Agent skill

Incident Postmortem

by oxbshw in oxbshw/LLM-Agents-Ecosystem-Handbook

Use after an incident is resolved — drafts a blameless postmortem from timeline notes, alerts, and chat threads.

MITAuto-check passedDevOps & Cloud

Install Incident Postmortem

skills CLI
$ npx skills add oxbshw/LLM-Agents-Ecosystem-Handbook --skill incident-postmortem -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install oxbshw/LLM-Agents-Ecosystem-Handbook incident-postmortem --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/oxbshw/LLM-Agents-Ecosystem-Handbook.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/catalog/incident-postmortem .claude/skills/incident-postmortem && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
incident-postmortem
GitHub stars
552
Token cost
~461 tokens
SKILL.md length
208 words
Files
2 (incl. references)
Skills in repo
6
Repo updated
First seen
Licence
MIT

At a glance

Use after an incident is resolved — drafts a blameless postmortem from timeline notes, alerts, and chat threads.

  • Works in 7 steps: Reconstruct the timeline (UTC), one row… → State impact in user-facing terms… → Identify the direct cause in one… → …
  • Tasks that involve Runbooks and postmortems
  • SKILL.md covers When to use, When NOT to use, Inputs and Outputs, plus 4 more sections
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Incident Postmortem is an agent skill from oxbshw/LLM-Agents-Ecosystem-Handbook. Use after an incident is resolved — drafts a blameless postmortem from timeline notes, alerts, and chat threads.

Its SKILL.md is about 460 tokens, which your agent loads only when the skill is triggered. The skill folder holds 2 other files, including reference files (for example `references/postmortem-template.md`).

It sits in DevOps & Cloud, covering Runbooks and postmortems. The repository describes itself as: One-stop handbook for building, deploying, and understanding LLM agents with 60+ skeletons, tutorials, ecosystem guides, and evaluation tools. The licence is MIT.

When your agent uses it

  • Tasks that involve Runbooks and postmortems

Example prompts

  • “/incident-postmortem”

Workflow steps

7 steps, taken from the first numbered list in SKILL.md.

  1. Reconstruct the timeline (UTC), one row per notable event
  2. State impact in user-facing terms (requests failed, dollars lost, customers affected)
  3. Identify the direct cause in one sentence — what specifically broke
  4. List contributing factors (the conditions that made the incident possible / hard to mitigate)
  5. Separate what went well (genuine wins, not platitudes) and what didn't
  6. Owners + dates on every action item; hard fail if missing
  7. Tone: blameless. Describe systems failing, not people.

What it can do on your machine

Read from SKILL.md and the folder at commit 7f8ee3c. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Incident Postmortem loads about 461 tokens when it runs, and up to ~636 if it reads all its reference files. Until then it costs about 33 tokens; SKILL.md has 208 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~33
When it runs · the whole SKILL.md, loaded when a task matches
~461
With references · SKILL.md plus every file in references/, read only if the agent opens them
~636

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from oxbshw/LLM-Agents-Ecosystem-Handbook at commit 7f8ee3c, republished under its MIT licence (© oxbshw). 208 words, ~461 tokens.

Download SKILL.mdSave it as .claude/skills/incident-postmortem/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.
name
incident-postmortem
description
Use after an incident is resolved — drafts a blameless postmortem from timeline notes, alerts, and chat threads.
version
0.1.0
status
experimental
risk
low
tags
ops, writes-files

Incident Postmortem

When to use

  • After an incident with customer impact
  • After a near-miss worth documenting
  • For drills / GameDay exercises

When NOT to use

  • Live incidents (use incident-runbook instead)
  • Pure private learnings (use a personal log)

Inputs

NameTypeRequiredNotes
timelinetext or pathsyesSource notes, alert links, chat extracts
severityS0–S3yesSeverity at peak
incident_idstringyese.g. INC-2026-04-12-001

Outputs

postmortem.md with: Summary, Impact, Timeline, Direct cause, Contributing factors, What went well, What didn't, Action items.

Workflow

  1. Reconstruct the timeline (UTC), one row per notable event
  2. State impact in user-facing terms (requests failed, dollars lost, customers affected)
  3. Identify the direct cause in one sentence — what specifically broke
  4. List contributing factors (the conditions that made the incident possible / hard to mitigate)
  5. Separate what went well (genuine wins, not platitudes) and what didn't
  6. Owners + dates on every action item; hard fail if missing
  7. Tone: blameless. Describe systems failing, not people.

References

Success criteria

  • Every action item has an owner and a date
  • Direct cause is one sentence
  • No names attached to fault; only roles / systems
  • Timeline times in UTC

Failure modes

  • Missing source data → list gaps explicitly; don't fill with guesses
  • Conflicting timelines → record both, flag for review

© oxbshw, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 1 other file (references) in skills/catalog/incident-postmortem of oxbshw/LLM-Agents-Ecosystem-Handbook.

  • SKILL.md
  • references/postmortem-template.md

Open the folder on GitHubat commit 7f8ee3c

Compare with similar skills

Incident Postmortem next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Incident Postmortem compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Incident Postmortem this skilloxbshw/LLM-Agents-Ecosystem-Handbook552—~461Automated safety check: PassMIT
Trader Memory Coretradermonty/claude-trading-skills3k3 repos~4.3kAutomated safety check: PassMIT
OpenRig Upgrade Proceduremvschwarz/openrig5.9k1 repos~2.9kAutomated safety check: PassApache-2.0
Author Migrationnrwl/nx29k—~12kAutomated safety check: NotesMIT
Write Notes Like Deepseekczm15053/write-notes-like-deepseek484—~2kAutomated safety check: PassNone
GreptimeDB Release RunbookGreptimeTeam/greptimedb6.7k—~1.4kAutomated safety check: PassApache-2.0

Similar skills

  • Trader Memory Core

    tradermonty/claude-trading-skills

    Track investment theses across their lifecycle — from screening idea to closed position with postmortem.

    3k GitHub starsUsed in 3 repos~4.3k tokens
    DevOps & CloudAuto-check passed
  • OpenRig Upgrade Procedure

    mvschwarz/openrig

    Walks an agent through upgrading the OpenRig CLI and daemon one observed step at a time, keeping live seats alive and reconciling managed plugin files.

    5.9k GitHub starsUsed in 1 repo~2.9k tokens
    DevOps & CloudAuto-check passed
  • Author or scope a first-party Nx migration. An agent skill from nrwl/nx.

    29k GitHub stars~12k tokensUpdated today
    DevOps & CloudAuto-check: notes
  • Write Notes Like Deepseek

    czm15053/write-notes-like-deepseek

    A skill your agent uses when a change is non-trivial by DSH standards (behavior, architecture, cross-file contracts, process/tooling, testing strategy, or on-disk/wire/config formats), when choosing…

    484 GitHub stars~2k tokensUpdated yesterday
    DevOps & CloudAuto-check passed
  • GreptimeDB Release Runbook

    GreptimeTeam/greptimedb

    Runbook for publishing a GreptimeDB version: pick the release branch, verify the Cargo version, then tag, create the GitHub release and open the docs note PR.

    6.7k GitHub stars~1.4k tokensUpdated today
    DevOps & CloudAuto-check passed
  • Statem

    henryqin1997/statem

    A skill your agent uses when a long coding or research task should be managed with statem state-machine runbooks, including creating specs, starting or resuming runs, checking current state…

    1.3k GitHub stars~1.2k tokensUpdated 1 mo ago
    DevOps & CloudAuto-check passed

More from oxbshw/LLM-Agents-Ecosystem-Handbook

  • API Design Reviewer

    oxbshw/LLM-Agents-Ecosystem-Handbook

    A skill your agent uses when reviewing a proposed REST or GraphQL API change before merge — checks contract clarity, backwards compatibility, errors, pagination, auth, and naming.

    552 GitHub stars~553 tokensUpdated 3 mo ago
    Auto-check passed
  • Dataset Profiler

    oxbshw/LLM-Agents-Ecosystem-Handbook

    A skill your agent uses when first encountering a new dataset — produces a structured profile (schema, missingness, distributions, outliers, gotchas) before any analysis.

    552 GitHub stars~492 tokensUpdated 3 mo ago
    Auto-check passed
  • PR Summarizer

    oxbshw/LLM-Agents-Ecosystem-Handbook

    A skill your agent uses when opening a PR — produces a clean PR description (what / why / how to verify / risks) from a branch diff against base.

    552 GitHub stars~441 tokensUpdated 3 mo ago
    Auto-check: notes
  • Adr Writer

    oxbshw/LLM-Agents-Ecosystem-Handbook

    A skill your agent uses when capturing an architecture decision so it survives turnover — produces an ADR-NNNN.md from context, options considered, and the chosen path.

    552 GitHub stars~476 tokensUpdated 3 mo ago
    Auto-check passed
  • Sprint Planner

    oxbshw/LLM-Agents-Ecosystem-Handbook

    A skill your agent uses when planning the next sprint — turns ticket intake + team capacity into a planned sprint with explicit non-goals.

    552 GitHub stars~429 tokensUpdated 3 mo ago
    Auto-check passed

Categories

Questions about Incident Postmortem

What does Incident Postmortem do?

Use after an incident is resolved — drafts a blameless postmortem from timeline notes, alerts, and chat threads. Incident Postmortem is an agent skill from oxbshw/LLM-Agents-Ecosystem-Handbook. Use after an incident is resolved — drafts a blameless postmortem from timeline notes, alerts, and chat threads.

When should I use Incident Postmortem?

Incident Postmortem fits situations like: tasks that involve Runbooks and postmortems.

How do I install Incident Postmortem in Claude Code?

Run `npx skills add oxbshw/LLM-Agents-Ecosystem-Handbook --skill incident-postmortem -a claude-code`. Or copy the skill folder (skills/catalog/incident-postmortem in oxbshw/LLM-Agents-Ecosystem-Handbook) into .claude/skills/incident-postmortem in your project. Claude Code loads it when a task matches its description.

How do I install Incident Postmortem in Codex?

Run `npx skills add oxbshw/LLM-Agents-Ecosystem-Handbook --skill incident-postmortem -a codex`. Or copy the skill folder (skills/catalog/incident-postmortem in oxbshw/LLM-Agents-Ecosystem-Handbook) into .agents/skills/incident-postmortem in your project. Codex loads it when a task matches its description.

Can I use Incident Postmortem in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add oxbshw/LLM-Agents-Ecosystem-Handbook --skill incident-postmortem -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/incident-postmortem, .gemini/skills/incident-postmortem, .github/skills/incident-postmortem and .opencode/skills/incident-postmortem in your project.

What does Incident Postmortem need to run?

SKILL.md names no scripts, command-line tools or credentials: Incident Postmortem is instructions for the agent only.

Does Incident Postmortem access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Incident Postmortem safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Incident Postmortem use?

Incident Postmortem is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Incident Postmortem use?

About 461 tokens (SKILL.md is roughly 1.8k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 175 tokens, read only when the agent opens those files.

What are the alternatives to Incident Postmortem?

Skills that share tags, products or a category with Incident Postmortem: Trader Memory Core (tradermonty/claude-trading-skills, 3k stars), OpenRig Upgrade Procedure (mvschwarz/openrig, 5.9k stars), Author Migration (nrwl/nx, 29k stars) and Write Notes Like Deepseek (czm15053/write-notes-like-deepseek, 484 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Incident Postmortem?

oxbshw (a GitHub user) maintains it in oxbshw/LLM-Agents-Ecosystem-Handbook, which has 552 GitHub stars. The repository holds 6 skills in this directory. The repository was last updated on June 30, 2026.

Source: oxbshw/LLM-Agents-Ecosystem-Handbook on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.