Oncall
pigweed-project/pigweed
Pigweed oncall rotation runbooks and maintenance workflows (such as rolling CIPD client tools for b/315378787).
Create structured incident response runbooks with step-by-step procedures, escalation paths, and recovery actions.
Install Incident Runbook Templates
$ npx skills add wshobson/agents --skill incident-runbook-templates -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install wshobson/agents incident-runbook-templates --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/wshobson/agents.git skills-src && mkdir -p .claude/skills && cp -r skills-src/plugins/incident-response/skills/incident-runbook-templates .claude/skills/incident-runbook-templates && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "incident-runbook-templates" agent skill from https://github.com/wshobson/agents/tree/main/plugins/incident-response/skills/incident-runbook-templates into .claude/skills/incident-runbook-templates/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "incident-runbook-templates", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/wshobson/agents/tree/main/plugins/incident-response/skills/incident-runbook-templatesType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add wshobson/agents --skill incident-runbook-templates -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install wshobson/agents incident-runbook-templates --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/wshobson/agents.git skills-src && mkdir -p .agents/skills && cp -r skills-src/plugins/incident-response/skills/incident-runbook-templates .agents/skills/incident-runbook-templates && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "incident-runbook-templates" agent skill from https://github.com/wshobson/agents/tree/main/plugins/incident-response/skills/incident-runbook-templates into .agents/skills/incident-runbook-templates/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "incident-runbook-templates", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add wshobson/agents --skill incident-runbook-templates -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install wshobson/agents incident-runbook-templates --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/wshobson/agents.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/plugins/incident-response/skills/incident-runbook-templates .cursor/skills/incident-runbook-templates && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "incident-runbook-templates" agent skill from https://github.com/wshobson/agents/tree/main/plugins/incident-response/skills/incident-runbook-templates into .cursor/skills/incident-runbook-templates/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "incident-runbook-templates", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/wshobson/agents.git --path plugins/incident-response/skills/incident-runbook-templates--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add wshobson/agents --skill incident-runbook-templates -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install wshobson/agents incident-runbook-templates --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/wshobson/agents.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/plugins/incident-response/skills/incident-runbook-templates .gemini/skills/incident-runbook-templates && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "incident-runbook-templates" agent skill from https://github.com/wshobson/agents/tree/main/plugins/incident-response/skills/incident-runbook-templates into .gemini/skills/incident-runbook-templates/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "incident-runbook-templates", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install wshobson/agents incident-runbook-templatesInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add wshobson/agents --skill incident-runbook-templates -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/wshobson/agents.git skills-src && mkdir -p .github/skills && cp -r skills-src/plugins/incident-response/skills/incident-runbook-templates .github/skills/incident-runbook-templates && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "incident-runbook-templates" agent skill from https://github.com/wshobson/agents/tree/main/plugins/incident-response/skills/incident-runbook-templates into .github/skills/incident-runbook-templates/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "incident-runbook-templates", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add wshobson/agents --skill incident-runbook-templates -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install wshobson/agents incident-runbook-templates --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/wshobson/agents.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/plugins/incident-response/skills/incident-runbook-templates .opencode/skills/incident-runbook-templates && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "incident-runbook-templates" agent skill from https://github.com/wshobson/agents/tree/main/plugins/incident-response/skills/incident-runbook-templates into .opencode/skills/incident-runbook-templates/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "incident-runbook-templates", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
incident-runbook-templates- GitHub stars
- 40k
- Token cost
- ~1.4k tokens
- SKILL.md length
- 401 words
- Files
- 2 (incl. references)
- Skills in repo
- 142
- Repo updated
- First seen
- Licence
- MIT
At a glance
Create structured incident response runbooks with step-by-step procedures, escalation paths, and recovery actions.
- Works in 2 steps: Incident Severity Levels → Runbook Structure
- Building a service outage runbook for a payment processing system
- SKILL.md covers When to Use This Skill, Core Concepts, Detailed patterns and worked… and Best Practices, plus 2 more sections
- Calls kubectl
What it does
Incident Runbook Templates is an agent skill from wshobson/agents. Create structured incident response runbooks with step-by-step procedures, escalation paths, and recovery actions. Use this skill when building a service outage runbook for a payment processing system; creating database incident procedures covering connection pool exhaustion, replication lag, and disk space alerts; onboarding new on-call engineers who need step-by-step recovery guides written for a 3 AM brain; or standardizing escalation matrices across multiple engineering teams.
Its SKILL.md is about 1.4k tokens, which your agent loads only when the skill is triggered. The skill folder holds 2 other files, including reference files (for example `references/details.md`).
It sits in DevOps & Cloud, covering Runbooks and postmortems and Incident response. The repository describes itself as: Multi-harness agentic plugin marketplace for Claude Code, Codex, Cursor, OpenCode, GitHub Copilot, Google Antigravity, and Pi. The licence is MIT.
When your agent uses it
- Building a service outage runbook for a payment processing system
- Creating database incident procedures covering connection pool exhaustion
- Replication lag
- Disk space alerts
Example prompts
- “/incident-runbook-templates”
Workflow steps
2 steps, taken from the step headings in SKILL.md.
What it can do on your machine
Read from SKILL.md and the folder at commit 46891e7. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
kubectl
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md. Its commands use kubectl, which can reach the network depending on how they are called.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Incident Runbook Templates loads about 1.4k tokens when it runs, and up to ~3.6k if it reads all its reference files. Until then it costs about 128 tokens; SKILL.md has 401 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from wshobson/agents at commit 46891e7, republished under its MIT licence (© wshobson). 401 words, ~1,366 tokens.
Download SKILL.mdSave it as
.claude/skills/incident-runbook-templates/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.- name
- incident-runbook-templates
- description
- Create structured incident response runbooks with step-by-step procedures, escalation paths, and recovery actions. Use this skill when building a service outage runbook for a payment processing system; creating database incident procedures covering connection pool exhaustion, replication lag, and disk space alerts; onboarding new on-call engineers who need step-by-step recovery guides written for a 3 AM brain; or standardizing escalation matrices across multiple engineering teams.
Incident Runbook Templates
Production-ready templates for incident response runbooks covering detection, triage, mitigation, resolution, and communication.
When to Use This Skill
- Creating incident response procedures
- Building service-specific runbooks
- Establishing escalation paths
- Documenting recovery procedures
- Responding to active incidents
- Onboarding on-call engineers
Core Concepts
1. Incident Severity Levels
| Severity | Impact | Response Time | Example |
|---|---|---|---|
| SEV1 | Complete outage, data loss | 15 min | Production down |
| SEV2 | Major degradation | 30 min | Critical feature broken |
| SEV3 | Minor impact | 2 hours | Non-critical bug |
| SEV4 | Minimal impact | Next business day | Cosmetic issue |
2. Runbook Structure
1. Overview & Impact
2. Detection & Alerts
3. Initial Triage
4. Mitigation Steps
5. Root Cause Investigation
6. Resolution Procedures
7. Verification & Rollback
8. Communication Templates
9. Escalation MatrixDetailed patterns and worked examples
Detailed pattern documentation lives in references/details.md. Read that file when the navigation tier above is insufficient.
Best Practices
Do's
- Keep runbooks updated - Review after every incident
- Test runbooks regularly - Game days, chaos engineering
- Include rollback steps - Always have an escape hatch
- Document assumptions - What must be true for steps to work
- Link to dashboards - Quick access during stress
Don'ts
- Don't assume knowledge - Write for 3 AM brain
- Don't skip verification - Confirm each step worked
- Don't forget communication - Keep stakeholders informed
- Don't work alone - Escalate early
- Don't skip postmortems - Learn from every incident
Troubleshooting
Runbook steps work in staging but fail during a real incident
Steps often assume preconditions that are true in a healthy environment but not during an outage. For each command in your runbook, add a prerequisite check and a "what to do if this command fails" note:
# Step: Check pod status
kubectl get pods -n payments
# Prerequisites: kubectl configured, kubeconfig points to correct cluster
# If this fails: run `aws eks update-kubeconfig --name prod-cluster --region us-east-1`
# Expected output: pods in Running stateShow full SKILL.md (169 more words)Show less
On-call engineer panics and skips steps out of order
Add a numbered checklist at the top of the runbook that mirrors the section numbers, so responders can track progress under stress without reading the full document:
## Quick Checklist
- [ ] 1. Declare incident severity and open war room
- [ ] 2. Check service health (Section 4.1)
- [ ] 3. Check recent deployments (Section 4.1)
- [ ] 4. Roll back if deploy is suspect (Section 4.1)
- [ ] 5. Post initial notification to #payments-incidents
- [ ] 6. Escalate if > 15 min unresolvedRunbook is outdated — commands reference old cluster names or endpoints
Runbooks rot because they're updated manually. Include a "Last Verified" date and owner at the top, and add a CI check that validates all curl endpoints and kubectl context names are still valid:
## Runbook Metadata
| Field | Value |
|---|---|
| Last verified | 2024-11-15 |
| Owner | @platform-team |
| Review cadence | After every SEV1/SEV2 |Stakeholder communication is delayed while engineers are heads-down
Assign a dedicated incident communicator role (separate from the incident commander) whose only job is to post status updates. Add a standing agenda in the communication template:
Update every 15 minutes (even if no new information):
- Current status (Investigating / Mitigating / Monitoring)
- Impact (what is broken, who is affected, % of traffic)
- What we are doing right now
- Next update in: 15 minutesDatabase runbook commands cause additional downtime when run incorrectly
Add explicit warnings before destructive SQL commands and require a dry-run output check before executing:
-- WARNING: This terminates active connections. Verify count first.
-- DRY RUN (check count before terminating):
SELECT count(*) FROM pg_stat_activity WHERE state = 'idle' AND query_start < now() - interval '10 minutes';
-- EXECUTE only after verifying count is reasonable (< 50):
SELECT pg_terminate_backend(pid) FROM pg_stat_activity
WHERE state = 'idle' AND query_start < now() - interval '10 minutes';Related Skills
postmortem-writing- After resolving an incident, use postmortem templates to capture root cause and preventive actionson-call-handoff-patterns- Structure shift handoffs so the incoming responder has full context on active incidents
© wshobson, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
SKILL.md and 1 other file (references) in plugins/incident-response/skills/incident-runbook-templates of wshobson/agents.
- SKILL.md
- references/details.md
Open the folder on GitHubat commit 46891e7
Compare with similar skills
Incident Runbook Templates next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Incident Runbook Templates this skillwshobson/agents | 40k | — | ~1.4k | Automated safety check: Pass | MIT | |
| Oncallpigweed-project/pigweed | 548 | — | ~963 | Automated safety check: Pass | Apache-2.0 | |
| Activation Governance Chaos RolloutAli-Marandi/DataSense | 107 | — | ~1.9k | Automated safety check: Pass | MIT | |
| Incident Response686f6c61/alfred-dev | 117 | — | ~1.1k | Automated safety check: Pass | MIT | |
| Superset Incident Triagesuperset-sh/superset | 15k | — | ~1k | Automated safety check: Pass | Custom licence | |
| Post-Incident DebriefVeryGoodOpenSource/vgv-wingspan | 109 | — | ~1.9k | Automated safety check: Pass | MIT |
Similar skills
Activation Governance Chaos Rollout
Ali-Marandi/DataSense
Design, validate, and govern fail-closed customer-activation automations that use an Outbox/worker pattern.
Incident Response
686f6c61/alfred-dev
Protocolo de respuesta ante incidentes en produccion: triaje, mitigacion, causa raiz y postmortem.
Superset Incident Triage
superset-sh/superset
Does a read-only first pass on a possible production incident: gathers deploy, Sentry and health-check signals, proposes a severity and status message, then stops for human approval.
Post-Incident Debrief
VeryGoodOpenSource/vgv-wingspan
Produces a blameless post-incident debrief with timeline, root cause and follow-up actions after an outage, failed release or significant bug, while details are fresh.
SRE Engineer
Jeffallan/claude-skills
Defines SLIs, SLOs and error budgets, and sets up golden-signal monitoring, blameless postmortems, toil automation and chaos experiments for production systems.
More from wshobson/agents
All 142 skills in this repoCloud Cost Optimization
wshobson/agents
Cuts cloud spend across AWS, Azure, GCP and OCI with cost tagging, rightsizing, commitment and spot pricing models, and architecture changes.
Billing Automation
wshobson/agents
Covers building subscription billing: billing cycles, subscription states, invoice generation, proration, tax handling and dunning for failed payments.
Python Performance Optimization
wshobson/agents
Profiles slow Python code with cProfile and memory profilers, then applies targeted fixes for CPU, memory, I/O and query bottlenecks.
Bats Shell Testing Patterns
wshobson/agents
Writes unit tests for shell scripts with Bats: error-condition tests, fixtures and mocks, cross-shell checks, parallel runs, helper files and CI integration.
Distributed Tracing
wshobson/agents
Implement distributed tracing with Jaeger and Tempo to track requests across microservices and identify performance bottlenecks.
Prompt Engineering Patterns
wshobson/agents
Reference for designing and tuning production LLM prompts: few-shot examples, chain-of-thought, structured outputs, templates and system prompts.
Related
Categories
Questions about Incident Runbook Templates
What does Incident Runbook Templates do?
Create structured incident response runbooks with step-by-step procedures, escalation paths, and recovery actions. Incident Runbook Templates is an agent skill from wshobson/agents. Create structured incident response runbooks with step-by-step procedures, escalation paths, and recovery actions.
When should I use Incident Runbook Templates?
Incident Runbook Templates fits situations like: building a service outage runbook for a payment processing system; creating database incident procedures covering connection pool exhaustion; replication lag; disk space alerts.
How do I install Incident Runbook Templates in Claude Code?
Run `npx skills add wshobson/agents --skill incident-runbook-templates -a claude-code`. Or copy the skill folder (plugins/incident-response/skills/incident-runbook-templates in wshobson/agents) into .claude/skills/incident-runbook-templates in your project. Claude Code loads it when a task matches its description.
How do I install Incident Runbook Templates in Codex?
Run `npx skills add wshobson/agents --skill incident-runbook-templates -a codex`. Or copy the skill folder (plugins/incident-response/skills/incident-runbook-templates in wshobson/agents) into .agents/skills/incident-runbook-templates in your project. Codex loads it when a task matches its description.
Can I use Incident Runbook Templates in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add wshobson/agents --skill incident-runbook-templates -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/incident-runbook-templates, .gemini/skills/incident-runbook-templates, .github/skills/incident-runbook-templates and .opencode/skills/incident-runbook-templates in your project.
What does Incident Runbook Templates need to run?
Going by SKILL.md and its folder, Incident Runbook Templates needs the command-line tools its instructions call (kubectl).
Does Incident Runbook Templates access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Incident Runbook Templates safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Incident Runbook Templates use?
Incident Runbook Templates is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Incident Runbook Templates use?
About 1.4k tokens (SKILL.md is roughly 5.5k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 2.2k tokens, read only when the agent opens those files.
What are the alternatives to Incident Runbook Templates?
Skills that share tags, products or a category with Incident Runbook Templates: Oncall (pigweed-project/pigweed, 548 stars), Activation Governance Chaos Rollout (Ali-Marandi/DataSense, 107 stars), Incident Response (686f6c61/alfred-dev, 117 stars) and Superset Incident Triage (superset-sh/superset, 15k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Incident Runbook Templates?
wshobson (a GitHub user) maintains it in wshobson/agents, which has 40,314 GitHub stars. The repository holds 142 skills in this directory. The repository was last updated on October 5, 2026.
Source: wshobson/agents on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.