CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

incident-commander

Comprehensive incident response framework from detection through resolution and post-incident review. Battle-tested SRE/DevOps practices: severity classification, timeline reconstruction, structured post-incident analysis. Use when declaring an incident, coordinating multi-team response during an outage, leading a post-mortem, or setting up on-call practices for a new service.

54

Quality

68%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./.gemini/skills/incident-commander/SKILL.md

The canonical home for this skill is incident-commander in alirezarezvani/claude-skills

SKILL.md
Quality
Evals
Security

Quality

Content

38%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is well-sectioned and domain-rich (severity matrix, response timings, templates), but it is monolithic and verbose, pads itself with generic SRE advice Claude already knows, and its progressive disclosure is broken in practice: every script, asset, and reference file it cites is missing from the bundle, making the usage examples non-executable. It reads more like a policy handbook than a lean operational skill.

Suggestions

Ship the referenced bundle files (scripts/incident_classifier.py, scripts/timeline_reconstructor.py, scripts/pir_generator.py, the assets/*.json samples, references/reference-information.md) or remove the commands and dangling reference — as written, none of the usage examples can run.

Split the communication templates, stakeholder cadence tables, and runbook template into reference files linked from a lean SKILL.md overview, keeping only severity definitions and the core workflow inline.

Cut sections that restate general knowledge — 'Best Practices' platitudes ('stay composed under pressure', 'use clear, jargon-free language') and the generic 'Integration with Existing Tools' list — and replace them with an explicit numbered incident workflow (declare → classify → establish command → mitigate → recover → PIR) with validation checkpoints.

DimensionReasoningScore

Conciseness

The ~470-line body has several padded sections that restate what Claude already knows or add fluff: 'Maintain Calm Leadership... Stay composed under pressure', 'Use clear, jargon-free language', the generic 'Integration with Existing Tools' list (PagerDuty, Slack, Zoom, Confluence, JIRA), and the marketing-style 'Key Features' bullets ('Intelligent incident triage based on impact and urgency metrics'). This matches 'noticeably verbose; several unnecessary explanations or padded sections' rather than the mostly-efficient level 3.

2 / 5

Actionability

The usage examples give concrete, flag-level commands (e.g. 'python scripts/timeline_reconstructor.py --input assets/sample_timeline_events.json --detect-phases --gap-analysis'), but the bundle contains no scripts/, assets/, or references/ directories — every referenced file (incident_classifier.py, sample_timeline_events.json, reference-information.md) is missing, so the commands are not executable as shipped. This lands at 'some concrete guidance but incomplete... missing key details' rather than level 4, where commands would actually run.

3 / 5

Workflow Clarity

An operational sequence is implied by the usage examples (classify → reconstruct timeline → generate PIR) and the embedded runbook template does include checkpoints ('Wait for {metric} to return to normal', 'Validate end-to-end functionality'), but the skill body itself never lays out a numbered end-to-end workflow with validation checkpoints for Claude to follow when invoked. This fits 'steps listed but validation gaps; sequence present but checkpoints missing or implicit'.

3 / 5

Progressive Disclosure

Scored against the actual bundle structure: no references/, scripts/, or assets/ exist, yet the body points to all three, and its single reference — '→ See references/reference-information.md for details' — is a dangling pointer to a nonexistent file. Meanwhile ~300 lines of communication templates, stakeholder matrices, and a full runbook template that clearly belong in separate reference files are inlined in SKILL.md. This matches 'content that clearly belongs in separate files is inlined; or references are buried' more than level 3, since the one signaled reference is broken and nothing is actually split out.

2 / 5

Total

10

/

20

Passed

Description

85%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description with an explicit 'Use when...' clause, concrete named capabilities, and natural trigger phrases. Its main weakness is conflict risk: 'incident response' is ambiguous between operational/outage response and security incident response, and the disambiguation present in the body is missing from the description itself.

Suggestions

Add a disambiguation clause to the description itself, e.g. 'For security incidents (intrusion, ransomware, data exfiltration), use incident-response instead' — the routing guidance currently lives only in the body.

Include additional natural trigger synonyms users say during outages, such as 'SEV1', 'production outage', 'service degraded', or 'escalation', to improve trigger coverage.

DimensionReasoningScore

Specificity

The description lists multiple concrete, specific actions — 'severity classification, timeline reconstruction, structured post-incident analysis' — and explicitly spans the full lifecycle 'from detection through resolution and post-incident review', matching the comprehensive-coverage anchor. It is not the level below (4) because coverage of the domain's actions is complete rather than having minor gaps.

5 / 5

Completeness

Both questions are answered explicitly: the 'what' is the incident response framework with named practices, and the 'when' is a concrete 'Use when declaring an incident, coordinating multi-team response during an outage, leading a post-mortem, or setting up on-call practices for a new service' clause with four concrete trigger phrases. This matches the top anchor exactly.

5 / 5

Trigger Term Quality

Triggers are natural phrases a user would actually say: 'declaring an incident', 'coordinating multi-team response during an outage', 'leading a post-mortem', 'setting up on-call practices'. Not a 5 because common synonyms and vocabulary users also say — 'SEV'/'severity', 'production outage', 'escalation', 'war room' — are absent from the trigger list.

4 / 5

Distinctiveness Conflict Risk

The description leans operational ('SRE/DevOps practices', 'outage', 'post-mortem', 'on-call'), but the term 'incident response framework' substantially overlaps with security incident-response skills, and the description itself does not disambiguate — the body's 'This is NOT security incident triage' routing guidance never appears in the description. It fits 'somewhat specific but could still overlap with similar skills' rather than 'mostly distinct', since a user asking for incident response to a breach or ransomware event would plausibly trigger this skill.

3 / 5

Total

17

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

referenced_paths_exist

Referenced path issues: 11 missing

Warning

Total

15

/

16

Passed

Repository

alirezarezvani/claude-skills

Path

.gemini/skills/incident-commander/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.