incident

incident is a skill for Claude Code from arbazkhan971/godmode. It costs 60 tokens per session (1,939 once invoked), scanned A, original, MIT.

A guide for responding to production incidents and writing post-mortems. A post-mortem is a factual record of what happened, its impact, and follow-up actions after a failure.

In plain words
What is it for?
Use it when a service is down or degraded, when reviewing recent deployments and error rates, and when documenting resolved incidents and action items.
Why use it?
It provides a consistent way to classify severity, build an incident timeline, coordinate recovery, and learn from failures without blaming individuals.

Skill for Claude Code

Written for Claude Code: shipped in a Claude Code plugin.

Part of the godmode plugin — 132 skills, 1 command, 7 agents, 3 MCP servers shipped together

Good fit Use it when a service is down or degraded, when reviewing recent deployments and error rates, and when documenting resolved incidents and action items.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/arbazkhan971/godmode/incident
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add arbazkhan971/godmode --skill incident
Clone the repo
git clone --depth 1 https://github.com/arbazkhan971/godmode

Made for: Claude Code.

Or install godmode, the plugin that ships this one along with the rest of its 132 skills, 1 command, 7 agents, 3 MCP servers.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for incident

README.md
[![agentmods](https://agentmods.dev/badge/skills/arbazkhan971/godmode/incident.svg)](https://agentmods.dev/skills/arbazkhan971/godmode/incident)
Your own site
<a href="https://agentmods.dev/skills/arbazkhan971/godmode/incident"><img src="https://agentmods.dev/badge/skills/arbazkhan971/godmode/incident.svg" alt="Measured on agentmods" height="20"></a>
Per session 60 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,939 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector pass 7 Sept 2026
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00060 $0.01939
Opus 5 $0.00030 $0.00970
Sonnet 5 $0.00012 $0.00388
Haiku 4.5 $0.00006 $0.00194

Measured 4d ago against content hash f200267fe451, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-08, from the pricing page.

Security

Grade A, and why

incident scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

curl -s "http://localhost:9090/api/v1/query?\
skills/incident/SKILL.md · 258 lines

How it starts

The opening of the file, as written. The whole thing — 258 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Incident — Incident Response & Post-Mortem

Activate When

  • User invokes /godmode:incident
  • User reports production outage or degradation
  • User says "production is down", "write a post-mortem"
  • Monitoring alerts or PagerDuty notifications shared

Workflow

Step 1: Incident Classification

# Check recent deployments (common root cause)
git log --oneline --since="2 hours ago" | head -10

# Check error rates if monitoring accessible
curl -s "http://localhost:9090/api/v1/query?\
query=rate(http_requests_total{code=~'5..'}[5m])" \
  2>/dev/null | head -5
INCIDENT CLASSIFICATION:
ID: INC-<YYYY-MM-DD>-<NNN>
Title: <concise impact description>
Severity: <SEV1 | SEV2 | SEV3 | SEV4>
Status: INVESTIGATING | IDENTIFIED | MONITORING | RESOLVED

SEVERITY MATRIX:
| Level | Impact           | Response Time |
|-------|-----------------|---------------|
| SEV1  | Complete outage | < 15 min      |
| SEV2  | Major degradation| < 30 min     |
| SEV3  | Partial degradation| < 2 hours  |
| SEV4  | Minimal impact  | Next business day|

IF error rate > 50%: SEV1
IF error rate 10-50% or major feature broken: SEV2
IF error rate 1-10% or workaround exists: SEV3
IF cosmetic or < 1% impact: SEV4

Step 2: Timeline Construction

INCIDENT TIMELINE — INC-<ID>:
| Timestamp (UTC) | Event                    |
|-----------------|--------------------------|
| HH:MM:SS        | First alert triggered    |
| HH:MM:SS        | On-call acknowledged     |
| HH:MM:SS        | Root cause identified    |
| HH:MM:SS        | Mitigation applied       |
| HH:MM:SS        | Service restored         |
| HH:MM:SS        | Incident resolved        |

EVIDENCE per entry:
  - Monitoring dashboards (screenshots/links)
  - Log snippets with timestamps
  - Deploy records (commit SHA, timestamp)
  - Customer reports / support tickets

Step 3: Impact Assessment

IMPACT:
Duration: <start> to <end> (<total minutes>)
Users affected: <number or percentage>
Requests failed: <number or error rate %>
Revenue impact: <estimated $ or unknown>
SLA consumed: <budget used, remaining>
Data impact: <lost, corrupted, exposed, or NONE>

THRESHOLDS:
  MTTD target: < 5 minutes (symptom to alert)
  MTTA target: < 15 minutes (alert to response)
  MTTR target: < 60 minutes (detection to resolution)
  IF MTTR > 120 min for SEV1: escalate process review

Read the full file on GitHub · 258 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 4d ago First seen · 258 lines · 60 tokens per session scan A f200267fe451

Subscribe to this mod's changes

incident is a skill published in the GitHub repository arbazkhan971/godmode (26 stars, last pushed 10d ago), licensed MIT. It adds 60 tokens to every session and 1,939 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

Related

Other skills, from other repositories

utility-pm-skill-iterate

Applies targeted improvements to an existing pm-skills skill based on feedback, validation reports, or convention changes. Reads current files, previews proposed changes, writes on confirmation, and suggests a version bump. Use when improving a skill after validation or feedback.

product-on-purpose/pm-skills · 58 tokens

speckit-workflow

Comprehensive understanding of the spec-kit methodology. Constitution-driven feature development with specify, plan, tasks, and implement phases.

tzachbon/smart-ralph · 30 tokens

reddit-moderate

Reddit moderation via PRAW: fetch modqueue, classify reports, take actions.

notque/vexjoy-agent · 22 tokens

plan

Breaks features/goals into phased plans with task lists, agent assignments, dependencies. Triggers: plan feature, implementation roadmap, break down task, project phases.

softspark/ai-toolkit · 35 tokens

om-auto-fix-issue

Fix or implement a tracker issue end to end from a single command — takes an issue id or a plain problem description (filed first via om-prepare-issue), classifies, then drives the bug autofix chain (om-verify-in-repo, om-root-cause, om-fix, om-open-pr, om-auto-review-pr, om-auto-qa-pr for UI fixes) or the feature…

open-mercato/skills · 131 tokens

foundation-okr-writer

Drafts, reviews, rewrites, and coaches outcome-based OKR sets across team, department, product, or company scopes. Supports five entry modes (Guided default, One-Shot via --oneshot, Sustained Coach, Audit Only, Rewrite). Diagnoses empowered-team context and adjusts framing; refuses to fabricate baselines or targets…

product-on-purpose/pm-skills · 130 tokens