New: 97,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Official agent skill

Incident Postmortem

by github in github/awesome-copilot

A skill your agent uses when an outage, production incident, or significant service degradation has occurred and the team needs to write a structured blameless post-mortem.

OfficialMITAuto-check passedDevOps & Cloud

Install Incident Postmortem

skills CLI
$ npx skills add github/awesome-copilot --skill incident-postmortem -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install github/awesome-copilot incident-postmortem --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/github/awesome-copilot.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/incident-postmortem .claude/skills/incident-postmortem && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
incident-postmortem
GitHub stars
40k
Token cost
~1.8k tokens
SKILL.md length
650 words
Files
1
Skills in repo
417
Repo updated
First seen
Licence
MIT

At a glance

A skill your agent uses when an outage, production incident, or significant service degradation has occurred and the team needs to write a structured blameless post-mortem.

  • Works in 6 steps: Gather Metadata → Reconstruct Timeline → Root Cause Analysis → …
  • Production incident
  • SKILL.md covers Blameless Principle, When to Use, Input Requirements and Process, plus 2 more sections
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Incident Postmortem is an agent skill from github/awesome-copilot, published by the product's own GitHub organization. Use when an outage, production incident, or significant service degradation has occurred and the team needs to write a structured blameless post-mortem. Triggers on phrases like "write a post-mortem", "incident review", "what went wrong", "outage report", "root cause analysis", or "RCA". Covers timeline reconstruction, contributing factor analysis, impact quantification, and action item generation with owners.

Its SKILL.md is about 1.8k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in DevOps & Cloud, covering Runbooks and postmortems, Incident response and Root cause analysis. The repository describes itself as: Community-contributed instructions, agents, skills, and configurations to help you make the most of GitHub Copilot. The licence is MIT.

When your agent uses it

  • Production incident
  • Significant service degradation has occurred and the team needs to write a structured blameless post-mortem
  • Phrases like write a post-mortem
  • Incident review

Example prompts

  • “write a post-mortem”
  • “incident review”
  • “what went wrong”
  • “/incident-postmortem”

Workflow steps

6 steps, taken from the step headings in SKILL.md.

  1. Gather Metadata
  2. Reconstruct Timeline
  3. Root Cause Analysis
  4. Impact Quantification
  5. Action Items
  6. Write the Document

What it can do on your machine

Read from SKILL.md and the folder at commit 727ff2e. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md (its code samples are markdown).

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Incident Postmortem loads about 1.8k tokens when it runs. Until then it costs about 108 tokens; SKILL.md has 650 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~108
When it runs · the whole SKILL.md, loaded when a task matches
~1.8k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from github/awesome-copilot at commit 727ff2e, republished under its MIT licence (© github). 650 words, ~1,823 tokens.

Download SKILL.mdSave it as .claude/skills/incident-postmortem/SKILL.md (or your agent's skills folder).
name
incident-postmortem
description
Use when an outage, production incident, or significant service degradation has occurred and the team needs to write a structured blameless post-mortem. Triggers on phrases like "write a post-mortem", "incident review", "what went wrong", "outage report", "root cause analysis", or "RCA". Covers timeline reconstruction, contributing factor analysis, impact quantification, and action item generation with owners.

Incident Post-Mortem

Guide a team through writing a structured, blameless post-mortem after a production incident. The output is a document that builds shared understanding, identifies root causes without blame, and produces concrete action items to prevent recurrence.

Blameless Principle

Systems fail, not people. The goal is to understand HOW the incident happened — not WHO caused it. Avoid language like "X forgot to", "Y should have known". Use "the system did not", "the process lacked", "the alert did not fire".

When to Use

  • Production outage or service degradation has been resolved
  • A significant near-miss occurred (would have been an incident if caught later)
  • User-facing errors, data loss, or SLA breach happened
  • Team wants to capture learnings before context fades

Not for: Minor bugs caught in staging, planned maintenance windows, or incidents with no learning value.

Input Requirements

Gather these details before writing the post-mortem. Ask for anything missing:

Incident Metadata
  • Incident title (short, descriptive)
  • Date and time of detection (with timezone)
  • Date and time of resolution
  • Severity / impact level (P1–P4 or equivalent)
  • Incident commander / on-call owner
Impact
  • Affected services and systems
  • User-facing impact (errors, slowness, full outage)
  • Estimated number of users affected
  • Data loss or corruption (yes/no, scope)
  • SLA/SLO breach (yes/no, by how much)
Timeline Events

Key moments to reconstruct:

  • First symptom occurred
  • Alert fired (or was noticed manually)
  • On-call paged / incident declared
  • Investigation started
  • Root cause identified
  • Mitigation applied
  • Full resolution confirmed
  • Customer communication sent (if any)
Contributing Factors

Ask the team: "What made this worse than it needed to be?" — not "who failed". Examples:

  • Alert threshold too high / alert didn't fire
  • Runbook was missing or outdated
  • Deploy lacked a feature flag for rollback
  • Monitoring didn't cover this failure mode
  • On-call handoff missed context

Process

Step 1 — Gather Metadata

If the user has not provided full incident details, ask for them section by section. Don't proceed to writing until you have: title, times, severity, affected services, and at least a rough timeline.

Step 2 — Reconstruct Timeline

Work with the user to build a precise chronological timeline. For each event:

  • Exact time (UTC preferred)
  • What happened (system event or human action)
  • Who observed it or took the action
  • Link to log / alert / Slack message if available

Flag gaps: "We don't know what happened between 14:32 and 14:47 — worth checking logs."

Show full SKILL.md (271 more words)Show less
Step 3 — Root Cause Analysis

Use the 5 Whys iteratively:

Why did users see 500 errors?
→ The API pods were crash-looping.

Why were they crash-looping?
→ Memory limit was exceeded.

Why was the limit exceeded?
→ A new query was loading full result sets into memory.

Why wasn't this caught before deploy?
→ Load tests only covered the p50 case, not high-cardinality accounts.

Why did load tests only cover p50?
→ We had no test fixtures for large accounts.

Stop when you reach a system/process gap you can fix. The last "why" should point to an action item.

Distinguish:

  • Root cause — the deepest systemic gap (one or two)
  • Contributing factors — conditions that made it worse but aren't the root cause
Step 4 — Impact Quantification

Help the user be precise:

  • Duration: detection to resolution (not symptom start to resolution — separate these)
  • Error rate at peak vs. normal baseline
  • Percentage of traffic affected
  • Revenue / business impact if known
Step 5 — Action Items

For each root cause and contributing factor, generate at least one action item:

#ActionOwnerDue DatePriority
1Add load test fixtures for accounts > 10k records@eng-team2026-07-01High
2Lower memory alert threshold from 90% to 75%@platform2026-06-23High
3Add runbook for memory OOM pods@on-call-rotation2026-06-30Medium

Action items must have an owner (a person, not a team) and a due date. Vague actions like "improve monitoring" are not acceptable — break them into specific deliverables.

Step 6 — Write the Document

Produce the full post-mortem using the template below. Save to docs/postmortems/YYYY-MM-DD-<slug>.md.

Output Template

markdown
# Post-Mortem: [Incident Title]

**Date:** YYYY-MM-DD  
**Severity:** P[1-4]  
**Duration:** X hours Y minutes (HH:MM UTC – HH:MM UTC)  
**Incident Commander:** @name  
**Status:** Resolved

---

## Summary

[2–3 sentences. What happened, what was the user impact, how was it resolved. Written for someone who wasn't involved.]

## Impact

| Dimension | Value |
|-----------|-------|
| Affected services | [list] |
| User-facing impact | [errors / degraded / full outage] |
| Users affected | [estimated number or %] |
| Peak error rate | [X% vs Y% baseline] |
| Data loss | [none / describe scope] |
| SLA breach | [yes/no — by how much] |

## Timeline

All times UTC.

| Time | Event |
|------|-------|
| HH:MM | [First symptom / alert fired] |
| HH:MM | [On-call paged] |
| HH:MM | [Incident declared] |
| HH:MM | [Root cause identified] |
| HH:MM | [Mitigation applied] |
| HH:MM | [Full resolution confirmed] |
| HH:MM | [Customer communication sent] |

## Root Cause

[1–2 paragraphs. The deepest systemic gap that, if fixed, would have prevented the incident. Written in blameless language. Reference the 5 Whys chain if helpful.]

## Contributing Factors

- [Factor 1 — condition that made the incident worse]
- [Factor 2]
- [Factor 3]

## What Went Well

- [Thing that worked — good alert, fast response, clear runbook]
- [Another positive]

## What Could Have Gone Better

- [Gap in process, tooling, or coverage — no blame language]
- [Another gap]

## Action Items

| # | Action | Owner | Due Date | Priority |
|---|--------|-------|----------|----------|
| 1 | [Specific deliverable] | @person | YYYY-MM-DD | High/Medium/Low |
| 2 | | | | |

## Lessons Learned

[Optional. 2–4 bullet points capturing non-obvious insights worth sharing with the broader team.]

Common Mistakes

MistakeFix
"Bob forgot to check the config""The deploy checklist did not include config validation"
Root cause is "human error"Keep asking Why — human error is always a symptom
Action items without ownersEvery item needs a named individual, not a team
Timeline reconstructed from memoryCheck logs, alerts, Slack, PagerDuty before writing
"Improve monitoring" as an actionSpecify: which service, which metric, what threshold, by when
Post-mortem written weeks laterWrite within 48–72 hours while context is fresh

© github, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in skills/incident-postmortem of github/awesome-copilot.

Open the folder on GitHubat commit 727ff2e

Compare with similar skills

Incident Postmortem next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Incident Postmortem compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Incident Postmortem this skillgithub/awesome-copilot40k—~1.8kAutomated safety check: PassMIT
Post-Incident DebriefVeryGoodOpenSource/vgv-wingspan108—~1.9kAutomated safety check: PassMIT
Conducting Post Incident Lessons Learnedmukul975/Anthropic-Cybersecurity-Skills34k—~1.7kAutomated safety check: PassApache-2.0
Incident Postmortemrevfactory/harness-1001.3k—~1.8kAutomated safety check: PassApache-2.0
Incident Response Patternsvibeeval/vibecosystem531—~709Automated safety check: PassMIT
Debug Production IssueFerroxLabs/wayland608—~3.8kAutomated safety check: PassApache-2.0

Similar skills

  • Post-Incident Debrief

    VeryGoodOpenSource/vgv-wingspan

    Produces a blameless post-incident debrief with timeline, root cause and follow-up actions after an outage, failed release or significant bug, while details are fresh.

    108 GitHub stars~1.9k tokensUpdated 7 days ago
    DevOps & CloudAuto-check passed

  • Conducting Post Incident Lessons Learned

    mukul975/Anthropic-Cybersecurity-Skills

    Facilitate structured post-incident reviews to identify root causes, document what worked and failed, and produce actionable recommendations to improve future incident response.

    34k GitHub stars~1.7k tokensUpdated 1 mo ago
    DevOps & CloudAuto-check passed

  • Incident Postmortem

    revfactory/harness-100

    A full pipeline where an agent team collaborates to generate incident postmortem reports.

    1.3k GitHub stars~1.8k tokensUpdated 6 mo ago
    DevOps & CloudAuto-check passed

  • Incident Response Patterns

    vibeeval/vibecosystem

    Incident severity classification, runbook templates, root cause analysis, and post-incident review

    531 GitHub stars~709 tokensUpdated 1 mo ago
    DevOps & CloudAuto-check passed

  • Debug Production Issue

    FerroxLabs/wayland

    Orchestrates systematic production debugging from alert through root cause identification and resolution, chaining four engineering skills into a structured diagnostic pipeline.

    608 GitHub stars~3.8k tokensUpdated yesterday
    DevOps & CloudAuto-check passed

  • Incident Response Lifecycle

    LeoYeAI/openclaw-master-skills

    Incident response process management following the NIST 800-61 lifecycle.

    2.2k GitHub stars~5k tokensUpdated 2 mo ago
    DevOps & CloudAuto-check passed

More from github/awesome-copilot

All 417 skills in this repo

  • Acquire Codebase Knowledge

    github/awesome-copilot

    Official

    Maps an unfamiliar codebase into seven evidence-backed documents in docs/codebase/, using a scan script and templates, for onboarding or architecture write-ups.

    40k GitHub starsUsed in 1 repo~2.3k tokens
    Auto-check passed

  • Azure Architecture Autopilot

    github/awesome-copilot

    Official

    Designs Azure infrastructure from a natural-language description, or diagrams an existing resource group, then refines the design through conversation and deploys it with Bicep.

    40k GitHub starsUsed in 1 repo~1.9k tokens
    Auto-check passed

  • Draw.io Diagram Generator

    github/awesome-copilot

    Official

    Generates, edits and validates draw.io files with correct mxGraph XML, covering flowcharts, architecture, sequence, ER and UML class diagrams.

    40k GitHub starsUsed in 1 repo~4.9k tokens
    Auto-check passed

  • Credit Risk Data Cleaning

    github/awesome-copilot

    Official

    Cleans raw credit data and screens variables before loan modeling, dropping unstable, noisy or redundant features and writing an Excel report of every step.

    40k GitHub starsUsed in 1 repo~1.5k tokens
    Auto-check passed

  • Daily Focus Board

    github/awesome-copilot

    Official

    Builds a warm, browser-based daily focus board the user updates by talking to their agent, with Eisenhower priorities, a brain-dump box and kind not-today carryover.

    40k GitHub stars~3k tokensUpdated today
    Auto-check passed

  • Python Pypi Package Builder

    github/awesome-copilot

    Official

    End-to-end skill for building, testing, linting, versioning, and publishing a production-grade Python library to PyPI.

    40k GitHub starsUsed in 1 repo~4.6k tokens
    Auto-check passed

Categories

Questions about Incident Postmortem

What does Incident Postmortem do?

A skill your agent uses when an outage, production incident, or significant service degradation has occurred and the team needs to write a structured blameless post-mortem. Incident Postmortem is an agent skill from github/awesome-copilot, published by the product's own GitHub organization. Use when an outage, production incident, or significant service degradation has occurred and the team needs to write a structured blameless post-mortem.

When should I use Incident Postmortem?

Incident Postmortem fits situations like: production incident; significant service degradation has occurred and the team needs to write a structured blameless post-mortem; phrases like write a post-mortem; incident review.

How do I install Incident Postmortem in Claude Code?

Run `npx skills add github/awesome-copilot --skill incident-postmortem -a claude-code`. Or copy the skill folder (skills/incident-postmortem in github/awesome-copilot) into .claude/skills/incident-postmortem in your project. Claude Code loads it when a task matches its description.

How do I install Incident Postmortem in Codex?

Run `npx skills add github/awesome-copilot --skill incident-postmortem -a codex`. Or copy the skill folder (skills/incident-postmortem in github/awesome-copilot) into .agents/skills/incident-postmortem in your project. Codex loads it when a task matches its description.

Can I use Incident Postmortem in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add github/awesome-copilot --skill incident-postmortem -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/incident-postmortem, .gemini/skills/incident-postmortem, .github/skills/incident-postmortem and .opencode/skills/incident-postmortem in your project.

What does Incident Postmortem need to run?

SKILL.md names no scripts, command-line tools or credentials: Incident Postmortem is instructions for the agent only.

Does Incident Postmortem access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Incident Postmortem safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Incident Postmortem use?

Incident Postmortem is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Incident Postmortem use?

About 1.8k tokens (SKILL.md is roughly 7.3k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Incident Postmortem?

Skills that share tags, products or a category with Incident Postmortem: Post-Incident Debrief (VeryGoodOpenSource/vgv-wingspan, 108 stars), Conducting Post Incident Lessons Learned (mukul975/Anthropic-Cybersecurity-Skills, 34k stars), Incident Postmortem (revfactory/harness-100, 1.3k stars) and Incident Response Patterns (vibeeval/vibecosystem, 531 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Incident Postmortem?

github (a GitHub organization, an official publisher) maintains it in github/awesome-copilot, which has 39,748 GitHub stars. The repository holds 417 skills in this directory. The repository was last updated on October 7, 2026.

Source: github/awesome-copilot on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.