Incident Summary Writer

incident-summary-writer

Purpose: Convert messy on-call notes into a clean, timeline-based incident summary with root cause, impact, and action items. No hedging, no vague attribution.

Input Schema

| Field | Type | Required | |---|---|---| | incident_id | string | yes | | timeline_notes | string | yes - raw notes with timestamps | | severity | string | yes - SEV1/SEV2/SEV3 | | affected_systems | string[] | yes | | root_cause | string | yes | | action_items | string[] | yes | | preserve_facts | string[] | yes |

{
  "incident_id": "INC-2024-0314",
  "timeline_notes": "9:41pm pages fired. checked logs. 11:23pm resolved. load balancer config was wrong after the deploy",
  "severity": "SEV2",
  "affected_systems": ["checkout", "payments-api"],
  "root_cause": "Misconfigured load balancer after 11pm deploy",
  "action_items": ["Add LB config validation to deploy checklist", "Lower alert threshold to p95 > 500ms"],
  "preserve_facts": ["INC-2024-0314", "9:41 PM", "11:23 PM", "4,300 timed-out requests"]
}

Output Schema

{
  "title": "INC-2024-0314 - SEV2 - Checkout outage (March 14)",
  "summary": "...",
  "timeline": [{"time": "9:41 PM", "event": "..."}, ...],
  "root_cause": "...",
  "impact": "...",
  "action_items": [{"owner": "TBD", "item": "...", "due": "TBD"}]
}

Prompt Flow

Pass 1: Structure into title, summary, timeline, root cause, impact, action items. Remove: significance inflation (P1), promotional adjectives (P4), weasel words (P5), AI vocab (P7), knowledge-cutoff disclaimers (P20), filler (P22), excessive hedging (P23).

Pass 2: "What sounds like AI-generated filler in this report?" -> final clean rewrite.

Examples

Short

Before: "We experienced some technical difficulties that may have potentially caused issues for certain users." After: "Checkout returned 502s for 4,300 requests between 9:41 PM and 11:23 PM PT on March 14."

Medium (summary)

Before: "The incident marks a pivotal moment in our infrastructure journey, underscoring the vital importance of robust configuration management going forward." After: "Root cause: a load balancer config pushed at 11 PM set the health check timeout to 1ms instead of 500ms. Every backend instance failed health checks and was removed from the pool."

Long (full report)

Unit Tests

# tests/skills/test_incident_summary_writer.py
from ai_pattern_scrubber import detect_patterns

SUMMARY = "Checkout returned 502s for 4,300 requests between 9:41 PM and 11:23 PM PT on March 14."
ROOT_CAUSE = "Root cause: a load balancer config pushed at 11 PM set the health check timeout to 1ms instead of 500ms."

def test_summary_no_hedging():
    assert not [h for h in detect_patterns(SUMMARY) if h.id == 23]

def test_root_cause_no_weasel_words():
    assert not [h for h in detect_patterns(ROOT_CAUSE) if h.id == 5]

def test_summary_no_high_severity():
    assert not [h for h in detect_patterns(SUMMARY) if h.severity == "high"]

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: nicholashidalgo
• Source: nicholashidalgo/claude-skillforge
• License: MIT

Install and usage instructions live in the source repository linked above.