How to use the Incident Commander agent skill

What is an agent skill, and what does this one do?

An agent skill is a folder containing a SKILL.md file and supporting files. When installed, an agent can load these instructions when a request matches the skill's description, so it follows a defined process instead of improvising.

The incident-commander skill covers three jobs. It classifies an incident as SEV1 to SEV4 based on user and business impact. It helps turn scattered logs and events into a clear timeline. It drafts a structured post-incident review with communication templates for stakeholder updates.

• Severity classification: SEV1 (complete outage affecting all users or critical business functions) down to SEV4 (minimal impact, cosmetic issues, or planned maintenance).
• Timeline reconstruction from timestamped events.
• Structured post-incident reviews and stakeholder communication templates.
• Covers the Incident Commander role: command and control, communication hub, process management, and post-incident leadership.

Install the incident-commander skill

Download the ZIP file for the skill from this page and unzip it. You can install it in one of two places depending on how you work.

For a personal setup, unzip the folder into ~/.claude/skills/. To scope it to one repository, unzip it into the project's .claude/skills/ folder. You can also upload the skill in the Claude apps under Settings → Capabilities → Skills.

• Personal install: ~/.claude/skills/ (available across your projects).
• Project install: .claude/skills/ inside the repository (shared with that project).
• Claude apps: Settings → Capabilities → Skills, then upload the skill.

How do you trigger the skill with a natural request?

You do not need a special command. Describe the situation in plain language. The skill's description covers declaring an incident, coordinating a multi-team response during an outage, leading a post-mortem, and setting up on-call practices for a new service, so requests phrased around those tasks are the most likely to load it.

Include the facts you have: the service, what users see, when it started, and any log lines or event times. The more specific the input, the more useful the classification and timeline will be.

• "We're declaring an incident: checkout API returning 500s for most users since 14:05 UTC. Classify it."
• "Here are these log lines and deploy events. Build an incident timeline and flag any gaps."
• "Draft a post-incident review for yesterday's database failover outage."
• "Help me set up on-call practices for our new billing service."

What can you ask it to do during a live incident?

During an outage, the skill is most useful for severity classification and for the communication work that competes with debugging. Give the agent the impact you can see, and ask it to classify the incident and draft an initial notification.

The initial notification template includes fields for start time, severity, impact, current status, affected services, symptoms, and the response team. The skill's communication templates also include an executive summary for SEV1 incidents and a customer communication template.

• Classify severity from the user and business impact you describe.
• Draft an initial stakeholder notification using the SEV1/2 template.
• Draft a leadership executive summary for a SEV1 incident.
• Draft a customer-facing message describing the issue, scope, and next steps.

What can it produce after the incident?

After resolution, give the agent your event logs and notes. It can reconstruct a chronological timeline and identify gaps. It can then draft a post-incident review (PIR). The skill's reference material describes applying RCA frameworks, including 5 Whys, Fishbone, and Timeline, and generating actionable follow-up items.

The assets folder includes an incident report template and a runbook template. The runbook template has sections for service overview, alert response decision trees, and on-call details, which is useful when setting up practices for a new service.

• Timeline with duration analysis and identified gaps.
• Post-incident review with root-cause analysis and follow-up items.
• Incident report draft using the included template (impact statement, timeline, and more).
• Runbook draft for a new service using the included runbook template.

What does the skill need, and what should you check first?

The skill lists no requirements. It does not run scripts and does not use the network, according to its metadata. It is a set of instructions and templates that the agent reads and applies to what you paste into the conversation.

Because the framework is generic, treat the agent's output as a draft. Check severity levels, response times, and templates against your organisation's own policies. Do not rely on it for authoritative severity decisions or legal or regulatory decisions without human review.

This skill is for availability and reliability problems. For security events such as ransomware, intrusions, or data exfiltration, the skill's documentation directs you to a separate incident-response skill.

• No listed requirements.
• Does not run scripts.
• Does not use the network.
• Not for security incidents: use the separate incident-response skill for those.
• Output needs human review against your own policies.