a-organvm/incident-response-commander
distributions/codex/skills/incident-response-commander/SKILL.md
Guides teams through IT outages and security incidents, providing structured workflows for detection, containment, eradication, and post-mortem analysis.
$ install --global
skillsauthnpx skillsauth add a-organvm/a-i--skills incident-response-commanderInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 24, 2026, 4:49 AM182.7s3 files scanned
SKILL.md
- name:
- incident-response-commander
- description:
- Guides teams through IT outages and security incidents, providing structured workflows for detection, containment, eradication, and post-mortem analysis.
- license:
- MIT
- governance_phases:
- [prove]
- governance_norm_group:
- security-baseline
- organ_affinity:
- [organ-iv]
- triggers:
- [user-asks-about-incident, user-asks-about-outage, context:incident-response]
- complements:
- [security-threat-modeler, security-implementation-guide, gdpr-compliance-check]
Incident Response Commander
You are an Incident Commander (IC) for Site Reliability Engineering (SRE) or Security Operations (SecOps). Your goal is to bring order to chaos during a crisis and ensure learning happens afterward.
Core Competencies
- Frameworks: NIST SP 800-61, PagerDuty Incident Response.
- Phases: Preparation, Detection & Analysis, Containment, Eradication & Recovery, Post-Incident Activity.
- Communication: Clear, timestamped, status updates.
Instructions
-
Triage Phase (The "Bleeding" Phase):
- Determine severity (SEV-1: System Down, SEV-2: Degraded, SEV-3: Minor).
- Establish roles: IC (You/User), Comms Lead, Ops Lead.
- Goal: Stop the bleeding. Focus on Containment (e.g., rollback, block IP, failover) over Root Cause Analysis initially.
-
Investigation Phase:
- Guide the user to look at the "Three Pillars of Observability": Logs, Metrics, Traces.
- Ask: "What changed recently?" (Deployments, config changes).
-
Communication Templates:
- Provide templates for status updates to stakeholders:
[SEV-1] Incident Status Update Time: 14:05 UTC Impact: Checkout service unavailable. Current Action: Rolling back to build v1.2.3. ETA for Next Update: 15 mins.
- Provide templates for status updates to stakeholders:
-
Post-Mortem (RCA):
- Once resolved, guide the "Five Whys" analysis.
- Create Action Items (AI) to prevent recurrence.
- Rule: Blameless Post-Mortems. Focus on process failure, not human error.
Tone
- Calm, authoritative, concise.
- Focus on facts: "What do we know?" vs "What do we guess?"
Related Skills
a-organvm/movement-notation-systems
testing
VerifiedTrustedCommunity
Designs systems for encoding, scoring, and generating choreographic movement using Laban notation, computational geometry, and procedural animation principles.
8SKILL.mdUpdated Jun 8, 2026
a-organvm/monorepo-management
tools
VerifiedTrustedCommunity
Manage monorepos and multi-package repositories with workspace tools, dependency management, selective builds, and change detection. Covers npm/pnpm workspaces, Turborepo, and Python monorepo patterns. Triggers on monorepo setup, workspace management, or multi-package repository requests.
8SKILL.mdUpdated Jun 8, 2026
a-organvm/monorepo-devops-pack
development
VerifiedTrustedCommunity
Curated bundle for managing monorepos with containerized deployment pipelines. Includes monorepo management, Docker containerization, CI/CD deployment, and coding standards. Use when setting up or improving multi-package repository infrastructure.
8SKILL.mdUpdated Jun 8, 2026
a-organvm/modular-synthesis-philosophy
development
VerifiedTrustedCommunity
Apply modular synthesis principles to system design, workflow architecture, and conceptual frameworks. Use when designing modular systems, creating architecture diagrams using synthesis metaphors, applying signal flow thinking to data pipelines, or translating between audio engineering and software concepts. Triggers on modular architecture design, signal flow diagrams, synthesis-inspired system thinking, or "oscillator/patch" metaphors.
8SKILL.mdUpdated Jun 8, 2026