Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add joao-aires/agent-skills-public --skill incident-responsegit clone --depth 1 https://github.com/joao-aires/agent-skills-publicWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/joao-aires/agent-skills-public/incident-response)<a href="https://agentmods.dev/skills/joao-aires/agent-skills-public/incident-response"><img src="https://agentmods.dev/badge/skills/joao-aires/agent-skills-public/incident-response/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/joao-aires/agent-skills-public/incident-response"><img src="https://agentmods.dev/badge/skills/joao-aires/agent-skills-public/incident-response.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00033 | $0.00776 |
| Opus 5.5 | $0.00013 | $0.00310 |
| Sonnet 5.5 | $0.00007 | $0.00155 |
| Haiku 4.5 | $0.00003 | $0.00078 |
Grade A, and why
incident-response scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 47 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Incident response
Read composition guidance for optional expertise, fallback and scope.
Reduce current user harm and preserve enough evidence to make the next decision. Establish what is failing now, who is affected, and which parts still work. Compare that impact with available signals so an old alert or a broken telemetry path does not define the incident by itself.
Run stabilization and investigation together. Choose a mitigation for the effect it is expected to have, observe whether that effect occurred, and revise the hypothesis when it did not. Record the target, time and result so another responder can understand what changed. Do not delay a supported mitigation to finish a perfect diagnosis.
Modes
- Live interactive response: establish impact, current state and response ownership promptly. Ask only questions needed for the next decision; investigate available sources meanwhile.
- Setup/exercise: implement local role/escalation/communication contracts, verification checks and rehearsals without presenting simulated actions as live operations.
- Recurring review: collect/scoped-correlate signals, draft incident updates and recommended actions. Execute only mitigations explicitly allowed by the incident/job policy; missing authority becomes a concrete handoff. Never reopen an old outage merely because an old alert link exists.
Consult references/response-guide.md for deeper implementation details when needed.
Response loop
- Read the exact alert/ticket/context and its UTC window; also recheck a window ending now. Corroborate customer/business outcomes and telemetry health. Identify scope, trend and evidence of unaffected segments.
- Apply local severity/major-incident criteria and name an incident lead. Separate operations, investigation, communication and timeline roles as staffing permits; explicit role ownership matters more than titles.
- Select the quickest defensible reversible mitigation: rollback/config revert, flag, load control, failover, compatible scale change or scoped maintenance. Preserve volatile evidence first when practical without materially delaying restoration.
- Record hypothesis, expected effect, actual target, action authority, stop/rollback condition and UTC execution/result. Avoid conflicting simultaneous changes; re-evaluate when impact grows or actions fail.
- Investigate: align changes in code/config/platform/credentials/data/load with onset; inspect diffs and scope; compare working/failing variants. Test the strongest hypotheses with discriminating evidence. A recent change is not causal proof.
- Escalate ownership/access/provider boundaries with facts, scope, window, actions/results and specific assistance needed. Keep impact updates on the local cadence and immediately on material changes; use absolute next-update time rather than unsupported fix ETA.
- Verify recovery through the original user/business path and independent signals, including served version/cache/async completion. Observe stability and track temporary controls.
- Handover or close: current impact, timeline, proven/unknown cause, rejected hypotheses, pending jobs/controls, next action and owner. Feed evidence to postmortem facilitation after stabilization.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed · +2 lines 047118c56e8a
- 2d ago Changed · +2 lines f2bcc96916c4
- 7d ago First seen · 43 lines · 33 tokens per session scan A 7b87ed199095
incident-response is a skill published in the GitHub repository joao-aires/agent-skills-public (2 stars, last pushed yesterday), licensed MIT. It adds 33 tokens to every session and 776 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-15.
Other skills, from other repositories
debug-optimize-lcp
Guides debugging and optimizing Largest Contentful Paint (LCP) using Chrome DevTools MCP tools. Use this skill whenever the user asks about LCP performance, slow page loads, Core Web Vitals optimization, or wants to understand why their page's main content takes too long to appear. Also use when the user mentions…
systematic-debugging
Use when debugging a failing test, build error, or runtime issue that isn't immediately obvious. Guides a 4-phase root cause analysis instead of random fix attempts.
log-error-digest
Analyze log files to troubleshoot errors, identify peak error periods, and produce error clustering, frequency statistics, and time distribution reports. Supports JSON, syslog, and Nginx formats with automatic detection. Use when a user uploads a .log file and asks to analyze errors, find patterns, debug issues, or…
deck-retro
Run a fully local agent-deck retrospective over the user's own transcripts, Recall index and logs. Use when a user wants to find recurring failures or take their own finding from investigation through synthetic reproduction, a user-filed issue, a test-first fix and contributor PR handoff. Also use for weekly usage…
incident-response-incident-response
Coordinate production incident triage, mitigation, investigation, recovery, and follow-up. Use when responding to outages or other incidents that require structured operational coordination.
cwv-optimizer
Diagnose and fix Core Web Vitals issues on AEM Edge Delivery Services pages. Goes deeper than generic CWV advice by understanding EDS-specific performance patterns including the 100KB LCP budget, E-L-D loading phases, block rendering behavior, and third-party script impact. Produces specific fixes for LCP, CLS, and…