skills/triage-incident/SKILL.md

---
name: triage-incident
description: Diagnose an active or recent production software/data/AI incident from logs, monitoring and deployments with safe mitigation planning.
---

# Triage Incident

Use this skill only for its stated purpose. Follow the shared source-of-truth, permission and evidence rules in `../../references/workflow-contract.md`. Read `../../references/incident-triage.md` for detailed method when necessary.

## Procedure
1. Establish impact, priority, currently verified symptoms and safe operational constraints.
2. Inspect relevant health signals, recent changes and traces; do not assume a root cause.
3. Suggest smallest safe containment/mitigation consistent with user permissions and runbooks.
4. Form and test hypotheses without destructive action; plan recovery checks.
5. Produce incident timeline, mitigation status, confirmed root cause or open hypotheses and follow-up tests.

## Handoff rule
State actual artifacts or grounded code findings and validation status. Never invent file paths, executed tests, tool access, or completed subagent work. Keep output proportionate to the user request.