Crisis Handler

Input: $ARGUMENTS

Interpretations

Before executing, identify which interpretation matches the user’s input:

Interpretation 1 — Active crisis response: The user is in the middle of a crisis right now and needs immediate structured triage — stabilize, diagnose, communicate, resolve. Interpretation 2 — Crisis post-mortem: The crisis has already been resolved, and the user wants to systematically analyze what happened, why, and how to prevent recurrence. Interpretation 3 — Crisis preparedness: No crisis is happening yet, but the user wants to build a crisis response plan for a specific type of disruption they anticipate or fear.

If ambiguous, ask: “I can help with handling an active crisis right now, analyzing a past crisis, or preparing for a future one — which fits?” If clear from context, proceed with the matching interpretation.

Overview

Crises demand a different mode than normal work. Structured triage: stabilize, understand, communicate, resolve, learn. Speed matters but panic makes things worse.

Step 0: Severity Assessment

Factor	Options	Implication
Impact scope	Individual / team / org / public	Communication breadth
Reversibility	Reversible / partial / irreversible	Action urgency
Time pressure	Minutes / hours / days	Triage depth
Escalation risk	Stable / growing / cascading	Containment priority

CRITICAL (irreversible + cascading + minutes): Skip to Step 2 NOW
HIGH (significant + growing): Steps 1-6 rapid
MODERATE (contained + hours): Steps 1-6 standard
LOW (manageable + days): May not need crisis procedure

Steps

Step 1: Situational Awareness (2 min max)

What happened? (facts only)
What is currently happening? (ongoing?)
Who/what is affected?
What’s been tried?
What resources are available now?

Step 2: Stabilize / Contain

What prevents further damage RIGHT NOW?
Execute minimum viable containment: isolate, activate fallbacks, restrict access
Verify containment worked
If fails → escalate immediately

Step 3: Communicate

Who needs to know right now? (key stakeholders only)
Communicate: what happened, current status, what’s being done, when next update
Do NOT communicate: speculation, blame, time promises
Set cadence (every N minutes/hours)

Step 4: Diagnose

What changed before the crisis?
What does evidence point to?
→ INVOKE: /rca [crisis] if time allows
If cause clear → fix. If not → rapid 5-Whys.

Step 5: Resolve

Design the fix (not a patch)
Assess fix risk: could it make things worse?
High risk → test in isolation, prepare rollback
Implement and verify (original problem resolved, no new problems)

Step 6: Stand Down and Debrief

Confirm fully resolved
Remove temporary measures (or document why they stay)
Communicate resolution to all stakeholders
Schedule post-mortem within 48 hours
→ INVOKE: /aar [crisis summary]

Anti-Patterns

Panic-driven action without understanding
Hero mode (one person handling everything)
Blame focus instead of fixing
Premature all-clear before verification
No debrief (crisis resolved but nothing learned)

When to Use

System outages, security incidents, PR crises, project derailments
Any disruption requiring immediate action

`ch - Crisis Handler`