Agent skill · writing content · github
incident-postmortem
Use when an outage, production incident, or significant service degradation has occurred and the team needs to write a structured blameless post-mortem. Triggers on phrases like "write a post-mortem", "incident review", "what went wrong", "outage report", "root cause analysis", or "RCA". Covers timeline reconstruction, contributing factor analysis, impact quantification, and action item generation with owners.
Why this skill is useful
Provides a structured framework for conducting blameless post-mortems that the AI wouldn't reliably generate on its own.
What it needs
About 5k tokens when loaded. Last updated 2026-08-07. 37,534 stars on the source repository.
What this skill does
Incident Post-Mortem Guide a team through writing a structured, blameless post-mortem after a production incident. The output is a document that builds shared understanding, identifies root causes without blame, and produces concrete action items to prevent recurrence. Blameless Principle Systems fail, not people. The goal is to understand HOW the incident happened — not WHO caused it. Avoid language like "X forgot to", "Y should have known". Use "the system did not", "the process lacked", "the alert did not fire". When to Use Production outage or service degradation has been resolved A significant near-miss occurred (would have been an incident if caught later) User-facing errors, data loss, or SLA breach happened Team wants to capture learnings before context fades Not for: Minor bugs caught in staging, planned maintenance windows, or incidents with no learning value. Input Requirements Gather these details before writing the post-mortem. Ask for anything missing: Incident Metadata Incident title (short, descriptive) Date and time of detection (with timezone) Date and time of resolution Severity / impact level (P1–P4 or equivalent) Incident commander / on-call owner Impact Affected services and systems User-facing impact (errors, slowness, full outage) Estimated number of users affected Data loss or corruption (yes/no, scope) SLA/SLO breach (yes/no, by how much) Timeline Events Key moments to reconstruct: First symptom occurred Alert fired (or was noticed manually) On-call paged / incident declared Investigation started Root cause identified Mitigation applied Full resolution confirmed Customer communication sent (if any) Contributing Factors Ask the team: "What made this worse than it needed to be?" — not "who failed". …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills github/incident-postmortem