Borrowing it
Nothing to install: this file belongs to RoboFinSystems/robosystems. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/RoboFinSystems/robosystems/main/.claude/commands/incident.mdgit clone --depth 1 https://github.com/RoboFinSystems/robosystemsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/robofinsystems/robosystems/incident)<a href="https://agentmods.dev/commands/robofinsystems/robosystems/incident"><img src="https://agentmods.dev/badge/commands/robofinsystems/robosystems/incident/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/robofinsystems/robosystems/incident"><img src="https://agentmods.dev/badge/commands/robofinsystems/robosystems/incident.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00019 | $0.01518 |
| Opus 5.5 | $0.00008 | $0.00607 |
| Sonnet 5.5 | $0.00004 | $0.00304 |
| Haiku 4.5 | $0.00002 | $0.00152 |
Grade A, and why
incident scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 69 lines — stays where its author put it; the contents beside it link to each section on GitHub.
A signal says something is wrong — a customer report, an internal user, an alarm email, a spike. This skill gives you a fast, ordered headstart on where to look: triage the signal to a likely subsystem, gather the state that confirms or rules it out, and hand back a crisp picture (impact, likely cause, next action). Pairs with the incident-triage runbook in local/RoboSystems/runbooks/ for the account's known failure classes and exact log groups — read it alongside this file.
Goal
Compress time-to-orientation. You're not expected to fix everything from here — you're expected to answer, quickly and with evidence: what's broken, how bad, since when, and what changed. Breadth before depth: check the obvious surfaces in parallel, then drill into the one that lights up.
Scope & guardrails
- Read-only triage.
describe-*/list-*/get-*, log reads,ghreads. Any remediation — restarting a service, cycling an instance, rolling back, editing data — is a separate, confirmed step, not part of triage. Neverget-secret-value. - Output is sensitive — never commit it. Incident notes name live hostnames, resource IDs, error contents, maybe customer identifiers. Keep them in the scratchpad or a private channel; never in the repo, never in a public Artifact.
- State the confidence. Distinguish confirmed (you saw the error/alarm) from suspected (fits the pattern). A wrong confident diagnosis sends everyone the wrong way.
1. Pin the signal
Get concrete before searching. From whoever/whatever raised it: what is failing (an endpoint? a product surface? everything?), who is affected (one tenant or all?), when it started, and what changed near then. A single-tenant issue and a platform-wide outage need completely different first moves.
Immediately check "what changed". A recent deploy is the highest-prior cause — but it is not the only kind of change, and the other kinds are invisible to gh:
gh run list --workflow=prod.yml --limit 5 # last deploys: when, success/fail, by whom
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 69 lines · 19 tokens per session scan A ce8f81370dd7
incident is a command published in the GitHub repository RoboFinSystems/robosystems (29 stars, last pushed today), licensed Apache-2.0. It adds 19 tokens to every session and 1,518 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
agent-brain-graph
Search using GraphRAG for relationship and dependency queries.
pg-health
Read-only PostgreSQL health check with pgbot, then a prioritized diagnosis.
maestro-odyssey
Long-running iterative cycle — one entry, seven modes (debug|improve|planex|review|security|defensive|ui). Shared archaeology/audit → fix → verify → generalize → discover → persist skeleton with mode-specific dimensions. User-invoked campaign entry; single-step fixes route via /maestro-next.
fix
When /fix is invoked, immediately execute the following steps.
fix
PURPOSE: Fix issues in based on feedback TASK.
incident
A command that turns the current troubleshooting or bug-fixing session into a six-part incident review. An incident review records what happened, why it happened, how it was fixed, and what should improve.