📦
content-creator
88Create Brand-Consistent Marketing Content
Marketing teams need content that stays consistent across channels. This skill helps plan, write, analyze, and optimize content for brand voice and SEO.
Writing & Content View
Skills incident-runbook-templates
📦
incident-runbook-templates
Content revision r2 Medium Risk ⚙️ External commands🌐 Network access📁 Filesystem access
Build Incident Response Runbooks
Generic incident procedures slow triage and create inconsistent decisions during outages. This skill creates structured runbooks with checks, mitigation steps, escalation paths, and communication templates.
Supports: Claude Codex Code(CC)
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "incident-runbook-templates" from https://skillstore.io/skills/sickn33-incident-runbook-templates.md and its manifest at https://skillstore.io/api/skills/sickn33-incident-runbook-templates/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "incident-runbook-templates". Create a runbook for payment latency above two seconds.
Expected outcome:
- Classify customer impact and confirm the alert window.
- Check deployment history, database saturation, and dependency latency.
- Choose a reversible mitigation with an approval checkpoint.
- Verify latency, errors, and payment completion before resolution.
Using "incident-runbook-templates". Draft an internal update for a database connection incident.
Expected outcome:
SEV2 database connection pressure is under investigation. New connections are delayed. The database and platform teams are reducing load and checking pool saturation.
Using "incident-runbook-templates". Create escalation rules for an unresolved service outage.
Expected outcome:
- Escalate to the engineering manager when a SEV1 remains unresolved after 15 minutes.
- Engage security immediately when evidence suggests unauthorized access or data exposure.
- Notify support and legal when customer communication or regulatory review may be required.
Security Audit
Medium Riskv5 • 7/24/2026 Open versioned report
Most static alerts misread Markdown syntax, reference links, or read-only examples. Four network findings are confirmed because the templates prescribe state-changing requests and an applyable broad network policy. One semantic finding covers production-changing commands that lack immediate approval safeguards; no prompt injection or exfiltration was found.
1
Files scanned
404
Lines analyzed
4
Review items
0
False positives ignored
Confirmed security concerns (1)
Medium
Production-changing commands lack immediate approval safeguards
The templates present rollback, scaling, database termination, feature-flag, and network-policy commands without requiring confirmation immediately before execution. Misapplied examples can disrupt services or broaden access.
The cited sections contain explicit mutating production commands. General validation guidance at the end reduces intent concerns but does not add per-action confirmation.
Capability review items (4)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Hardcoded URL
curl -X POST https://api.company.com/internal/feature-flags \
The example sends a POST request that enables a feature flag at an internal endpoint. If adapted and executed without approval, it can change production behavior.
Medium
Hardcoded URL
curl -X POST https://api.company.com/internal/feature-flags \
The documented POST request disables a production feature flag. Executing an adapted command without authorization can alter service behavior.
Medium
Hardcoded IP address
cidr: 0.0.0.0/0
The applyable NetworkPolicy example permits 0.0.0.0/0 except one subnet. Because policies are additive, this can unintentionally broaden production ingress.
Medium
Hardcoded IP address
- 192.168.1.0/24 # Suspicious range
The policy hardcodes 192.168.1.0/24 as the suspicious range. Copying the placeholder can block legitimate private traffic while failing to block the actual source.
Risk Factors
⚙️ External commands (40)
SKILL.md:23 SKILL.md:47-57 SKILL.md:57-63 SKILL.md:63-80 SKILL.md:80-81 SKILL.md:81-82 SKILL.md:82-92 SKILL.md:92-101 SKILL.md:101-104 SKILL.md:104-120 SKILL.md:120-138 SKILL.md:138-141 SKILL.md:141-162 SKILL.md:162-165 SKILL.md:165-182 SKILL.md:182-185 SKILL.md:185-215 SKILL.md:215-218 SKILL.md:218-230 SKILL.md:230-233 SKILL.md:233-243 SKILL.md:243-257 SKILL.md:257-272 SKILL.md:272-275 SKILL.md:275-291 SKILL.md:291-294 SKILL.md:294-308 SKILL.md:308-309 SKILL.md:309-313 SKILL.md:313-319 SKILL.md:319-320 SKILL.md:320-321 SKILL.md:321-322 SKILL.md:322-325 SKILL.md:325-343 SKILL.md:343-346 SKILL.md:346-358 SKILL.md:358-361 SKILL.md:361-375 SKILL.md:375-376
🌐 Network access (17)
📁 Filesystem access (1)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/sickn33-incident-runbook-templates/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/sickn33-incident-runbook-templates?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/sickn33-incident-runbook-templates?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-incident-runbook-templates/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/sickn33-incident-runbook-templates.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
sickn33. (2026). incident-runbook-templates security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-incident-runbook-templates/audits/5BibTeX citation
@techreport{sickn33-sickn33-incident-runbook-templates-2026,
author = {sickn33},
title = {incident-runbook-templates security audit report (audit version 5)},
institution = {Skillstore},
year = {2026},
number = {5},
url = {https://skillstore.io/skills/sickn33-incident-runbook-templates/audits/5},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "incident-runbook-templates security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
- name: "sickn33"
date-released: "2026-07-24"
url: "https://skillstore.io/skills/sickn33-incident-runbook-templates/audits/5"
identifiers:
- type: other
value: "skillstore:sickn33-incident-runbook-templates:audit:5"
description: "Skillstore immutable audit report identifier"
Compare variants
2 installable variantsEach author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.
Why this variant is first
Highest Skillstore Score
Author / source Skillstore Score Evidence Confidence Skillstore usage Updated
wshobson Recommended
wshobson-incident-runbook-templates
Skillstore Score 78
Evidence Confidence High
Skillstore usage 15
Updated
2026-08-21
sickn33 Current
sickn33-incident-runbook-templates
Skillstore Score 69
Evidence Confidence High
Skillstore usage 11
Updated
2026-08-21
Skillstore Score
Why this score Evidence Confidence: High 55
Architecture
85
Maintainability
87
Content
68
Community
83
Spec Compliance
What You Can Build
Prepare a service outage runbook
Create a service-specific procedure with alerts, initial checks, mitigation options, rollback steps, and recovery verification.
Standardize database incident response
Document safe investigation paths for connection pressure, replication lag, and storage exhaustion.
Coordinate incident communication
Define escalation conditions and consistent internal updates for each stage of a serious incident.
Try These Prompts
Create a basic runbook
Create an incident runbook for [service]. Include impact, alerts, first checks, escalation contacts, mitigation, rollback, verification, and communication steps.
Adapt an outage template
Adapt the service outage template for [service] running on [platform]. Use these dashboards, alerts, dependencies, owners, and approved operational commands: [details].
Review runbook safety
Review this runbook for ambiguous actions, missing approvals, unsafe commands, weak verification, incomplete rollback, and unclear escalation. Suggest precise corrections: [runbook].
Design a complex incident workflow
Design a SEV1 runbook for [failure mode] across [systems]. Add decision points, dependencies, evidence capture, approval gates, rollback criteria, and stakeholder updates.
Best Practices
- Replace every placeholder and validate each command in a non-production environment before publishing the runbook.
- Require explicit approval, success criteria, rollback conditions, and verification for every production-changing action.
- Review the runbook after incidents, exercises, architecture changes, ownership changes, and monitoring updates.
Avoid
- Do not execute generic commands against production without confirming the environment, permissions, target, and expected impact.
- Do not rely on one dashboard, one responder, or one mitigation path during a serious incident.
- Do not declare resolution before customer impact, service health, data integrity, and rollback stability are verified.
Frequently Asked Questions
Does this skill execute incident commands?
No. It provides templates and examples. Operators must review, authorize, test, and execute any command through approved procedures.
Can I use the examples directly in production?
No. Replace all placeholders and validate commands, permissions, endpoints, thresholds, and rollback behavior in your environment.
Which incident types are covered?
The detailed examples cover service outages and database incidents. The shared structure can support other incident types after careful adaptation.
Does it include communication guidance?
Yes. It includes initial notifications, progress updates, resolution notices, escalation conditions, and stakeholder roles.
How should teams maintain generated runbooks?
Assign an owner and review each runbook after incidents, exercises, service changes, monitoring updates, and contact changes.
Can Claude, Codex, and Claude Code use this skill?
Yes. The marketplace metadata lists Claude, Codex, and Claude Code as supported tools.
Developer Details
Author
sickn33License
MIT
Skillstore revision
r2
Version notice
The author did not declare a version.
Repository
https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/incident-runbook-templatesRef
88a8e9a07f4c54ab105c1c41b6267c287146b07b
Maintenance freshness
7/26/2026
Usage
9 downloads · 96 views
File structure
📄 SKILL.md
More from sickn33
View all📦
prompt-engineering-patterns
85Improve LLM Prompts With Proven Patterns
Inconsistent prompts waste time and make AI outputs hard to trust. This skill guides prompt design with reusable patterns, examples, evaluation steps, and optimization workflows.
Productivity View
📦
senior-fullstack
82Build Fullstack Apps with Senior Patterns
Teams need consistent setup, architecture, and review guidance for modern web applications. This skill provides scaffolders, workflow references, and quality prompts for React, Next.js, Node.js, GraphQL, and PostgreSQL projects.
Coding & Development View
📦
senior-architect
81Design Scalable Software Architectures
Architecture decisions are hard to compare across web, mobile, backend, and cloud systems. This skill provides structured guides and local scaffold scripts for reports, dependency review, and trade-off documentation.
Coding & Development View
📦
prompt-engineer
81Optimize AI Prompts With Prompt Engineer
Writing clear prompts is hard when goals are vague or complex. This skill turns rough requests into structured prompts using proven prompt frameworks.
Productivity View
📦
product-manager-toolkit
80Prioritize Product Work With Research Insights
Product teams need faster ways to rank features, synthesize interviews, and document decisions. This skill provides RICE scoring, interview analysis, and PRD templates for structured planning.
Productivity View
Related Skills
View all📦
devops-runbooks
79Create Reliable DevOps Runbooks
by 89jobrien
Operational knowledge often lives in tickets, chat, and memory. This skill turns procedures into structured runbooks for incidents, maintenance, rollback, and escalation.
DevOps & Infrastructure View
📦
on-call-handoff-patterns
38Create Reliable On-Call Handoffs
by wshobson
On-call transitions lose context when incidents, investigations, and changes are spread across tools. This skill helps Claude, Codex, and Claude Code produce structured handoffs that preserve operational continuity.
DevOps & Infrastructure View
📦
it-operations
38Strengthen IT Operations and Service Reliability
by davila7
IT teams need consistent methods for reliable services and incident response. This skill provides structured workflows, metrics, runbooks, automation guidance, and recovery practices.
DevOps & Infrastructure View
📦
incident-command-governor
82Build Governed Incident Command Packets
by yaojingang
Incident response notes often become inconsistent, incomplete, and hard to review. This skill turns operational inputs into a governed packet with severity, owners, communications, and review notes.
DevOps & Infrastructure View
📦
operating-production-services
81Operate Reliable Production Services
by Asmayaseen
Production teams need clear reliability targets and repeatable incident practices. This skill provides SLO guidance, burn-rate alert patterns, and blameless postmortem templates.
DevOps & Infrastructure View
📦
project-operator
79Operate Local Project Stacks Safely
by ACSKamloops
Local development stacks can be hard to debug when logs, services, and config changes are handled out of order. This skill guides Claude, Codex, and Claude Code to inspect evidence first and explain safe operational steps.
DevOps & Infrastructure View