How do I use Incident Response on Zeplik?

Sign in to Zeplik and ask in plain language, or type /incident-response in any chat to invoke it directly. The skill applies its method and returns a result you can refine in the same conversation.

Which AI model does the Incident Response skill use?

Any model you choose. Zeplik works across every model in one chat, so the Incident Response skill runs on your preferred model for the task.

Where does the Incident Response skill come from?

The Incident Response skill is adapted from the open-source anthropics/knowledge-work-plugins project (Apache-2.0) and tuned to run natively on Zeplik. The original source is linked on this page.

How much does the Incident Response skill cost?

Using the skill is free to start. You only spend Zeplik credits when the assistant runs, and new accounts begin with free credits.

Incident Response

Software development skill, available on Zeplik

Incident Response is a ready-to-run software development skill on Zeplik. Not for routine debugging of a failing test (use systematic-debugging). Ask in plain language and Zeplik applies the skill's method for you inside the conversation, on whichever AI model you prefer.

The Incident Response skill loads automatically when your request matches it, or you can invoke it directly by typing /incident-response in any chat. It works with attachments, connectors, and any model that supports the task, so you get the same expert method every time without setting anything up.

What the Incident Response skill can do

Triage incident severity from SEV1 to SEV4 with response times
Draft factual status updates with impact, actions, and next steps
Generate blameless postmortems with timeline and 5 whys root cause analysis
Track action items with owners, priority, and due dates for follow-up

Try these prompts on Zeplik

Pick a prompt to open it in the Zeplik app. If you are not signed in yet, your prompt is waiting for you the moment you do.

How the Incident Response skill works

/incident-response

If you see unfamiliar placeholders or need to check which tools are connected, see CONNECTORS.md.

Manage an incident from detection through postmortem.

Usage

/incident-response $ARGUMENTS

Modes

/incident-response new [description]     # Start a new incident
/incident-response update [status]       # Post a status update
/incident-response postmortem            # Generate postmortem from incident data

If no mode is specified, ask what phase the incident is in.

How It Works

┌─────────────────────────────────────────────────────────────────┐
│                    INCIDENT RESPONSE                               │
├─────────────────────────────────────────────────────────────────┤
│  Phase 1: TRIAGE                                                  │
│  ✓ Assess severity (SEV1-4)                                     │
│  ✓ Identify affected systems and users                          │
│  ✓ Assign roles (IC, comms, responders)                         │
│                                                                    │
│  Phase 2: COMMUNICATE                                              │
│  ✓ Draft internal status update                                  │
│  ✓ Draft customer communication (if needed)                     │
│  ✓ Set up war room and cadence                                   │
│                                                                    │
│  Phase 3: MITIGATE                                                 │
│  ✓ Document mitigation steps taken                               │
│  ✓ Track timeline of events                                      │
│  ✓ Confirm resolution                                            │
│                                                                    │
│  Phase 4: POSTMORTEM                                               │
│  ✓ Blameless postmortem document                                 │
│  ✓ Timeline reconstruction                                       │
│  ✓ Root cause analysis (5 whys)                                  │
│  ✓ Action items with owners                                      │
└─────────────────────────────────────────────────────────────────┘

Severity Classification

Level	Criteria	Response Time
SEV1	Service down, all users affected	Immediate, all-hands
SEV2	Major feature degraded, many users affected	Within 15 min
SEV3	Minor feature issue, some users affected	Within 1 hour
SEV4	Cosmetic or low-impact issue	Next business day

Communication Guidance

Provide clear, factual updates at regular cadence. Include: what's happening, who's affected, what we're doing, when the next update is.

Output — Status Update

## Incident Update: [Title]
**Severity:** SEV[1-4] | **Status:** Investigating | Identified | Monitoring | Resolved
**Impact:** [Who/what is affected]
**Last Updated:** [Timestamp]

### Current Status
[What we know now]

### Actions Taken
- [Action 1]
- [Action 2]

### Next Steps
- [What's happening next and ETA]

### Timeline
| Time | Event |
|------|-------|
| [HH:MM] | [Event] |

Output — Postmortem

## Postmortem: [Incident Title]
**Date:** [Date] | **Duration:** [X hours] | **Severity:** SEV[X]
**Authors:** [Names] | **Status:** Draft

### Summary
[2-3 sentence plain-language summary]

### Impact
- [Users affected]
- [Duration of impact]
- [Business impact if quantifiable]

### Timeline
| Time (UTC) | Event |
|------------|-------|
| [HH:MM] | [Event] |

### Root Cause
[Detailed explanation of what caused the incident]

### 5 Whys
1. Why did [symptom]? → [Because...]
2. Why did [cause 1]? → [Because...]
3. Why did [cause 2]? → [Because...]
4. Why did [cause 3]? → [Because...]
5. Why did [cause 4]? → [Root cause]

### What Went Well
- [Things that worked]

### What Went Poorly
- [Things that didn't work]

### Action Items
| Action | Owner | Priority | Due Date |
|--------|-------|----------|----------|
| [Action] | [Person] | P0/P1/P2 | [Date] |

### Lessons Learned
[Key takeaways for the team]

If Connectors Available

If ~~monitoring is connected:

Pull alert details and metrics
Show graphs of affected metrics

If ~~incident management is connected:

Create or update incident in PagerDuty/Opsgenie
Page on-call responders

If ~~chat is connected:

Post status updates to incident channel
Create war room channel

Tips

Start writing immediately — Don't wait for complete information. Update as you learn more.
Keep updates factual — What we know, what we've done, what's next. No speculation.
Postmortems are blameless — Focus on systems and processes, not individuals.

Zeplik output presentation

Present the final deliverable as a single polished artifact: clear headings, tables where the content is tabular, fenced code where it is code. Lead with the deliverable itself; keep process commentary to a single short line. If the skill produced multiple files or sections, end with a compact list of them with one-line purposes.

How to use the Incident Response skill

Sign in to Zeplik
Create a free Zeplik account or sign in. New accounts start with free credits, so you can try the Incident Response skill right away.
Describe your software development task
Ask in plain language, or type /incident-response to invoke the skill directly. Zeplik recognizes the Incident Response skill and applies its method.
Review and refine the result
Zeplik returns a clear, structured answer. Ask follow-ups in the same chat to refine it or take the next step.

Source and credit

Author: Anthropic
License: Apache-2.0

Adapted from the open-source anthropics/knowledge-work-plugins project and tuned to run natively on Zeplik. View source on GitHub.

Frequently asked questions

What is the Incident Response skill?: Incident Response is a ready-to-run software development skill on Zeplik. Not for routine debugging of a failing test (use systematic-debugging). Ask in plain language and Zeplik applies the skill's method for you inside the conversation, on whichever AI model you prefer.
How do I use Incident Response on Zeplik?: Sign in to Zeplik and ask in plain language, or type /incident-response in any chat to invoke it directly. The skill applies its method and returns a result you can refine in the same conversation.
Which AI model does the Incident Response skill use?: Any model you choose. Zeplik works across every model in one chat, so the Incident Response skill runs on your preferred model for the task.
Where does the Incident Response skill come from?: The Incident Response skill is adapted from the open-source anthropics/knowledge-work-plugins project (Apache-2.0) and tuned to run natively on Zeplik. The original source is linked on this page.
How much does the Incident Response skill cost?: Using the skill is free to start. You only spend Zeplik credits when the assistant runs, and new accounts begin with free credits.

Related software development skills

More on Zeplik

Try Incident Response on Zeplik

Every model, one chat. Bring the Incident Response skill into your next conversation and let the assistant do the work.

Browse all skills