Preface¶

When an online service goes down, the on-duty engineer’s biggest fear isn’t “not knowing how to fix it”—it’s the chaos of the process: Should we troubleshoot the root cause first, or roll back immediately? Should we set up an incident channel? How should we communicate externally? The postmortem document always gets pushed to next week. Knowledge is stored in people’s heads, and when the on-duty rotation changes, steps are easily missed.

Agent Skill lets you turn such workflows into reusable SKILL.md files, letting AI coding tools like Cursor, Claude Code, and Codex CLI assist you according to a unified standard during conversations. This article introduces the incident-response skill from the awesome-cursor-skills repository maintained by spencerpauly: it covers incident grading, mitigation, communication, and blameless postmortems.

What Is It¶

incident-response is an Agent Skill for production incident response. Its official description is straightforward: Handle production incidents — triage, mitigate, communicate, and write postmortems.

It is hosted in the resources/incident-response/ directory of the spencerpauly/awesome-cursor-skills repository, with the core file being SKILL.md. This repository defines Skills as reusable instruction files: after copying them to your project’s .cursor/skills/ (or personal directory), the Agent will automatically discover them. The incident-response skill also marks user-invocable: true, making it suitable for explicit invocation via commands like /incident-response in chats.

It does not aim to “write business code for you”, but instead encodes common incident response checklists from SRE/DevOps workflows into the Agent, reducing human oversights during high-stress situations.

Core Features and Highlights¶

Based on the SKILL.md in the repository, its capabilities can be divided into three parts.

1. Unified Severity Levels (SEV1–SEV4)

After the grading framework is added to the Skill, the Agent will first help you align on “how serious this issue is and how quickly you need to act”, rather than diving straight into root cause analysis.

2. Five-Step Incident Workflow

The Skill breaks down incident response into fixed stages:
1. Detect & Triage (First ~5 Minutes): Confirm you are handling the incident; assign a SEV level; check monitoring (error rates, latency, status pages); verify recent deployments with git log --oneline -10.
2. Mitigate (15–30 Minutes Afterwards): The goal is to stop the bleeding, not find the root cause. Optional actions include rollbacks (git revert && deploy), disabling Feature Flags, scaling up, failing over to standby clusters, rate limiting, or blocking abnormal traffic.
3. Communicate: Create an internal incident channel (e.g., #incident-2026-04-10), sync updates every 15–30 minutes, clarify roles (Incident Commander, Communicator, Engineers); update the external status page, notify affected users if necessary, and communicate honestly.
4. Resolve: Deploy the fix; confirm recovery with metrics (not just “the error logs are gone”); close the incident channel with a summary.
5. Postmortem (Within 48 Hours): Write a blameless postmortem, focus on process improvements, and avoid blaming individuals.

3. Ready-to-Use Postmortem Template

The Skill includes a Markdown postmortem skeleton: incident title, date, duration, severity, impact, timeline, root cause, what went well/what went wrong, and Action Items with assignees and deadlines. The Agent can draft content according to this structure, and the team can then fill in the factual details.

There are also additional practice tips: prioritize rollbacks before deep diving; the most recent deployment is often the most suspicious source of issues; postmortems should not assign blame; maintain Runbooks for common failures; practice with game day drills before a real incident occurs.

Installation and Activation¶

incident-response follows the universal Agent Skills (SKILL.md) format. According to Cursor’s official documentation, the Agent scans the skill directory on startup; you can also manually invoke it by typing / followed by the skill name in the Agent chat. Compatible directories include the skills paths for Claude / Codex.

Method 1: Install via skills CLI (Recommended)

The installation command provided by skills.sh and vercel-labs’ npx skills tool is:

npx skills add https://github.com/spencerpauly/awesome-cursor-skills --skill incident-response

You can also use the shorthand version:

npx skills add spencerpauly/awesome-cursor-skills --skill incident-response

If targeting Claude Code, third-party directories like the Claude Skills Hub will prompt you to add --agent claude-code, which installs the skill to your project’s .claude/skills/ directory. Please follow the requirements of your actual used Agent.

Method 2: Manual Copy

As noted in the awesome-cursor-skills README, you can simply copy the existing SKILL.md into .cursor/skills/. The recommended directory structure is:

.cursor/skills/incident-response/SKILL.md

Cursor also loads skills from:
| Location | Scope |
|------|--------|
| .agents/skills/, .cursor/skills/ | Project-level |
| ~/.agents/skills/, ~/.cursor/skills/ | User-level (global) |
| .claude/skills/, .codex/skills/ and their corresponding home directories | Compatible with Claude Code / Codex CLI |

After installation, you can describe the incident in natural language in the Agent chat (for example: “The payment success rate has dropped sharply, please help me follow the incident response workflow”), or explicitly invoke this Skill, and it will assist you with grading, mitigation suggestions, communication scripts, and postmortem drafts according to the aforementioned process.

Typical Usage Examples¶

All the following examples are from the official SKILL.md, and you can adjust them according to your team’s toolchain.

1. When You First Receive an Alert

You can tell the Agent:

The payment success rate has dropped to 20%, please follow incident-response to perform grading and the first 5 minutes of triage.
First check the recent deployments: git log --oneline -10

The Agent should first confirm that it is handling the incident, recommend a SEV level (for example, payment failures fall under SEV2 per the Skill), remind you to check monitoring and recent deployments, rather than jumping straight into modifying business logic.

2. Mitigation Stage

If you suspect a recent deployment introduced the issue:

We suspect the recent migration caused the webhook 500 errors. Follow the Skill to prioritize mitigation: evaluate git revert && deploy, or disable the relevant feature flag. Stop the bleeding first, and troubleshoot the root cause later.

The mitigation methods explicitly listed in the Skill also include scaling up, failing over to standby clusters, rate limiting, or blocking abnormal traffic.

3. Drafting a Blameless Postmortem

After the incident is resolved, you can ask the Agent to generate a first draft according to the official template. The sample structure included in the Skill is as follows (the content is the official example, replace it with your team’s actual incident details for formal use):

# Incident: Payments failing for Stripe webhook
**Date:** 2026-04-10
**Duration:** 45 minutes (14:30 — 15:15 UTC)
**Severity:** SEV2
**Impact:** ~200 users unable to complete purchases

## Timeline
- 14:30 — Alert fires: payment success rate drops to 20%
- 14:35 — On-call engineer acknowledges, begins investigation
- 14:40 — Identified: Stripe webhook endpoint returning 500
- 14:45 — Root cause: migration added NOT NULL column without default
- 14:50 — Fix deployed: added default value to migration
- 15:00 — Payment success rate recovering
- 15:15 — Metrics back to normal, incident closed

## Root Cause
Database migration #47 added a `currency` column with NOT NULL
but no DEFAULT value. Existing rows were fine (backfilled), but
new webhook events failed because the insert didn't include `currency`.

## What Went Well
- Alert fired within 5 minutes of the issue starting
- Rollback was considered but the fix was faster

## What Went Wrong
- Migration wasn't tested with live webhook payloads
- No staging test for the webhook flow

## Action Items
- [ ] Add webhook integration test to CI (@alice, due 2026-04-17)
- [ ] Require DEFAULT for all new NOT NULL columns in migration review (@bob)
- [ ] Add runbook for payment failures (@charlie, due 2026-04-14)

Fill in the actual timestamps, impact scope, and responsible parties, then manually review the facts and wording before finalizing.

Applicable Scenarios and Notes¶

For:
- R&D/SRE/DevOps teams with on-call rotations that need unified SEV grading and communication rhythms
- Teams that want to store incident response and postmortem templates in their repository and share them across projects
- Teams using AI coding Agents like Cursor, Claude Code, or Codex CLI to assist with on-call duties

Notes:
- The Skill provides workflow and copy frameworks, and cannot replace monitoring alerts, deployment systems, status pages, or actual privileged operations; rollbacks, scaling, and traffic switching still need to be executed on your existing platform, and you are responsible for the changes.
- The timelines, user counts, and migration numbers in the examples are teaching samples included in the Skill, not real incidents in your production environment—do not use them as factual content verbatim.
- SEV definitions, response time limits, and role naming conventions may vary across organizations; after installation, we recommend modifying the SKILL.md to align with your company’s internal Runbooks.
- The Agent may recommend rollbacks or disabling feature flags; always double-check the impact scope and approval requirements before executing any changes.

Summary¶

incident-response turns the most easily overlooked steps in production incident handling—grading severity, stopping bleeding first, internal and external communication, and completing a blameless postmortem within 48 hours—into an installable SKILL.md file. For teams already using AI coding Agents, the cost is very low: install it to the skills directory with a single npx skills add command, and you can collaborate according to a unified workflow during on-call chats.

Official repository: https://github.com/spencerpauly/awesome-cursor-skills/tree/main/resources/incident-response