Best incident response skills for Claude Code, Codex and other agents.

Automates the triage of GitHub issues in the A2UI repository.

a2ui-project/a2ui

Investigates past Kubernetes incidents from Kubeshark traffic snapshots: takes captures, dissects API calls, extracts PCAPs and compares traffic over time.

kubeshark/kubeshark

Decide, don't guess — trigger on ANY combinatorial or ground-state decision where a plausible guess is worse than silence: rosters and on-call schedules, packing and placement, RAG passage…

brayonpi/hexstellar

特定の読み手に向けて、概念・PR・設計を「冗長にならない水準」の速習資料として説明し、図と主張を道具で検証する。読み手のペルソナ（既に知っていること・知らないこと・読み方）を質問と公開情報から作り、その差分だけを書く。図は Mermaid / D2 で描いて事実シートに照らし、本文に引用するコード・出力は再実行して照合し、HTML は vlmkit のゲートに通す。Use when the…

mizchi/explainer

Cross-agent self-inspection of your AI-agent stack. An agent skill from alexgreensh/repo-forensics.

alexgreensh/repo-forensics

Investigates a service incident to its root cause by querying a UModel object graph alongside metrics, logs, topology and recent deployments.

alibaba/UnifiedModel

Pigweed oncall rotation runbooks and maintenance workflows (such as rolling CIPD client tools for b/315378787).

pigweed-project/pigweed

Database operations runbook — backup, recovery, performance tuning, troubleshooting.

OpenDCAI/DataMind

The project's episodic memory: a timestamped ledger of rules paid for with real outages and near-misses, one entry per incident.

kortix-ai/suna

Comprehensive security review framework for AI agents. An agent skill from slowmist/slowmist-agent-security.

slowmist/slowmist-agent-security

Turns CI failures, open issues, recent commits and chat threads into a prioritized markdown report that an automation loop can act on without inventing architecture work.

cobusgreyling/loop-engineering

Expert ISO 42001 AI Management System (AIMS) compliance advisor.

Sushegaad/Claude-Skills-Governance-Risk-and-Compliance

Investigates incidents and production problems with hypothesis-driven debugging, queries Axiom observability data when available, and keeps secrets out of commands and output.

openclaw/clawhub

Design, validate, and govern fail-closed customer-activation automations that use an Outbox/worker pattern.

Ali-Marandi/DataSense

Configure Grafana Alerting, Incident Response Management (IRM), and SLOs end-to-end — provisions Grafana-managed and data-source-managed alert rules, contact points (Slack/PagerDuty/email/webhook)…

grafana/skills

Hunts Windows malware persistence with Sysinternals Autoruns, covering run keys, services, scheduled tasks and drivers, with baseline comparison.

mukul975/Anthropic-Cybersecurity-Skills

Handle security incidents with IR playbooks and procedures. An agent skill from BagelHole/DevOps-Security-Agent-Skills.

BagelHole/DevOps-Security-Agent-Skills

Digital forensics and incident response - Windows event log analysis, PCAP forensics, filesystem artifact analysis, AD attack detection, and timeline correlation.

transilienceai/communitytools

Creates Dockerfiles, configures CI/CD pipelines, writes Kubernetes manifests, and generates Terraform/Pulumi infrastructure templates.

Yikai-Liao/symusic

Write the weekly on-call handoff: everything the incoming on-call needs, triage-ready, posted to the channel at shift boundary.

anthropics/oncall-kit

Triages GitHub issues by routing to oncall teams, applying labels, and closing questions.

pytorch/pytorch

Diagnoses a failing scheduled TMDb Integration run, re-runs transient failures, and fixes real API drift on its own branch with a PR, merging it only when told to.

adamayoung/TMDb

Protocolo de respuesta ante incidentes en produccion: triaje, mitigacion, causa raiz y postmortem.

686f6c61/alfred-dev

Bootstrap a Claude-assisted on-call for this channel/repo: discover the available connectors, mine incident history into draft triage playbooks, interview the human for policy, validate against…

anthropics/oncall-kit

Walks an agent through an evidence-first incident investigation across logs, metrics, code and screenshots, from first symptom to the smallest safe mitigation.

madebyaris/advance-minimax-m3-cursor-rules

Sub-triages issues in the oncall:distributed queue by assigning distributed module labels, routing to sub-oncalls, and marking triaged.

pytorch/pytorch

Does a read-only first pass on a possible production incident: gathers deploy, Sentry and health-check signals, proposes a severity and status message, then stops for human approval.

superset-sh/superset

Drive CI green on a pushed, review-clean feature PR — On-Call diagnoses failures and hands fix tasks to the SWE.

iusztinpaul/squid

Deploys Cisco ACI policy changes only behind an approved ServiceNow Change Request, capturing pre and post-change fault baselines and rolling back automatically on a fault delta.

automateyournetwork/netclaw

Disable or re-enable Cloudflare R2 (download-r2.pytorch.org) usage in managev2.py during R2 outages.

pytorch/test-infra

Install local-first security hardening: pre-commit secret detection, offline dependency scans, static analysis, reports, and gated free CI.

luongnv89/skills

Turns a leaked key, token or password into one tracked rotation task the moment it's spotted, instead of a reminder repeated every session.

avelikiy/great_cto

Runs a phased health audit of a Cisco ACI fabric through MCP tools: node status, links, tenant and policy review, faults and endpoint learning.

automateyournetwork/netclaw

Read and record root causes in the Linear incident-alert knowledge base.

langfuse/langfuse

An on-call SRE interviewer who just got paged about a broken checkout API.

PrepLabsAI/InterviewMentor

Produces a blameless post-incident debrief with timeline, root cause and follow-up actions after an outage, failed release or significant bug, while details are fresh.

VeryGoodOpenSource/vgv-wingspan

Defines SLIs, SLOs and error budgets, and sets up golden-signal monitoring, blameless postmortems, toil automation and chaos experiments for production systems.

Jeffallan/claude-skills

A skill your agent uses for anything about how your MSP runs day-to-day support: setting or questioning a ticket's priority, response and resolution targets, "the client says everything is down"…

RTFM-IT-Services-LLC/msp-claude-skills

Cut a new Sculptor release candidate from main: run just cut-release (which creates the release/sculptor-vX.Y.0 branch at X.Y.0rc1, pushes the tag that triggers the RC build, and opens a PR bumping…

imbue-ai/sculptor

Expert SRE incident responder specializing in rapid problem resolution, modern observability, and comprehensive incident management.

davila7/claude-code-templates

Diagnoses compile errors, runtime exceptions, failing tests, pipeline failures and production alerts from code and logs, giving a root cause before any fix.

davidYichengWei/agentic-engineering-framework

A skill your agent uses when responding to or forensically investigating an incident — triage acquisition (Velociraptor/KAPE), Volatility 3 memory forensics, Chainsaw/Hayabusa EVTX timelining…

hypnguyen1209/offensive-claude

An incident commander interviewer running a P0 outage war room.

PrepLabsAI/InterviewMentor

Automate PagerDuty tasks via Rube MCP (Composio): manage incidents, services, schedules, escalation policies, and on-call rotations.

davepoon/buildwithclaude

Security leadership for growth-stage companies. An agent skill from alirezarezvani/claude-skills.

alirezarezvani/claude-skills

A skill your agent uses for your MSP's proactive, recurring operations: patching and update cycles, maintenance windows, backup monitoring and test restores, monitoring and alert triage, the on-call…

RTFM-IT-Services-LLC/msp-claude-skills

Implement incident management processes and escalation procedures.

sickn33/agentic-awesome-skills

Monitor AI agent health, detect anomalies, set up alerting, and maintain observability dashboards for production multi-agent systems.

cosmicstack-labs/mercury-agent-skills