incident

A read-only procedure for investigating a production warning, error report, or unusual system change. It narrows the problem to a likely subsystem and records the evidence, impact, timing, and next action.

In plain words
What is it for?
Use it to check system state and logs, identify what is broken and how badly, find when it started and what changed, and prepare an incident summary.
Why use it?
It gives you an ordered starting point when a live system may be failing, without making risky changes during the initial investigation.

Command for Claude Code

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add commands/robofinsystems/robosystems/incident
Clone the repo
git clone --depth 1 https://github.com/RoboFinSystems/robosystems

Made for: Claude Code.

Per session 19 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 1,518 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00019 $0.01518
Opus 5 $0.00010 $0.00759
Sonnet 5 $0.00004 $0.00304
Haiku 4.5 $0.00002 $0.00152

Measured 3d ago against content hash ce8f81370dd7, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

incident scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/commands/incident.md · 69 lines

How it starts

The opening of the file, as written. The whole thing — 69 lines — stays where its author put it; the contents beside it link to each section on GitHub.

A signal says something is wrong — a customer report, an internal user, an alarm email, a spike. This skill gives you a fast, ordered headstart on where to look: triage the signal to a likely subsystem, gather the state that confirms or rules it out, and hand back a crisp picture (impact, likely cause, next action). Pairs with the incident-triage runbook in local/RoboSystems/runbooks/ for the account's known failure classes and exact log groups — read it alongside this file.

Goal

Compress time-to-orientation. You're not expected to fix everything from here — you're expected to answer, quickly and with evidence: what's broken, how bad, since when, and what changed. Breadth before depth: check the obvious surfaces in parallel, then drill into the one that lights up.

Scope & guardrails

  • Read-only triage. describe-* / list-* / get-*, log reads, gh reads. Any remediation — restarting a service, cycling an instance, rolling back, editing data — is a separate, confirmed step, not part of triage. Never get-secret-value.
  • Output is sensitive — never commit it. Incident notes name live hostnames, resource IDs, error contents, maybe customer identifiers. Keep them in the scratchpad or a private channel; never in the repo, never in a public Artifact.
  • State the confidence. Distinguish confirmed (you saw the error/alarm) from suspected (fits the pattern). A wrong confident diagnosis sends everyone the wrong way.

1. Pin the signal

Get concrete before searching. From whoever/whatever raised it: what is failing (an endpoint? a product surface? everything?), who is affected (one tenant or all?), when it started, and what changed near then. A single-tenant issue and a platform-wide outage need completely different first moves.

Immediately check "what changed". A recent deploy is the highest-prior cause — but it is not the only kind of change, and the other kinds are invisible to gh:

gh run list --workflow=prod.yml --limit 5      # last deploys: when, success/fail, by whom

Read the full file on GitHub · 69 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 3d ago First seen · 69 lines · 19 tokens per session scan A ce8f81370dd7

Subscribe to this mod's changes

incident is a command published in the GitHub repository RoboFinSystems/robosystems (24 stars, last pushed 4d ago), licensed Apache-2.0. It adds 19 tokens to every session and 1,518 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.