Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add kumaran-is/claude-code-onboarding --skill ai-incident-responsegit clone --depth 1 https://github.com/kumaran-is/claude-code-onboardingWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kumaran-is/claude-code-onboarding/ai-incident-response)<a href="https://agentmods.dev/skills/kumaran-is/claude-code-onboarding/ai-incident-response"><img src="https://agentmods.dev/badge/skills/kumaran-is/claude-code-onboarding/ai-incident-response/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kumaran-is/claude-code-onboarding/ai-incident-response"><img src="https://agentmods.dev/badge/skills/kumaran-is/claude-code-onboarding/ai-incident-response.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00070 | $0.01773 |
| Opus 5 | $0.00035 | $0.00886 |
| Sonnet 5 | $0.00014 | $0.00355 |
| Haiku 4.5 | $0.00007 | $0.00177 |
Grade A, and why
ai-incident-response scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 180 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AI Incident Response
Iron Law: Stabilize before investigating. Pull the kill switch or roll back before debugging root cause. Curiosity about why it broke must never delay stopping the bleeding.
When AI production behavior degrades, follow the procedure from the AI Playbook (Layer 4 §4.3). The objective: stabilize first, investigate second, learn third.
Stage 1: Stabilize (first 15 minutes)
Do these in order. Do not investigate root cause yet — that comes after the bleeding stops.
-
Confirm scope. Ask the user:
- What feature is affected?
- What is the symptom? (Wrong outputs / latency spike / cost spike / refusals / safety violation / user reports)
- When did it start?
- Is it ongoing right now?
-
Decide on rollback or kill. Check the Decision Record for rollback triggers. If the symptom matches:
- Pull the kill switch if the feature is causing user-visible harm. Confirm in chat before pulling.
- Roll back to last known good version (prompt, model, retrieval index, threshold) if the kill switch is too aggressive.
- Reduce traffic (drop the percentage rollout step) if the impact is bounded but worsening.
-
Capture the crime scene before anything else changes:
- Model version
- Prompt version
- Retrieval index version (if RAG)
- Tool versions (if agent)
- A sample of bad outputs with their inputs (sanitized)
- The time window
- Affected users / tenants
-
Notify. The Decision Record names an on-call owner. Tell them. If the incident has user impact, the team's incident comms process owns it from here.
Stage 2: Triage (next 30–60 minutes)
-
Quarantine bad outputs. Decide per the feature's design (Layer 4 §4.3):
- Recall (remove the output from view)
- Retract (notify affected users)
- Mark-as-disputed (annotate in the system)
- Annotate downstream records (e.g., flag the CRM entries created)
-
Reverse downstream actions if possible.
- For Tier 3+ actions: identify what was committed, who must authorize reversal, and execute.
- For Tier 0–2 (read-only or post-hoc reversible): may not need active reversal, but log the impact.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 180 lines · 70 tokens per session scan A 7b80635202a2
ai-incident-response is a skill published in the GitHub repository kumaran-is/claude-code-onboarding (35 stars, last pushed 2mo ago), licensed MIT. It adds 70 tokens to every session and 1,773 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
spark-optimization
Optimize Apache Spark jobs with partitioning, caching, shuffle optimization, and memory tuning. Use when improving Spark performance, debugging slow jobs, or scaling data processing pipelines.
notebooklm
Install, authenticate, troubleshoot, and operate Gemini Notebook through the notebooklm-py CLI or typed async Python API. Use for notebook and source management, grounded chat and research, and artifact generation or download when the user mentions Gemini Notebook, notebooklm-py, the notebooklm CLI, or its Python API.…
debug-inference
Debug inference clients that use an attached provider and its native endpoint, including hosted APIs and host-local Ollama, vLLM, SGLang, TRT-LLM, LM Studio, or NIM. Use for provider attachment, endpoint policy, credential substitution, topology, and migration from the removed inference.local endpoint. Trigger…
oh-my-posh
Install, configure, or troubleshoot Oh My Posh/ohmyposh: shell init, themes, segments, Nerd Font icons, and prompt setup on PowerShell, zsh, bash, or fish.
eagle3-triage
Triage a failed EAGLE3 pipeline run. Identifies which step failed (data synthesis, hidden state dump, training, or benchmark), diagnoses root cause from logs, and suggests fixes. Use when user reports an EAGLE3 pipeline failure or asks why a specific step failed. Also helps debug new model support issues.
trulens-instrumentation
Instrument LLM apps with TruLens OTEL-based tracing - from setup to debugging and optimization.