Orchestrating Incident Response with Claude Skills: A Complete Technical Guide

The Claude Skills repository provides a modular, production-ready incident response stack combining the Incident Commander skill for tactical response, the Runbook Generator for automated documentation, and the C-Level Advisor skill for executive coordination.

Orchestrating incident response with Claude skills enables engineering teams to deploy a comprehensive, self-contained framework for detecting, classifying, and remediating production incidents. The alirezarezvani/claude-skills repository delivers three complementary skill packages that transform chaotic emergency workflows into structured, auditable processes.

Core Components of the Incident Response Stack

The repository organizes incident response capabilities into three distinct skill domains, each targeting a specific operational layer.

Incident Commander – Engineering Team

The Incident Commander skill in engineering-team/incident-commander/SKILL.md provides the tactical engine for engineering teams. It defines a complete severity classification matrix (SEV 1–4), timeline reconstruction protocols, and post-incident review frameworks. The skill embeds communication templates for initial notifications, executive summaries, and customer notices, alongside an escalation matrix mapping severity levels to L1/L2/L3 contacts.

Runbook Generator – Engineering

The Runbook Generator skill located at engineering/runbook-generator/SKILL.md automatically detects repository stacks and produces executable runbooks for deployment, incident response, and database maintenance. It implements "staleness checks" that compare the Last verified date of generated runbooks against the most recent git-log timestamps of referenced configuration files like vercel.json or prisma/schema.prisma, ensuring documentation remains synchronized with codebase changes.

Executive Incident-Response Playbook – C-Level Advisor

The C-Level Advisor skill in c-level-advisor/ciso-advisor/references/incident_response.md supplies high-level decision-making frameworks for CEOs, CISOs, and board members. It covers regulatory notification timelines (GDPR 72h, HIPAA 60d, US state laws), insurance coordination protocols, and tabletop exercise designs, creating strategic alignment with the Incident Commander's tactical operations.

Architectural Design and Workflow

The repository follows a "knowledge-flows-from-references-to-SKILL-to-scripts" pattern defined in the top-level CLAUDE.md, making the incident response stack composable and maintainable.

Modular Skill Packages

Each skill resides in a self-contained folder with a SKILL.md file that defines the problem space, required scripts, and reference materials. Teams can deploy only the Incident Commander skill for basic response capabilities, or combine it with the Runbook Generator to produce end-to-end operational runbooks without unnecessary overhead.

Core Incident-Response Engine

The Incident Commander skill implements three core CLI tools located in engineering-team/incident-commander/scripts/:

• incident_classifier.py – Consumes JSON payloads or log files to output classified severity (SEV 1–4) and suggested response actions
• timeline_reconstructor.py – Collates timestamps from diverse log sources into a chronological, readable incident timeline
• pir_generator.py – Generates structured Post-Incident Review documents supporting multiple RCA frameworks including the 5-Whys method

Runbook Generation Layer

The Runbook Generator automatically scans repository structures (GitHub Actions workflows, Docker configurations, Terraform files) and generates markdown runbooks with embedded CI gate validation steps. All generated documentation lives under docs/ and remains version-controlled alongside the code it governs, creating trivial audit trails.

CLI Tools and Automation Scripts

The following command-line invocations demonstrate production usage of the incident response scripts. All tools reside in engineering-team/incident-commander/scripts/ and engineering/runbook-generator/scripts/.

Classify an incident from a JSON payload:

echo '{"description":"Users see 500 errors on checkout", "affected_users":"85%", "business_impact":"high"}' \
  | python incident_classifier.py --format json

Reconstruct an incident timeline from raw logs:

python timeline_reconstructor.py \
  --input logs/api_incident_events.json \
  --output timeline.md

Generate a Post-Incident Review using the 5-Whys RCA method:

python pir_generator.py \
  --incident incident_data.json \
  --timeline timeline.md \
  --rca-method five-whys \
  --output docs/postmortems/2024-11-02-checkout-outage.md

Produce an incident-response runbook with automatic stack detection:

python -m runbook_generator \
  --repo . \
  --type incident-response \
  --output docs/runbooks/incident-response.md

Validate runbook freshness against recent git activity:

python runbook_generator --check-staleness \
  --runbook docs/runbooks/incident-response.md

All commands output clear ✅/❌ markers and verification strings following the repository's "copy-paste-able + verification" principle.

Integration Points for Production Systems

The Claude Skills incident response stack connects directly to existing operational infrastructure.

Monitoring and Alerting – The runbooks reference PagerDuty or Opsgenie alert formats, while the Incident Commander's communication templates assume Slack war-room integration for real-time coordination.

CI/CD Pipelines – The Runbook Generator detects GitHub Actions workflows in .github/workflows/ and embeds CI gate validation steps into deployment runbooks, preventing stale procedures from reaching production.

Documentation Governance – By storing all runbooks and PIRs under docs/ and versioning them alongside source code, the system maintains a single source of truth that satisfies audit requirements without manual documentation overhead.

Summary

• Orchestrating incident response with Claude skills combines three modular packages: Incident Commander for tactical response, Runbook Generator for automated documentation, and C-Level Advisor for executive coordination.
• The core engine includes incident_classifier.py, timeline_reconstructor.py, and pir_generator.py for automated severity classification, timeline reconstruction, and post-incident review generation.
• The Runbook Generator implements staleness detection to keep operational documentation synchronized with infrastructure changes.
• All skills follow a consistent "knowledge-flows-from-references-to-SKILL-to-scripts" architecture defined in the repository's CLAUDE.md.
• Integration points support PagerDuty, Opsgenie, Slack, GitHub Actions, and version-controlled documentation under docs/.

Frequently Asked Questions

How does the Incident Commander skill determine incident severity?

The incident_classifier.py script processes JSON payloads containing incident descriptions, affected user percentages, and business impact assessments to output standardized SEV 1–4 classifications. The skill defines explicit criteria in engineering-team/incident-commander/SKILL.md that map technical symptoms to severity levels, automatically suggesting response actions and escalation paths based on the classification result.

What prevents generated runbooks from becoming outdated?

The Runbook Generator implements automated staleness checks via the --check-staleness flag, which compares the Last verified timestamp in existing runbooks against the most recent git-log timestamps of referenced configuration files. If the runbook predates changes to vercel.json, prisma/schema.prisma, or workflow definitions, the tool flags the documentation for immediate regeneration.

Can teams use only specific components without adopting the full stack?

Yes. The modular architecture following the CLAUDE.md "knowledge-flows-from-references-to-SKILL-to-scripts" pattern allows teams to deploy only the Incident Commander skill for basic response capabilities, or combine it selectively with the Runbook Generator. Each skill resides in a self-contained folder with independent dependencies, preventing unnecessary overhead from unused components.

How does the C-Level Advisor skill integrate with engineering response workflows?

The C-Level Advisor skill in c-level-advisor/ciso-advisor/references/incident_response.md dovetails with the Incident Commander's tactical steps by providing parallel executive-level decision trees. While engineering teams execute technical remediation using the Incident Commander scripts, executives follow the advisor's regulatory notification timelines (GDPR 72h, HIPAA 60d) and communication templates, ensuring coordinated technical and strategic incident response.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}