PlugWiki

incident-runbook-templates Skill for Claude: What It Does and How to Install It

Helps your assistant write incident runbooks that an on-call engineer can follow at 3 AM.

Installs
11.2K
on skills.sh
Stars
42.1K
on GitHub
Files
1
besides SKILL.md
Updated
Oct 2026
last repo commit

SKILL.md defines four severity levels (SEV1 to SEV4) with response times, a nine-part runbook structure and do and don't lists. Its Troubleshooting section has five fixes, such as adding a prerequisite check to each command, a quick checklist at the top of a runbook and a Last Verified date.

Two templates sit in references/details.md: a service outage runbook (a payment service example with triage, mitigation, verification, rollback, escalation and communication templates) and a database incident runbook (connection pool exhaustion, replication lag, disk space). It bundles no scripts.

Good for

  • SRE and on-call engineers
  • Engineering managers standardizing escalation
  • Teams onboarding new on-call staff

Install incident-runbook-templates

Claude Code

  1. 1

    Copy this prompt.

    Install the incident-runbook-templates skill in Claude Code. Run this command:

/plugin marketplace add wshobson/agents
/plugin install incident-response@claude-code-workflows

Then check that it loaded and tell me how to use it.
  2. 2

    Paste it into Claude Code. It shows the change and asks before running it.

Pick one route. The plugin routes install the whole incident-response plugin: 6 agents, 2 commands and 4 skills (counted from the plugin folder in the repo tree, which has no hooks or MCP config files). The skills-only routes install just this skill, with no agents or commands.

From the project README. Source.

What's in the skill

When it loads

Create structured incident response runbooks with step-by-step procedures, escalation paths, and recovery actions. Use this skill when building a service outage runbook for a payment processing system; creating database incident procedures covering connection pool exhaustion, replication lag, and disk space alerts; onboarding new on-call engineers who need step-by-step recovery guides written for a 3 AM brain; or standardizing escalation matrices across multiple engineering teams.

Sections in SKILL.md

  1. When to Use This Skill
  2. Core Concepts
  3. 1. Incident Severity Levels
  4. 2. Runbook Structure
  5. Detailed patterns and worked examples
  6. Best Practices
  7. Do's
  8. Don'ts
  9. Troubleshooting
  10. Runbook steps work in staging but fail during a real incident
  11. On-call engineer panics and skips steps out of order
  12. Quick Checklist
  13. Runbook is outdated — commands reference old cluster names or endpoints
  14. Runbook Metadata
  15. Stakeholder communication is delayed while engineers are heads-down
  16. Database runbook commands cause additional downtime when run incorrectly

Key facts

Author
wshobson (repo owner)
License
MIT
Installs on skills.sh
11,174 (Nov 2, 2026)
GitHub stars
42,081 for the whole wshobson/agents repo (Nov 2, 2026)
Last repo commit
Oct 30, 2026
What it includes
2 files including SKILL.md: references/details.md (no scripts)
Part of
The incident-response plugin (version 1.4.1) in wshobson/agents. Counted from the plugin folder: 6 agents, 2 commands and 4 skills
Works in
Claude Code, Codex CLI, Cursor, OpenCode, Antigravity CLI, GitHub Copilot and Pi, per the README. Skills-only installers ask which tool you use

What it includes

  • SEV1 to SEV4 with impact, response time and an example each

    SEV1 to SEV4 with impact, response time and an example each.

    Incident severity levels

  • Nine sections, from overview and impact to escalation matrix

    Nine sections, from overview and impact to escalation matrix.

    Runbook structure

  • Keep runbooks updated, test them, include rollback steps and write for a 3 AM brain

    Keep runbooks updated, test them, include rollback steps and write for a 3 AM brain.

    Best practices

  • Five fixes: failing prerequisites, skipped steps, stale runbooks, delayed comms

    Five fixes: failing prerequisites, skipped steps, stale runbooks, delayed comms and risky database commands.

    Troubleshooting guidance

  • Detection, triage, four mitigation paths, verification, rollback, escalation matrix

    Detection, triage, four mitigation paths, verification, rollback, escalation matrix and three communication templates (in references/details.md)

    Template 1: Service outage runbook

  • Connection pool exhaustion, replication lag and disk space critical, with SQL

    Connection pool exhaustion, replication lag and disk space critical, with SQL and shell examples (in references/details.md)

    Template 2: Database incident runbook

From the official docs

Permissions

Medium risk

What it can do

  • Read your data
  • Create and change things
  • Delete things
  • Read-only mode

Watch out for

  • The templates contain commands that change production systems

    references/details.md includes kubectl rollout undo, kubectl scale, kubectl set env, a kubectl apply of a NetworkPolicy, a curl POST to a feature-flag endpoint, ./scripts/db-rollback.sh, pg_terminate_backend and VACUUM FULL. They are examples inside runbook text. Review each one before it goes into a runbook or is run. github.com

  • A destructive database step is left open

    The disk space section ends with the comment "If emergency, delete old data or expand disk" and gives no command. The pg_terminate_backend examples end idle connections; SKILL.md's own example warns to check the count first. github.com

  • The plugin route installs more than this skill

    The incident-response plugin has 6 agents, 2 commands and 4 skills. We found no hooks or MCP config files in its folder. The skills-only routes install only this skill. github.com

Security advisories

No published security advisories as of Nov 2, 2026.

Technical details
Turning on read-onlySKILL.md and references/details.md do not describe a read-only mode.
Sign-in and keysSKILL.md and references/details.md do not describe key storage. The examples use placeholders such as $DB_HOST, $DB_USER and a kubeconfig, and one SKILL.md example mentions aws eks update-kubeconfig.
Scopes

  • The assistant writes runbook text. The templates include shell, kubectl, psql and SQL examples that change systems if someone runs them

Questions

What does the incident-runbook-templates skill do?

It gives the assistant a runbook-writing guide: severity levels, a runbook structure, a service outage template and a database incident template.

How do I install incident-runbook-templates?

Use the install box at the top of this page. For Claude Code it lists the plugin route (/plugin marketplace add wshobson/agents, then /plugin install incident-response@claude-code-workflows) and two skills-only commands: npx skills add wshobson/agents --skill incident-runbook-templates and gh skill install wshobson/agents incident-runbook-templates (GitHub CLI 2.90 or later), which skip the plugin's agents and commands.

Does it run any of the commands it writes?

SKILL.md and references/details.md contain kubectl, psql, curl and SQL examples, but the skill does not say the assistant runs them. They are text for a runbook. Whether anything executes depends on your own settings and what you ask the assistant to do.

Is it safe?

Its folder holds two Markdown files and no scripts, so installing it adds no executable code. The templates do contain commands that change systems, such as kubectl rollout undo, kubectl scale, kubectl set env, a NetworkPolicy apply, pg_terminate_backend and VACUUM FULL. Review every command before anyone runs it, especially against production.

Which related skills does it mention?

SKILL.md's Related Skills section names postmortem-writing and on-call-handoff-patterns. Both ship in the same incident-response plugin. They are optional companions: this skill does not need them to work.

Should I install the whole incident-response plugin?

Only if you want the rest. The README documents a plugin route for Claude Code and Codex. The incident-response plugin folder holds 6 agents, 2 commands and 4 skills, and its repo tree shows no hooks or MCP config files. The install box offers the plugin and the skills-only commands.

Does it work in Codex or Cursor?

The README documents Codex CLI as a plugin route and a skills-only install. For Cursor it points to a plugin marketplace and its setup docs, which we did not check, so follow the README there.

Is this skill from Anthropic?

No. It is in wshobson/agents, a community collection. The skill sits in the incident-response plugin there, alongside connectivity-triage, on-call-handoff-patterns and postmortem-writing.

Information

updated Nov 2, 2026

Repository
wshobson/agents
Folder
plugins/incident-response/skills/incident-runbook-templates

wshobson/agentsskills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 5
  1. incident-runbook-templates SKILL.md · github.com
  2. wshobson/agents README · github.com
  3. incident-response plugin.json · github.com
  4. wshobson/agents marketplace.json · github.com
  5. details.md · github.com

Updated Nov 2, 2026.