ai-sre-incident-response

ai-sre-incident-response is a skill for Claude Code from sickn33/agentic-awesome-skills. It costs 32 tokens per session (3,140 once invoked), scanned A, original, MIT.

An incident-response guide for AI services, including systems that use large language models. It treats outages, poor answer quality, unsafe responses, and unexpected spending as different kinds of incidents.

In plain words
What is it for?
Use it to prepare severity levels, dashboards, runbooks, failover and rollback plans, and response steps for availability, quality, safety, and cost incidents.
Why use it?
It gives responders a shared way to classify and handle failures that ordinary uptime monitoring may not describe. It also connects response work with monitoring, on-call duties, and rollback procedures.

Skill for Claude Code

Written for Claude Code: shipped in a Claude Code plugin. Also seen: positional $N argument.

Part of the agentic-awesome-skills plugin — 248 skills shipped together

Good fit Use it to prepare severity levels, dashboards, runbooks, failover and rollback plans, and response steps for availability, quality, safety, and cost incidents.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/sickn33/agentic-awesome-skills/ai-sre-incident-response
About the project

AAS Core is a local control plane for coding agents that lets them search a large catalogue of skills, choose a stack, validate it, and create a reproducible plan. It is used to assemble and review agent workflows through its CLI, local MCP server, catalogue, plugins, and Workbench. The catalogue add-ons provide the skills, plugins, bundles, and workflows that AAS Core helps agents select and validate.

sickn33/agentic-awesome-skills · 47,958 stars · on GitHub · aaskills.tech

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add sickn33/agentic-awesome-skills --skill ai-sre-incident-response
Clone the repo
git clone --depth 1 https://github.com/sickn33/agentic-awesome-skills

Made for: Claude Code.

Or install agentic-awesome-skills, the plugin that ships this one along with the rest of its 248 skills.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for ai-sre-incident-response

README.md
[![agentmods](https://agentmods.dev/badge/skills/sickn33/agentic-awesome-skills/ai-sre-incident-response/github.svg)](https://agentmods.dev/skills/sickn33/agentic-awesome-skills/ai-sre-incident-response)
Your own site
<a href="https://agentmods.dev/skills/sickn33/agentic-awesome-skills/ai-sre-incident-response"><img src="https://agentmods.dev/badge/skills/sickn33/agentic-awesome-skills/ai-sre-incident-response/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for ai-sre-incident-response

Your own site · 80×15
<a href="https://agentmods.dev/skills/sickn33/agentic-awesome-skills/ai-sre-incident-response"><img src="https://agentmods.dev/badge/skills/sickn33/agentic-awesome-skills/ai-sre-incident-response.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 32 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 3,140 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00032 $0.03140
Opus 5.5 $0.00013 $0.01256
Sonnet 5.5 $0.00006 $0.00628
Haiku 4.5 $0.00003 $0.00314

Measured 5d ago against content hash 88764883b8bb, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

ai-sre-incident-response scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

curl -s -o /dev/null -w "%{http_code}" https://api.provider.com/health
Origin

Copies of this mod

2 near-identical copies found in the catalogue:

plugins/agentic-awesome-skills-claude/skills/ai-sre-incident-response/SKILL.md · 338 lines

How it starts

The opening of the file, as written. The whole thing — 338 lines — stays where its author put it; the contents beside it link to each section on GitHub.

AI SRE Incident Response

Apply SRE rigor to AI systems where incidents include quality regressions, unsafe outputs, and budget explosions.

When to Use This Skill

  • An LLM endpoint begins returning degraded or hallucinated answers
  • Token spend spikes beyond budget thresholds
  • A model provider goes down and traffic must fail over
  • Safety guardrails fire at abnormal rates
  • A new model deployment causes latency or accuracy regression

Prerequisites

  • Prometheus and Alertmanager deployed with scrape targets for AI services
  • Grafana dashboards for golden signals (latency, error rate, cost, quality)
  • On-call rotation configured in PagerDuty, Opsgenie, or equivalent
  • Runbook repository accessible to responders
  • Rollback mechanism for model and prompt versions (GitOps or feature flags)

AI Incident Classes

  • Availability incident: model/provider unavailable, timeout storm.
  • Quality incident: answer accuracy or tool success drops below SLO.
  • Safety incident: harmful or policy-violating outputs increase.
  • Cost incident: unexpected token or provider spend spike.

Severity Framework

Severity Criteria Response Time Notification
SEV1 User-facing outage, compliance risk, data leak 5 min Page on-call + incident commander
SEV2 Major degradation in key flows 15 min Page on-call
SEV3 Limited impact or internal-only issue 1 hour Slack alert
SEV4 Cosmetic or low-priority regression Next business day Ticket

Golden Signals for AI Services

  • Request success rate
  • Latency (queue + generation + tool execution)
  • Hallucination/groundedness proxy metrics
  • Cost per minute and per tenant
  • Guardrail violation rate

Prometheus Alert Rules

The thresholds below are illustrative. Calibrate them to the declared SLO, metric units, tenant budgets and workload; a groundedness proxy is not a verified quality measurement. Counter rates are per second, so the cost-per-minute alert explicitly multiplies by 60.

Read the full file on GitHub · 338 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 5d ago Changed 88764883b8bb
  2. 6d ago Changed · +1 lines 7d20169de620
  3. 29d ago First seen · 337 lines · 32 tokens per session scan A b9654a5db9e0

Subscribe to this mod's changes

ai-sre-incident-response is a skill published in the GitHub repository sickn33/agentic-awesome-skills (47,958 stars, last pushed yesterday), licensed MIT. It adds 32 tokens to every session and 3,140 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-21.