# Incident Commander (incident-commander)

> Classifies production incident severity, rebuilds the timeline and drafts the post-incident review, with communication templates and runbooks.

- Category: [Monitoring & Ops](https://www.myskills.tools/en/categories/monitoring-ops/)
- Source: Community · Alireza Rezvani
- Repository: https://github.com/alirezarezvani/claude-skills/tree/main/engineering-team/skills/incident-commander (commit 91a20ba)
- SKILL.md: https://github.com/alirezarezvani/claude-skills/blob/main/engineering-team/skills/incident-commander/SKILL.md
- Install command: `npx skills add alirezarezvani/claude-skills --skill incident-commander`
- License: MIT
- Compatible with: Claude Code, Codex, Cursor, Gemini CLI, Windsurf
- Permissions: read-repo ✓, write-files ✓, shell ✓, network ✗
- Status: Scan passed
- A rule scan cannot catch every risk. Read this skill's SKILL.md and check its permissions before installing.

## Core rule

Grade severity by user, revenue and SLA impact, and keep communication cadence fixed per severity.

## Execution Phases

1. **Classify severity** — incident_classifier.py grades SEV1–SEV4 from impact and urgency and sets response requirements.
2. **Command and communicate** — The commander coordinates the response and updates internal teams, executives and customers on a severity-based cadence.
3. **Rebuild the timeline** — timeline_reconstructor.py turns scattered logs and events into a coherent incident narrative.
4. **Post-incident review** — pir_generator.py drafts the PIR with several RCA frameworks, and recurring patterns become runbooks.

## Permissions (summarised from SKILL.md)

| Capability | Needed | Details |
|---|---|---|
| File writes | Required | Writes classification results, timelines, PIR reports and runbook documents. |
| Command execution | Limited | Runs the skill's three bundled Python scripts on incident data. |
| Network outbound | Not required | The skill does not call for network access. |

## SKILL.md frontmatter (YAML)

```yaml
---
name: "incident-commander"
description: "Use when declaring or running a production incident or outage, or writing its post-incident review. Classifies severity with incident_classifier.py, rebuilds the timeline with timeline_reconstructor.py and drafts the PIR with pir_generator.py. Security incidents: incident-response."
---
```

Home: https://www.myskills.tools/en/ · URL: https://www.myskills.tools/en/skills/incident-commander/