fast enough?
• Was automated investigation helpful?
• What monitoring gaps exist?
• Should R1 be upgraded to patched version?
• Do we need redundant path for this link?

Escalation Matrix

:arrow_up: *Escalation Guide*

│ Severity │ Notify              │ Escalate After │ Channel          │
│ P1       │ IC + Manager + NOC  │ 15 min         │ #incidents       │
│ P2       │ IC + Team           │ 30 min         │ #netclaw-alerts  │
│ P3       │ Assigned engineer   │ 4 hours        │ #netclaw-alerts  │
│ P4       │ Queue only          │ Next business   │ #netclaw-general │

Before escalating, check DND status:

  • If engineer has DND active, escalate to next person in rotation
  • Never suppress P1 escalation for DND

Reaction-Based Status Tracking

ReactionStatusMeaning
:rotating_light:DeclaredIncident is active
:raised_hand:ClaimedIC has taken ownership
:mag:InvestigatingActive investigation
:wrench:FixingFix being applied
:hourglass:WaitingWaiting on external (vendor, ISP)
:white_check_mark:ResolvedIncident resolved
:bookmark:PIR ScheduledPost-incident review planned
Show full SKILL.md (134 more words)Show less

ServiceNow Integration

Create ServiceNow incident at Phase 1:

bash
python3 $MCP_CALL "python3 -u $SERVICENOW_MCP_SCRIPT" create_incident \
  '{"short_description":"P1 - R1 unreachable, WAN outage Site A","description":"R1 is unreachable. 47 routes lost, 3 OSPF adjacencies down. Impact: ~200 users at Site A without WAN connectivity.","urgency":"1","impact":"1","category":"Network"}'

Update ServiceNow as incident progresses and close on resolution.

GAIT Audit Trail

Record every phase in GAIT:

bash
python3 $MCP_CALL "python3 -u $GAIT_MCP_SCRIPT" gait_record_turn \
  '{"input":{"role":"assistant","content":"INCIDENT P1: R1 unreachable. Phase 1 declared, Phase 2 IC assigned @engineer1, Phase 3 automated investigation shows R1 crash, Phase 4 monitoring recovery, Phase 5 resolved after 34 min. INC0012345 closed.","artifacts":[]}}'

Failure Behavior

  • If a tool call fails with an authentication or connection error, check that GAIT_MCP_SCRIPT, PYATS_MCP_SCRIPT, SERVICENOW_MCP_SCRIPT are set and valid before assuming a data or device problem.
  • On a tool error (timeout, unreachable host, malformed response), report the failure and its error message directly to the user rather than fabricating or guessing at results.
  • For a confirmed read-only call, check connectivity and retry once if appropriate. For any call that changes state or sends a message, a timeout does not prove the action failed: inspect current state or delivery status before retrying, preserve the required approval/change gates, and do not repeat an action whose outcome is unknown.

© automateyournetwork, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in workspace/skills/slack-incident-workflow of automateyournetwork/netclaw.

Open the folder on GitHubat commit aa90e7d

Compare with similar skills

Slack Incident Workflow next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Slack Incident Workflow compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Slack Incident Workflow this skillautomateyournetwork/netclaw676—~2.1kAutomated safety check: PassApache-2.0
Axiom SRE Investigatoropenclaw/clawhub9.5k—~7.1kAutomated safety check: PassMIT
Alerting Irmgrafana/skills2821 repos~1.9kAutomated safety check: PassApache-2.0
Doordash Group Ordersdavila7/claude-code-templates33k—~1.3kAutomated safety check: PassMIT
Oncall Irmgrafana/skills282—~1.4kAutomated safety check: PassApache-2.0
Vercel Incident Runbookjeremylongshore/tons-of-skills-marketplace2.8k—~2kAutomated safety check: PassMIT

Similar skills

  • Axiom SRE Investigator

    openclaw/clawhub

    Investigates incidents and production problems with hypothesis-driven debugging, queries Axiom observability data when available, and keeps secrets out of commands and output.

    9.5k GitHub stars~7.1k tokensUpdated yesterday
    DevOps & CloudAuto-check passed
  • Alerting Irm

    grafana/skills

    Official

    Configure Grafana Alerting, Incident Response Management (IRM), and SLOs end-to-end — provisions Grafana-managed and data-source-managed alert rules, contact points (Slack/PagerDuty/email/webhook)…

    282 GitHub starsUsed in 1 repo~1.9k tokens
    DevOps & CloudAuto-check passed
  • Doordash Group Orders

    davila7/claude-code-templates

    Group food ordering through the DoorDash CLI (dd-cli) from a persistent team roster.

    33k GitHub stars~1.3k tokensUpdated today
    DevOps & CloudAuto-check passed
  • Oncall Irm

    grafana/skills

    Official

    Route alerts, run on-call rotations, and drive incidents in Grafana IRM / OnCall — integrations (Alertmanager / Grafana Alerting / generic webhook / PagerDuty), Jinja2 routing + grouping templates…

    282 GitHub stars~1.4k tokensUpdated 2 days ago
    DevOps & CloudAuto-check passed
  • Vercel Incident Runbook

    jeremylongshore/tons-of-skills-marketplace

    Vercel incident response procedures with triage, instant rollback, and postmortem.

    2.8k GitHub stars~2k tokensUpdated today
    DevOps & CloudAuto-check passed
  • Sentry Alert Tuner

    LeoYeAI/openclaw-master-skills

    Reduce Sentry alert fatigue by surgically tuning issue grouping, fingerprint rules, severity mapping, sample rates, before-send filters, sourcemap pipelines, and release-health gates.

    2.2k GitHub stars~7.3k tokensUpdated 2 mo ago
    DevOps & CloudAuto-check passed

More from automateyournetwork/netclaw

All 120 skills in this repo
  • EVE-NG Lab Topology Design

    automateyournetwork/netclaw

    Entry point for designing EVE-NG network labs: classifies the request, gathers missing requirements, proposes options and validates the resulting topology.

    676 GitHub stars~612 tokensUpdated yesterday
    Auto-check passed
  • ACI Policy Change Deployment

    automateyournetwork/netclaw

    Deploys Cisco ACI policy changes only behind an approved ServiceNow Change Request, capturing pre and post-change fault baselines and rolling back automatically on a fault delta.

    676 GitHub stars~4.2k tokensUpdated yesterday
    Auto-check passed
  • Cisco ACI Fabric Health Audit

    automateyournetwork/netclaw

    Runs a phased health audit of a Cisco ACI fabric through MCP tools: node status, links, tenant and policy review, faults and endpoint learning.

    676 GitHub stars~2.9k tokensUpdated yesterday
    Auto-check passed
  • Anta Validation

    automateyournetwork/netclaw

    Validate Arista EOS network state against ANTA's pre-built 208-test catalogue, with structured pass/fail verdicts.

    676 GitHub stars~1.2k tokensUpdated yesterday
    Auto-check passed
  • Arista Cvp

    automateyournetwork/netclaw

    Arista CloudVision Portal (CVP) automation via REST API — device inventory, events, connectivity monitoring, tag management (4 tools).

    676 GitHub stars~2.2k tokensUpdated yesterday
    Auto-check: notes
  • AWS Cloud Monitoring

    automateyournetwork/netclaw

    AWS CloudWatch monitoring — metrics, alarms, log queries, VPC flow log analysis, network performance.

    676 GitHub stars~1k tokensUpdated yesterday
    Auto-check passed

Works with

Categories

Questions about Slack Incident Workflow

What does Slack Incident Workflow do?

Manage network incident response workflows in Slack - incident channels, status updates, escalation, resolution tracking, and post-incident review coordination. Slack Incident Workflow is an agent skill from automateyournetwork/netclaw. Manage network incident response workflows in Slack - incident channels, status updates, escalation, resolution tracking, and post-incident review coordination.

When should I use Slack Incident Workflow?

Slack Incident Workflow fits situations like: declaring a network incident; coordinating outage response in Slack; tracking incident status; running a post-incident review.

How do I install Slack Incident Workflow in Claude Code?

Run `npx skills add automateyournetwork/netclaw --skill slack-incident-workflow -a claude-code`. Or copy the skill folder (workspace/skills/slack-incident-workflow in automateyournetwork/netclaw) into .claude/skills/slack-incident-workflow in your project. Claude Code loads it when a task matches its description.

How do I install Slack Incident Workflow in Codex?

Run `npx skills add automateyournetwork/netclaw --skill slack-incident-workflow -a codex`. Or copy the skill folder (workspace/skills/slack-incident-workflow in automateyournetwork/netclaw) into .agents/skills/slack-incident-workflow in your project. Codex loads it when a task matches its description.

Can I use Slack Incident Workflow in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add automateyournetwork/netclaw --skill slack-incident-workflow -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/slack-incident-workflow, .gemini/skills/slack-incident-workflow, .github/skills/slack-incident-workflow and .opencode/skills/slack-incident-workflow in your project.

What does Slack Incident Workflow need to run?

Going by SKILL.md and its folder, Slack Incident Workflow needs the command-line tools its instructions call (python3). Our summary lists: Python 3.

Does Slack Incident Workflow access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Slack Incident Workflow safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Slack Incident Workflow use?

Slack Incident Workflow is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Slack Incident Workflow use?

About 2.1k tokens (SKILL.md is roughly 8.5k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Slack Incident Workflow?

Skills that share tags, products or a category with Slack Incident Workflow: Axiom SRE Investigator (openclaw/clawhub, 9.5k stars), Alerting Irm (grafana/skills, 282 stars), Doordash Group Orders (davila7/claude-code-templates, 33k stars) and Oncall Irm (grafana/skills, 282 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Slack Incident Workflow?

automateyournetwork (a GitHub user) maintains it in automateyournetwork/netclaw, which has 676 GitHub stars. The repository holds 120 skills in this directory. The repository was last updated on October 9, 2026.

Source: automateyournetwork/netclaw on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.