[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6RV96JKQ8XGSNN95ZWWPF58":3,"skill-same:01M6RV96JKQ8XGSNN95ZWWPF58":70},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":22,"publishedAt":43,"linkOnly":44,"markdownContent":45,"markdownBody":46,"frontMatter":47,"refName":50,"commitSha":51,"skillDirectory":52,"forksCount":13,"repositoryHtmlUrl":53,"repositoryHomepageUrl":6,"ownerHtmlUrl":54,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":55,"install":56,"resources":69},"01M6RV96JKQ8XGSNN95ZWWPF58","healthcare-phi-compliance",null,"Protected Health Information (PHI) and Personally Identifiable Information (PII) compliance patterns for healthcare applications. Covers data classification, access control, audit trails, encryption, and common leak vectors.","sakamoto-family-smile\u002Fagent_monorepo","sakamoto-family-smile","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F132812403?v=4","01M6RTAT3H8PMWX5SJ65KP3VYF","01M6RTAV321WB5RAHCWTZMX5CV",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fsakamoto-family-smile\u002Fagent_monorepo\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fecc\u002Fhealthcare-phi-compliance\u002FSKILL.md",[17],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42],"compliance","phi","healthcare","healthcare phi compliance","compliance patterns","audit","super","for","data classification","information","Access Control","patterns","common","access","health","classification","applications","pii","encryption","data","2026-11-10 10:12:30",false,"---\nname: incident-runbook-templates\ndescription: Create structured incident response runbooks with step-by-step procedures, escalation paths, and recovery actions. Use when building runbooks, responding to incidents, or establishing incident response procedures.\n---\n\n# Incident Runbook Templates\n\nProduction-ready templates for incident response runbooks covering detection, triage, mitigation, resolution, and communication.\n\n## Do not use this skill when\n\n- The task is unrelated to incident runbook templates\n- You need a different domain or tool outside this scope\n\n## Instructions\n\n- Clarify goals, constraints, and required inputs.\n- Apply relevant best practices and validate outcomes.\n- Provide actionable steps and verification.\n- If detailed examples are required, open `resources\u002Fimplementation-playbook.md`.\n\n## Use this skill when\n\n- Creating incident response procedures\n- Building service-specific runbooks\n- Establishing escalation paths\n- Documenting recovery procedures\n- Responding to active incidents\n- Onboarding on-call engineers\n\n## Core Concepts\n\n### 1. Incident Severity Levels\n\n| Severity | Impact | Response Time | Example |\n|----------|--------|---------------|---------|\n| **SEV1** | Complete outage, data loss | 15 min | Production down |\n| **SEV2** | Major degradation | 30 min | Critical feature broken |\n| **SEV3** | Minor impact | 2 hours | Non-critical bug |\n| **SEV4** | Minimal impact | Next business day | Cosmetic issue |\n\n### 2. Runbook Structure\n\n```\n1. Overview & Impact\n2. Detection & Alerts\n3. Initial Triage\n4. Mitigation Steps\n5. Root Cause Investigation\n6. Resolution Procedures\n7. Verification & Rollback\n8. Communication Templates\n9. Escalation Matrix\n```\n\n## Runbook Templates\n\n### Template 1: Service Outage Runbook\n\n```markdown\n# [Service Name] Outage Runbook\n\n## Overview\n**Service**: Payment Processing Service\n**Owner**: Platform Team\n**Slack**: #payments-incidents\n**PagerDuty**: payments-oncall\n\n## Impact Assessment\n- [ ] Which customers are affected?\n- [ ] What percentage of traffic is impacted?\n- [ ] Are there financial implications?\n- [ ] What's the blast radius?\n\n## Detection\n### Alerts\n- `payment_error_rate > 5%` (PagerDuty)\n- `payment_latency_p99 > 2s` (Slack)\n- `payment_success_rate \u003C 95%` (PagerDuty)\n\n### Dashboards\n- [Payment Service Dashboard](https:\u002F\u002Fgrafana\u002Fd\u002Fpayments)\n- [Error Tracking](https:\u002F\u002Fsentry.io\u002Fpayments)\n- [Dependency Status](https:\u002F\u002Fstatus.stripe.com)\n\n## Initial Triage (First 5 Minutes)\n\n### 1. Assess Scope\n```bash\n# Check service health\nkubectl get pods -n payments -l app=payment-service\n\n# Check recent deployments\nkubectl rollout history deployment\u002Fpayment-service -n payments\n\n# Check error rates\ncurl -s \"http:\u002F\u002Fprometheus:9090\u002Fapi\u002Fv1\u002Fquery?query=sum(rate(http_requests_total{status=~'5..'}[5m]))\"\n```\n\n### 2. Quick Health Checks\n- [ ] Can you reach the service? `curl -I https:\u002F\u002Fapi.company.com\u002Fpayments\u002Fhealth`\n- [ ] Database connectivity? Check connection pool metrics\n- [ ] External dependencies? Check Stripe, bank API status\n- [ ] Recent changes? Check deploy history\n\n### 3. Initial Classification\n| Symptom | Likely Cause | Go To Section |\n|---------|--------------|---------------|\n| All requests failing | Service down | Section 4.1 |\n| High latency | Database\u002Fdependency | Section 4.2 |\n| Partial failures | Code bug | Section 4.3 |\n| Spike in errors | Traffic surge | Section 4.4 |\n\n## Mitigation Procedures\n\n### 4.1 Service Completely Down\n```bash\n# Step 1: Check pod status\nkubectl get pods -n payments\n\n# Step 2: If pods are crash-looping, check logs\nkubectl logs -n payments -l app=payment-service --tail=100\n\n# Step 3: Check recent deployments\nkubectl rollout history deployment\u002Fpayment-service -n payments\n\n# Step 4: ROLLBACK if recent deploy is suspect\nkubectl rollout undo deployment\u002Fpayment-service -n payments\n\n# Step 5: Scale up if resource constrained\nkubectl scale deployment\u002Fpayment-service -n payments --replicas=10\n\n# Step 6: Verify recovery\nkubectl rollout status deployment\u002Fpayment-service -n payments\n```\n\n### 4.2 High Latency\n```bash\n# Step 1: Check database connections\nkubectl exec -n payments deploy\u002Fpayment-service -- \\\n  curl localhost:8080\u002Fmetrics | grep db_pool\n\n# Step 2: Check slow queries (if DB issue)\npsql -h $DB_HOST -U $DB_USER -c \"\n  SELECT pid, now() - query_start AS duration, query\n  FROM pg_stat_activity\n  WHERE state = 'active' AND duration > interval '5 seconds'\n  ORDER BY duration DESC;\"\n\n# Step 3: Kill long-running queries if needed\npsql -h $DB_HOST -U $DB_USER -c \"SELECT pg_terminate_backend(pid);\"\n\n# Step 4: Check external dependency latency\ncurl -w \"@curl-format.txt\" -o \u002Fdev\u002Fnull -s https:\u002F\u002Fapi.stripe.com\u002Fv1\u002Fhealth\n\n# Step 5: Enable circuit breaker if dependency is slow\nkubectl set env deployment\u002Fpayment-service \\\n  STRIPE_CIRCUIT_BREAKER_ENABLED=true -n payments\n```\n\n### 4.3 Partial Failures (Specific Errors)\n```bash\n# Step 1: Identify error pattern\nkubectl logs -n payments -l app=payment-service --tail=500 | \\\n  grep -i error | sort | uniq -c | sort -rn | head -20\n\n# Step 2: Check error tracking\n# Go to Sentry: https:\u002F\u002Fsentry.io\u002Fpayments\n\n# Step 3: If specific endpoint, enable feature flag to disable\ncurl -X POST https:\u002F\u002Fapi.company.com\u002Finternal\u002Ffeature-flags \\\n  -d '{\"flag\": \"DISABLE_PROBLEMATIC_FEATURE\", \"enabled\": true}'\n\n# Step 4: If data issue, check recent data changes\npsql -h $DB_HOST -c \"\n  SELECT * FROM audit_log\n  WHERE table_name = 'payment_methods'\n  AND created_at > now() - interval '1 hour';\"\n```\n\n### 4.4 Traffic Surge\n```bash\n# Step 1: Check current request rate\nkubectl top pods -n payments\n\n# Step 2: Scale horizontally\nkubectl scale deployment\u002Fpayment-service -n payments --replicas=20\n\n# Step 3: Enable rate limiting\nkubectl set env deployment\u002Fpayment-service \\\n  RATE_LIMIT_ENABLED=true \\\n  RATE_LIMIT_RPS=1000 -n payments\n\n# Step 4: If attack, block suspicious IPs\nkubectl apply -f - \u003C\u003CEOF\napiVersion: networking.k8s.io\u002Fv1\nkind: NetworkPolicy\nmetadata:\n  name: block-suspicious\n  namespace: payments\nspec:\n  podSelector:\n    matchLabels:\n      app: payment-service\n  ingress:\n  - from:\n    - ipBlock:\n        cidr: 0.0.0.0\u002F0\n        except:\n        - 192.168.1.0\u002F24  # Suspicious range\nEOF\n```\n\n## Verification Steps\n```bash\n# Verify service is healthy\ncurl -s https:\u002F\u002Fapi.company.com\u002Fpayments\u002Fhealth | jq\n\n# Verify error rate is back to normal\ncurl -s \"http:\u002F\u002Fprometheus:9090\u002Fapi\u002Fv1\u002Fquery?query=sum(rate(http_requests_total{status=~'5..'}[5m]))\" | jq '.data.result[0].value[1]'\n\n# Verify latency is acceptable\ncurl -s \"http:\u002F\u002Fprometheus:9090\u002Fapi\u002Fv1\u002Fquery?query=histogram_quantile(0.99,sum(rate(http_request_duration_seconds_bucket[5m]))by(le))\" | jq\n\n# Smoke test critical flows\n.\u002Fscripts\u002Fsmoke-test-payments.sh\n```\n\n## Rollback Procedures\n```bash\n# Rollback Kubernetes deployment\nkubectl rollout undo deployment\u002Fpayment-service -n payments\n\n# Rollback database migration (if applicable)\n.\u002Fscripts\u002Fdb-rollback.sh $MIGRATION_VERSION\n\n# Rollback feature flag\ncurl -X POST https:\u002F\u002Fapi.company.com\u002Finternal\u002Ffeature-flags \\\n  -d '{\"flag\": \"NEW_PAYMENT_FLOW\", \"enabled\": false}'\n```\n\n## Escalation Matrix\n\n| Condition | Escalate To | Contact |\n|-----------|-------------|---------|\n| > 15 min unresolved SEV1 | Engineering Manager | @manager (Slack) |\n| Data breach suspected | Security Team | #security-incidents |\n| Financial impact > $10k | Finance + Legal | @finance-oncall |\n| Customer communication needed | Support Lead | @support-lead |\n\n## Communication Templates\n\n### Initial Notification (Internal)\n```\n? INCIDENT: Payment Service Degradation\n\nSeverity: SEV2\nStatus: Investigating\nImpact: ~20% of payment requests failing\nStart Time: [TIME]\nIncident Commander: [NAME]\n\nCurrent Actions:\n- Investigating root cause\n- Scaling up service\n- Monitoring dashboards\n\nUpdates in #payments-incidents\n```\n\n### Status Update\n```\n? UPDATE: Payment Service Incident\n\nStatus: Mitigating\nImpact: Reduced to ~5% failure rate\nDuration: 25 minutes\n\nActions Taken:\n- Rolled back deployment v2.3.4 → v2.3.3\n- Scaled service from 5 → 10 replicas\n\nNext Steps:\n- Continuing to monitor\n- Root cause analysis in progress\n\nETA to Resolution: ~15 minutes\n```\n\n### Resolution Notification\n```\n✅ RESOLVED: Payment Service Incident\n\nDuration: 45 minutes\nImpact: ~5,000 affected transactions\nRoot Cause: Memory leak in v2.3.4\n\nResolution:\n- Rolled back to v2.3.3\n- Transactions auto-retried successfully\n\nFollow-up:\n- Postmortem scheduled for [DATE]\n- Bug fix in progress\n```\n```\n\n### Template 2: Database Incident Runbook\n\n```markdown\n# Database Incident Runbook\n\n## Quick Reference\n| Issue | Command |\n|-------|---------|\n| Check connections | `SELECT count(*) FROM pg_stat_activity;` |\n| Kill query | `SELECT pg_terminate_backend(pid);` |\n| Check replication lag | `SELECT extract(epoch from (now() - pg_last_xact_replay_timestamp()));` |\n| Check locks | `SELECT * FROM pg_locks WHERE NOT granted;` |\n\n## Connection Pool Exhaustion\n```sql\n-- Check current connections\nSELECT datname, usename, state, count(*)\nFROM pg_stat_activity\nGROUP BY datname, usename, state\nORDER BY count(*) DESC;\n\n-- Identify long-running connections\nSELECT pid, usename, datname, state, query_start, query\nFROM pg_stat_activity\nWHERE state != 'idle'\nORDER BY query_start;\n\n-- Terminate idle connections\nSELECT pg_terminate_backend(pid)\nFROM pg_stat_activity\nWHERE state = 'idle'\nAND query_start \u003C now() - interval '10 minutes';\n```\n\n## Replication Lag\n```sql\n-- Check lag on replica\nSELECT\n  CASE\n    WHEN pg_last_wal_receive_lsn() = pg_last_wal_replay_lsn() THEN 0\n    ELSE extract(epoch from now() - pg_last_xact_replay_timestamp())\n  END AS lag_seconds;\n\n-- If lag > 60s, consider:\n-- 1. Check network between primary\u002Freplica\n-- 2. Check replica disk I\u002FO\n-- 3. Consider failover if unrecoverable\n```\n\n## Disk Space Critical\n```bash\n# Check disk usage\ndf -h \u002Fvar\u002Flib\u002Fpostgresql\u002Fdata\n\n# Find large tables\npsql -c \"SELECT relname, pg_size_pretty(pg_total_relation_size(relid))\nFROM pg_catalog.pg_statio_user_tables\nORDER BY pg_total_relation_size(relid) DESC\nLIMIT 10;\"\n\n# VACUUM to reclaim space\npsql -c \"VACUUM FULL large_table;\"\n\n# If emergency, delete old data or expand disk\n```\n```\n\n## Best Practices\n\n### Do's\n- **Keep runbooks updated** - Review after every incident\n- **Test runbooks regularly** - Game days, chaos engineering\n- **Include rollback steps** - Always have an escape hatch\n- **Document assumptions** - What must be true for steps to work\n- **Link to dashboards** - Quick access during stress\n\n### Don'ts\n- **Don't assume knowledge** - Write for 3 AM brain\n- **Don't skip verification** - Confirm each step worked\n- **Don't forget communication** - Keep stakeholders informed\n- **Don't work alone** - Escalate early\n- **Don't skip postmortems** - Learn from every incident\n\n## Resources\n\n- [Google SRE Book - Incident Management](https:\u002F\u002Fsre.google\u002Fsre-book\u002Fmanaging-incidents\u002F)\n- [PagerDuty Incident Response](https:\u002F\u002Fresponse.pagerduty.com\u002F)\n- [Atlassian Incident Management](https:\u002F\u002Fwww.atlassian.com\u002Fincident-management)\n","# Incident Runbook Templates\n\nProduction-ready templates for incident response runbooks covering detection, triage, mitigation, resolution, and communication.\n\n## Do not use this skill when\n\n- The task is unrelated to incident runbook templates\n- You need a different domain or tool outside this scope\n\n## Instructions\n\n- Clarify goals, constraints, and required inputs.\n- Apply relevant best practices and validate outcomes.\n- Provide actionable steps and verification.\n- If detailed examples are required, open `resources\u002Fimplementation-playbook.md`.\n\n## Use this skill when\n\n- Creating incident response procedures\n- Building service-specific runbooks\n- Establishing escalation paths\n- Documenting recovery procedures\n- Responding to active incidents\n- Onboarding on-call engineers\n\n## Core Concepts\n\n### 1. Incident Severity Levels\n\n| Severity | Impact | Response Time | Example |\n|----------|--------|---------------|---------|\n| **SEV1** | Complete outage, data loss | 15 min | Production down |\n| **SEV2** | Major degradation | 30 min | Critical feature broken |\n| **SEV3** | Minor impact | 2 hours | Non-critical bug |\n| **SEV4** | Minimal impact | Next business day | Cosmetic issue |\n\n### 2. Runbook Structure\n\n```\n1. Overview & Impact\n2. Detection & Alerts\n3. Initial Triage\n4. Mitigation Steps\n5. Root Cause Investigation\n6. Resolution Procedures\n7. Verification & Rollback\n8. Communication Templates\n9. Escalation Matrix\n```\n\n## Runbook Templates\n\n### Template 1: Service Outage Runbook\n\n```markdown\n# [Service Name] Outage Runbook\n\n## Overview\n**Service**: Payment Processing Service\n**Owner**: Platform Team\n**Slack**: #payments-incidents\n**PagerDuty**: payments-oncall\n\n## Impact Assessment\n- [ ] Which customers are affected?\n- [ ] What percentage of traffic is impacted?\n- [ ] Are there financial implications?\n- [ ] What's the blast radius?\n\n## Detection\n### Alerts\n- `payment_error_rate > 5%` (PagerDuty)\n- `payment_latency_p99 > 2s` (Slack)\n- `payment_success_rate \u003C 95%` (PagerDuty)\n\n### Dashboards\n- [Payment Service Dashboard](https:\u002F\u002Fgrafana\u002Fd\u002Fpayments)\n- [Error Tracking](https:\u002F\u002Fsentry.io\u002Fpayments)\n- [Dependency Status](https:\u002F\u002Fstatus.stripe.com)\n\n## Initial Triage (First 5 Minutes)\n\n### 1. Assess Scope\n```bash\n# Check service health\nkubectl get pods -n payments -l app=payment-service\n\n# Check recent deployments\nkubectl rollout history deployment\u002Fpayment-service -n payments\n\n# Check error rates\ncurl -s \"http:\u002F\u002Fprometheus:9090\u002Fapi\u002Fv1\u002Fquery?query=sum(rate(http_requests_total{status=~'5..'}[5m]))\"\n```\n\n### 2. Quick Health Checks\n- [ ] Can you reach the service? `curl -I https:\u002F\u002Fapi.company.com\u002Fpayments\u002Fhealth`\n- [ ] Database connectivity? Check connection pool metrics\n- [ ] External dependencies? Check Stripe, bank API status\n- [ ] Recent changes? Check deploy history\n\n### 3. Initial Classification\n| Symptom | Likely Cause | Go To Section |\n|---------|--------------|---------------|\n| All requests failing | Service down | Section 4.1 |\n| High latency | Database\u002Fdependency | Section 4.2 |\n| Partial failures | Code bug | Section 4.3 |\n| Spike in errors | Traffic surge | Section 4.4 |\n\n## Mitigation Procedures\n\n### 4.1 Service Completely Down\n```bash\n# Step 1: Check pod status\nkubectl get pods -n payments\n\n# Step 2: If pods are crash-looping, check logs\nkubectl logs -n payments -l app=payment-service --tail=100\n\n# Step 3: Check recent deployments\nkubectl rollout history deployment\u002Fpayment-service -n payments\n\n# Step 4: ROLLBACK if recent deploy is suspect\nkubectl rollout undo deployment\u002Fpayment-service -n payments\n\n# Step 5: Scale up if resource constrained\nkubectl scale deployment\u002Fpayment-service -n payments --replicas=10\n\n# Step 6: Verify recovery\nkubectl rollout status deployment\u002Fpayment-service -n payments\n```\n\n### 4.2 High Latency\n```bash\n# Step 1: Check database connections\nkubectl exec -n payments deploy\u002Fpayment-service -- \\\n  curl localhost:8080\u002Fmetrics | grep db_pool\n\n# Step 2: Check slow queries (if DB issue)\npsql -h $DB_HOST -U $DB_USER -c \"\n  SELECT pid, now() - query_start AS duration, query\n  FROM pg_stat_activity\n  WHERE state = 'active' AND duration > interval '5 seconds'\n  ORDER BY duration DESC;\"\n\n# Step 3: Kill long-running queries if needed\npsql -h $DB_HOST -U $DB_USER -c \"SELECT pg_terminate_backend(pid);\"\n\n# Step 4: Check external dependency latency\ncurl -w \"@curl-format.txt\" -o \u002Fdev\u002Fnull -s https:\u002F\u002Fapi.stripe.com\u002Fv1\u002Fhealth\n\n# Step 5: Enable circuit breaker if dependency is slow\nkubectl set env deployment\u002Fpayment-service \\\n  STRIPE_CIRCUIT_BREAKER_ENABLED=true -n payments\n```\n\n### 4.3 Partial Failures (Specific Errors)\n```bash\n# Step 1: Identify error pattern\nkubectl logs -n payments -l app=payment-service --tail=500 | \\\n  grep -i error | sort | uniq -c | sort -rn | head -20\n\n# Step 2: Check error tracking\n# Go to Sentry: https:\u002F\u002Fsentry.io\u002Fpayments\n\n# Step 3: If specific endpoint, enable feature flag to disable\ncurl -X POST https:\u002F\u002Fapi.company.com\u002Finternal\u002Ffeature-flags \\\n  -d '{\"flag\": \"DISABLE_PROBLEMATIC_FEATURE\", \"enabled\": true}'\n\n# Step 4: If data issue, check recent data changes\npsql -h $DB_HOST -c \"\n  SELECT * FROM audit_log\n  WHERE table_name = 'payment_methods'\n  AND created_at > now() - interval '1 hour';\"\n```\n\n### 4.4 Traffic Surge\n```bash\n# Step 1: Check current request rate\nkubectl top pods -n payments\n\n# Step 2: Scale horizontally\nkubectl scale deployment\u002Fpayment-service -n payments --replicas=20\n\n# Step 3: Enable rate limiting\nkubectl set env deployment\u002Fpayment-service \\\n  RATE_LIMIT_ENABLED=true \\\n  RATE_LIMIT_RPS=1000 -n payments\n\n# Step 4: If attack, block suspicious IPs\nkubectl apply -f - \u003C\u003CEOF\napiVersion: networking.k8s.io\u002Fv1\nkind: NetworkPolicy\nmetadata:\n  name: block-suspicious\n  namespace: payments\nspec:\n  podSelector:\n    matchLabels:\n      app: payment-service\n  ingress:\n  - from:\n    - ipBlock:\n        cidr: 0.0.0.0\u002F0\n        except:\n        - 192.168.1.0\u002F24  # Suspicious range\nEOF\n```\n\n## Verification Steps\n```bash\n# Verify service is healthy\ncurl -s https:\u002F\u002Fapi.company.com\u002Fpayments\u002Fhealth | jq\n\n# Verify error rate is back to normal\ncurl -s \"http:\u002F\u002Fprometheus:9090\u002Fapi\u002Fv1\u002Fquery?query=sum(rate(http_requests_total{status=~'5..'}[5m]))\" | jq '.data.result[0].value[1]'\n\n# Verify latency is acceptable\ncurl -s \"http:\u002F\u002Fprometheus:9090\u002Fapi\u002Fv1\u002Fquery?query=histogram_quantile(0.99,sum(rate(http_request_duration_seconds_bucket[5m]))by(le))\" | jq\n\n# Smoke test critical flows\n.\u002Fscripts\u002Fsmoke-test-payments.sh\n```\n\n## Rollback Procedures\n```bash\n# Rollback Kubernetes deployment\nkubectl rollout undo deployment\u002Fpayment-service -n payments\n\n# Rollback database migration (if applicable)\n.\u002Fscripts\u002Fdb-rollback.sh $MIGRATION_VERSION\n\n# Rollback feature flag\ncurl -X POST https:\u002F\u002Fapi.company.com\u002Finternal\u002Ffeature-flags \\\n  -d '{\"flag\": \"NEW_PAYMENT_FLOW\", \"enabled\": false}'\n```\n\n## Escalation Matrix\n\n| Condition | Escalate To | Contact |\n|-----------|-------------|---------|\n| > 15 min unresolved SEV1 | Engineering Manager | @manager (Slack) |\n| Data breach suspected | Security Team | #security-incidents |\n| Financial impact > $10k | Finance + Legal | @finance-oncall |\n| Customer communication needed | Support Lead | @support-lead |\n\n## Communication Templates\n\n### Initial Notification (Internal)\n```\n? INCIDENT: Payment Service Degradation\n\nSeverity: SEV2\nStatus: Investigating\nImpact: ~20% of payment requests failing\nStart Time: [TIME]\nIncident Commander: [NAME]\n\nCurrent Actions:\n- Investigating root cause\n- Scaling up service\n- Monitoring dashboards\n\nUpdates in #payments-incidents\n```\n\n### Status Update\n```\n? UPDATE: Payment Service Incident\n\nStatus: Mitigating\nImpact: Reduced to ~5% failure rate\nDuration: 25 minutes\n\nActions Taken:\n- Rolled back deployment v2.3.4 → v2.3.3\n- Scaled service from 5 → 10 replicas\n\nNext Steps:\n- Continuing to monitor\n- Root cause analysis in progress\n\nETA to Resolution: ~15 minutes\n```\n\n### Resolution Notification\n```\n✅ RESOLVED: Payment Service Incident\n\nDuration: 45 minutes\nImpact: ~5,000 affected transactions\nRoot Cause: Memory leak in v2.3.4\n\nResolution:\n- Rolled back to v2.3.3\n- Transactions auto-retried successfully\n\nFollow-up:\n- Postmortem scheduled for [DATE]\n- Bug fix in progress\n```\n```\n\n### Template 2: Database Incident Runbook\n\n```markdown\n# Database Incident Runbook\n\n## Quick Reference\n| Issue | Command |\n|-------|---------|\n| Check connections | `SELECT count(*) FROM pg_stat_activity;` |\n| Kill query | `SELECT pg_terminate_backend(pid);` |\n| Check replication lag | `SELECT extract(epoch from (now() - pg_last_xact_replay_timestamp()));` |\n| Check locks | `SELECT * FROM pg_locks WHERE NOT granted;` |\n\n## Connection Pool Exhaustion\n```sql\n-- Check current connections\nSELECT datname, usename, state, count(*)\nFROM pg_stat_activity\nGROUP BY datname, usename, state\nORDER BY count(*) DESC;\n\n-- Identify long-running connections\nSELECT pid, usename, datname, state, query_start, query\nFROM pg_stat_activity\nWHERE state != 'idle'\nORDER BY query_start;\n\n-- Terminate idle connections\nSELECT pg_terminate_backend(pid)\nFROM pg_stat_activity\nWHERE state = 'idle'\nAND query_start \u003C now() - interval '10 minutes';\n```\n\n## Replication Lag\n```sql\n-- Check lag on replica\nSELECT\n  CASE\n    WHEN pg_last_wal_receive_lsn() = pg_last_wal_replay_lsn() THEN 0\n    ELSE extract(epoch from now() - pg_last_xact_replay_timestamp())\n  END AS lag_seconds;\n\n-- If lag > 60s, consider:\n-- 1. Check network between primary\u002Freplica\n-- 2. Check replica disk I\u002FO\n-- 3. Consider failover if unrecoverable\n```\n\n## Disk Space Critical\n```bash\n# Check disk usage\ndf -h \u002Fvar\u002Flib\u002Fpostgresql\u002Fdata\n\n# Find large tables\npsql -c \"SELECT relname, pg_size_pretty(pg_total_relation_size(relid))\nFROM pg_catalog.pg_statio_user_tables\nORDER BY pg_total_relation_size(relid) DESC\nLIMIT 10;\"\n\n# VACUUM to reclaim space\npsql -c \"VACUUM FULL large_table;\"\n\n# If emergency, delete old data or expand disk\n```\n```\n\n## Best Practices\n\n### Do's\n- **Keep runbooks updated** - Review after every incident\n- **Test runbooks regularly** - Game days, chaos engineering\n- **Include rollback steps** - Always have an escape hatch\n- **Document assumptions** - What must be true for steps to work\n- **Link to dashboards** - Quick access during stress\n\n### Don'ts\n- **Don't assume knowledge** - Write for 3 AM brain\n- **Don't skip verification** - Confirm each step worked\n- **Don't forget communication** - Keep stakeholders informed\n- **Don't work alone** - Escalate early\n- **Don't skip postmortems** - Learn from every incident\n\n## Resources\n\n- [Google SRE Book - Incident Management](https:\u002F\u002Fsre.google\u002Fsre-book\u002Fmanaging-incidents\u002F)\n- [PagerDuty Incident Response](https:\u002F\u002Fresponse.pagerduty.com\u002F)\n- [Atlassian Incident Management](https:\u002F\u002Fwww.atlassian.com\u002Fincident-management)\n",{"name":48,"description":49},"incident-runbook-templates","Create structured incident response runbooks with step-by-step procedures, escalation paths, and recovery actions. Use when building runbooks, responding to incidents, or establishing incident response procedures.","main","fbf4d3f6fb9300cbe74e1bea7d4e177911f3499b",".claude\u002Fskills\u002Fecc\u002Fhealthcare-phi-compliance","https:\u002F\u002Fgithub.com\u002Fsakamoto-family-smile\u002Fagent_monorepo","https:\u002F\u002Fgithub.com\u002Fsakamoto-family-smile","2026-11-08 20:29:14",{"source":8,"skillName":48,"commands":57,"prompt":67,"zipAvailable":68},[58,61,64],{"tool":59,"command":60},"npx","npx skills add sakamoto-family-smile\u002Fagent_monorepo --skill incident-runbook-templates",{"tool":62,"command":63},"bunx","bunx skills add sakamoto-family-smile\u002Fagent_monorepo --skill incident-runbook-templates",{"tool":65,"command":66},"pnpm","pnpm dlx skills add sakamoto-family-smile\u002Fagent_monorepo --skill incident-runbook-templates","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fsakamoto-family-smile\u002Fagent_monorepo\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fecc\u002Fhealthcare-phi-compliance\u002FSKILL.md",true,[],[71,105,113,131,154,182],{"skillNo":72,"name":73,"nameZh":6,"description":74,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":75,"categories":76,"keywords":85,"publishedAt":43},"01M6RW50THEFSKK42YNR8XFZA1","remotion-video-creation","Best practices for Remotion - Video creation in React. 29 domain-specific rules covering 3D, animations, audio, captions, charts, transitions, and more.","https:\u002F\u002Fgithub.com\u002Fsakamoto-family-smile\u002Fagent_monorepo\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fecc\u002Fremotion-video-creation\u002FSKILL.md",[77,82],{"categoryNo":78,"categoryName":79,"taxonomyType":80,"taxonomyTypeDesc":81},"01JBSEEDCAT000000000000009","前端开发","SCENARIO","使用场景",{"categoryNo":83,"categoryName":84,"taxonomyType":80,"taxonomyTypeDesc":81},"01JBSEEDCAT000000000000016","图像与多媒体",[86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,30],"Video","remotion video","remotion video creation","creation","Remotion","Charts","Captions","Audio","3D","Composition","Animation","best practices","more","animations","domain-specific","domain","three","Rules","Lottie",{"skillNo":106,"name":107,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":108,"categories":109,"keywords":110,"publishedAt":43},"01M6VCJ23NPECPSZJKGY691F75","hotcook-recipes","https:\u002F\u002Fgithub.com\u002Fsakamoto-family-smile\u002Fagent_monorepo\u002Fblob\u002Fmain\u002Fhotcook-agent\u002Fdata\u002Fskills\u002Fhotcook-recipes\u002FSKILL.md",[],[111,112],"hotcook recipes","recipes",{"skillNo":114,"name":115,"nameZh":6,"description":116,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":117,"categories":118,"keywords":125,"publishedAt":43},"01M6VCHHE00X5XHSDRD1KH1BW2","code-helper","Code review and assistance skill","https:\u002F\u002Fgithub.com\u002Fsakamoto-family-smile\u002Fagent_monorepo\u002Fblob\u002Fmain\u002Fagent-system-2\u002Fskills\u002Fcode-helper\u002Fskill.md",[119,122],{"categoryNo":120,"categoryName":121,"taxonomyType":80,"taxonomyTypeDesc":81},"01JBSEEDCAT000000000000007","代码审查",{"categoryNo":123,"categoryName":124,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000030","开发工程师",[126,127,128,129,130],"code helper","helper","code","code review","review",{"skillNo":132,"name":133,"nameZh":6,"description":134,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":135,"categories":136,"keywords":143,"publishedAt":43},"01M6VCH3Q31A20H6SQ1H0J7JB2","research-assistant","Web research assistant skill using Brave Search MCP","https:\u002F\u002Fgithub.com\u002Fsakamoto-family-smile\u002Fagent_monorepo\u002Fblob\u002Fmain\u002Fagent-system-1\u002Fskills\u002Fresearch-assistant\u002Fskill.md",[137,140],{"categoryNo":138,"categoryName":139,"taxonomyType":80,"taxonomyTypeDesc":81},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":141,"categoryName":142,"taxonomyType":80,"taxonomyTypeDesc":81},"01JBSEEDCAT000000000000023","Skill与智能体开发",[144,145,146,147,148,149,150,151,152,153],"research assistant","research","assistant","MCP","web","search","brave search","web research","brave","web research assistant",{"skillNo":155,"name":156,"nameZh":6,"description":157,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":158,"categories":159,"keywords":164,"publishedAt":43},"01M6VCGZZGPNVJSCZ1JTMNZAHY","x-api","X\u002FTwitter API integration for posting tweets, threads, reading timelines, search, and analytics. Covers OAuth auth patterns, rate limits, and platform-native content posting. Use when the user wants to interact with X programmatically.","https:\u002F\u002Fgithub.com\u002Fsakamoto-family-smile\u002Fagent_monorepo\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fecc\u002Fx-api\u002FSKILL.md",[160,163],{"categoryNo":161,"categoryName":162,"taxonomyType":80,"taxonomyTypeDesc":81},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":123,"categoryName":124,"taxonomyType":20,"taxonomyTypeDesc":21},[165,166,167,168,169,170,30,171,172,173,174,175,34,176,177,178,179,180,149,181],"x api","api","with","when","limits","rate","threads","reading","native","posting","platform","api integration","twitter","use","auth","analytics","OAuth",{"skillNo":183,"name":184,"nameZh":6,"description":185,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":186,"categories":187,"keywords":189,"publishedAt":43},"01M6VCGVX6DGB1FKTA53QBBCQB","workspace-surface-audit","Audit the active repo, MCP servers, plugins, connectors, env surfaces, and harness setup, then recommend the highest-value ECC-native skills, hooks, agents, and operator workflows. Use when the user wants help setting up Claude Code or understanding what capabilities are actually available in their environment.","https:\u002F\u002Fgithub.com\u002Fsakamoto-family-smile\u002Fagent_monorepo\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fecc\u002Fworkspace-surface-audit\u002FSKILL.md",[188],{"categoryNo":141,"categoryName":142,"taxonomyType":80,"taxonomyTypeDesc":81},[190,191,28,192,147,193,194,128,195,196,197,198,178,199,200,201,202,173,203,168],"workspace surface audit","workspace","hooks","workflows","connectors","capabilities","harness","repo","environment","up","harness setup","active","env","value"]