incident-runbook-templates
Build Incident Response Runbooks
Generic incident procedures slow triage and create inconsistent decisions during outages. This skill creates structured runbooks with checks, mitigation steps, escalation paths, and communication templates.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Review the Skillstore skill "incident-runbook-templates" from https://skillstore.io/skills/sickn33-incident-runbook-templates.md and its manifest at https://skillstore.io/api/skills/sickn33-incident-runbook-templates/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "incident-runbook-templates". Create a runbook for payment latency above two seconds.
Expected outcome:
- Classify customer impact and confirm the alert window.
- Check deployment history, database saturation, and dependency latency.
- Choose a reversible mitigation with an approval checkpoint.
- Verify latency, errors, and payment completion before resolution.
Using "incident-runbook-templates". Draft an internal update for a database connection incident.
Expected outcome:
SEV2 database connection pressure is under investigation. New connections are delayed. The database and platform teams are reducing load and checking pool saturation.
Using "incident-runbook-templates". Create escalation rules for an unresolved service outage.
Expected outcome:
- Escalate to the engineering manager when a SEV1 remains unresolved after 15 minutes.
- Engage security immediately when evidence suggests unauthorized access or data exposure.
- Notify support and legal when customer communication or regulatory review may be required.
Security Audit
Medium RiskMost static alerts misread Markdown syntax, reference links, or read-only examples. Four network findings are confirmed because the templates prescribe state-changing requests and an applyable broad network policy. One semantic finding covers production-changing commands that lack immediate approval safeguards; no prompt injection or exfiltration was found.
Confirmed security concerns (1)
Capability review items (4)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Risk Factors
⚙️ External commands (40)
🌐 Network access (17)
📁 Filesystem access (1)
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/sickn33-incident-runbook-templates/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/sickn33-incident-runbook-templates?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/sickn33-incident-runbook-templates?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-incident-runbook-templates/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/sickn33-incident-runbook-templates.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
sickn33. (2026). incident-runbook-templates security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-incident-runbook-templates/audits/5BibTeX citation
@techreport{sickn33-sickn33-incident-runbook-templates-2026,
author = {sickn33},
title = {incident-runbook-templates security audit report (audit version 5)},
institution = {Skillstore},
year = {2026},
number = {5},
url = {https://skillstore.io/skills/sickn33-incident-runbook-templates/audits/5},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "incident-runbook-templates security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
- name: "sickn33"
date-released: "2026-07-24"
url: "https://skillstore.io/skills/sickn33-incident-runbook-templates/audits/5"
identifiers:
- type: other
value: "skillstore:sickn33-incident-runbook-templates:audit:5"
description: "Skillstore immutable audit report identifier"
Compare variants
2 installable variantsEach author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.
Why this variant is first
wshobson-incident-runbook-templates
2026-08-21
sickn33-incident-runbook-templates
2026-08-21
Skillstore Score
Why this score Evidence Confidence: HighWhat You Can Build
Prepare a service outage runbook
Create a service-specific procedure with alerts, initial checks, mitigation options, rollback steps, and recovery verification.
Standardize database incident response
Document safe investigation paths for connection pressure, replication lag, and storage exhaustion.
Coordinate incident communication
Define escalation conditions and consistent internal updates for each stage of a serious incident.
Try These Prompts
Create an incident runbook for [service]. Include impact, alerts, first checks, escalation contacts, mitigation, rollback, verification, and communication steps.
Adapt the service outage template for [service] running on [platform]. Use these dashboards, alerts, dependencies, owners, and approved operational commands: [details].
Review this runbook for ambiguous actions, missing approvals, unsafe commands, weak verification, incomplete rollback, and unclear escalation. Suggest precise corrections: [runbook].
Design a SEV1 runbook for [failure mode] across [systems]. Add decision points, dependencies, evidence capture, approval gates, rollback criteria, and stakeholder updates.
Best Practices
- Replace every placeholder and validate each command in a non-production environment before publishing the runbook.
- Require explicit approval, success criteria, rollback conditions, and verification for every production-changing action.
- Review the runbook after incidents, exercises, architecture changes, ownership changes, and monitoring updates.
Avoid
- Do not execute generic commands against production without confirming the environment, permissions, target, and expected impact.
- Do not rely on one dashboard, one responder, or one mitigation path during a serious incident.
- Do not declare resolution before customer impact, service health, data integrity, and rollback stability are verified.
Frequently Asked Questions
Does this skill execute incident commands?
Can I use the examples directly in production?
Which incident types are covered?
Does it include communication guidance?
How should teams maintain generated runbooks?
Can Claude, Codex, and Claude Code use this skill?
Developer Details
Author
sickn33License
MIT
Skillstore revision
r2
Version notice
The author did not declare a version.
Repository
https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/incident-runbook-templatesRef
88a8e9a07f4c54ab105c1c41b6267c287146b07b
Maintenance freshness
7/26/2026
Usage
9 downloads · 96 views
File structure
📄 SKILL.md