CtrlK
BlogDocsLog inGet started
Tessl Logo

incident-response-incident-response

Use when working with incident response incident response

32

Quality

27%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./plugins/AI-Agents-Safe-Coding-Skills/skills/incident-response-incident-response/SKILL.md

The canonical home for this skill is incident-response-incident-response in administrakt0r/AI-Agents-Safe-Coding-Skills

SKILL.md
Quality
Evals
Security

Quality

Content

35%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

This skill is a verbose, abstract orchestration template for incident response that reads more like a process document than actionable Claude instructions. It extensively describes concepts Claude already understands (SRE practices, postmortems, observability) without providing concrete, executable guidance. The workflow structure is reasonable but lacks the validation checkpoints critical for high-stakes incident response operations.

Suggestions

Remove explanatory content Claude already knows (severity level definitions, incident types, SRE concepts, extended thinking block) and focus on the specific decision logic and tool invocations unique to this workflow.

Replace abstract 'Use Task tool with subagent_type=...' instructions with concrete, executable examples showing actual tool calls with realistic inputs and expected outputs.

Add explicit validation checkpoints between phases (e.g., 'Before proceeding to Phase 2, confirm: mitigation is active, user impact is reduced, incident doc is created') to create proper feedback loops for this high-stakes workflow.

Move configuration details (severity levels, incident types, coordination protocols, success criteria) into separate reference files and link to them from the main skill to improve progressive disclosure.

DimensionReasoningScore

Conciseness

The skill is heavily verbose with extensive explanations Claude already knows (SRE concepts, what observability is, what a postmortem is). The extended thinking block is unnecessary filler. Severity level definitions, incident types, and coordination protocols are standard knowledge that don't need this level of detail. The description itself is redundantly 'incident response incident response'.

2 / 5

Actionability

Despite listing many steps, the guidance is entirely abstract — it describes what to do conceptually ('Use Task tool with subagent_type=...') but provides no executable code, no actual commands, no real tool invocations, and no concrete examples. The prompts are templates with $ARGUMENTS placeholders but no demonstration of actual usage. There's no copy-paste ready content.

2 / 5

Workflow Clarity

The phases are clearly sequenced (Detection → Investigation → Resolution → Communication → Postmortem) with numbered steps, which is good. However, there are no explicit validation checkpoints or feedback loops — step 3 mentions rollback assessment but doesn't define criteria for when to rollback vs proceed. The deployment step mentions rollback triggers but doesn't specify them. For a destructive/high-stakes workflow like incident response, the lack of explicit validation gates caps this at 3.

3 / 5

Progressive Disclosure

The skill references `resources/implementation-playbook.md` but no bundle files are provided, so we can't verify it exists. The massive amount of content (13 detailed steps, configuration, success criteria, coordination protocols) is all inlined in a single file when much of it (severity definitions, communication templates, coordination protocols) could be split into separate reference files. Some structure exists via phase headers but the file is monolithic.

3 / 5

Total

10

/

20

Passed

Description

20%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

This description is extremely weak: it lacks any concrete actions, contains a redundant repetition ('incident response incident response'), and provides no meaningful detail about what the skill does. While it includes a 'Use when' clause and a domain keyword, the absence of a 'what' component and the lack of trigger term variety make it nearly unusable for skill selection.

Suggestions

Add concrete actions describing what the skill does, e.g., 'Triages security alerts, coordinates incident response workflows, generates post-incident reports.'

Expand trigger terms with natural synonyms and variations such as 'security incident', 'breach', 'alert', 'on-call', 'escalation', 'post-mortem'.

Fix the redundant 'incident response incident response' typo and add a clear 'Use when...' clause with specific trigger scenarios, e.g., 'Use when the user needs to respond to a security incident, triage alerts, or create incident timelines.'

DimensionReasoningScore

Specificity

The description contains no concrete actions whatsoever. It does not describe what the skill does—only mentions the domain 'incident response' with no verbs or capabilities listed.

1 / 5

Completeness

There is a 'when' clause ('Use when working with incident response') but the 'what' is entirely absent—there is no description of what the skill actually does. The redundant repetition of 'incident response' appears to be a typo.

2 / 5

Trigger Term Quality

The phrase 'incident response' is a relevant keyword, but it is repeated redundantly and no synonyms, variations, or related terms (e.g., 'security incident', 'alert triage', 'breach', 'on-call') are provided.

2 / 5

Distinctiveness Conflict Risk

'Incident response' is a broad domain that could overlap with security monitoring, alerting, runbook execution, or post-mortem skills. Without specific actions or scope, conflict risk is high.

2 / 5

Total

7

/

20

Passed

Validation

90%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation10 / 11 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

10

/

11

Passed

Repository
administrakt0r/AI-Agents-Safe-Coding-Skills
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.