New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

After Action Report

by rampstackco in rampstackco/claude-skills

Run a structured after-action review (postmortem, retrospective) on a launch, incident, or completed project to capture timeline, root cause analysis, contributing factors, and actionable lessons.

MITAuto-check passedProduct & Project Management

Install After Action Report

skills CLI
$ npx skills add rampstackco/claude-skills --skill after-action-report -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install rampstackco/claude-skills after-action-report --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/rampstackco/claude-skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/after-action-report .claude/skills/after-action-report && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
after-action-report
GitHub stars
940
Used in
1 other repo
Token cost
~2.5k tokens
SKILL.md length
1,185 words
Files
3 (incl. references)
Skills in repo
103
Repo updated
First seen
Licence
MIT

At a glance

Run a structured after-action review (postmortem, retrospective) on a launch, incident, or completed project to capture timeline, root cause analysis, contributing factors, and actionable lessons.

  • Works in 12 steps: Summary → Timeline → Root cause analysis → …
  • The user wants to run a postmortem
  • SKILL.md covers When to use, When NOT to use, Required inputs and The framework: blameless…, plus 6 more sections
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

After Action Report is an agent skill from rampstackco/claude-skills. Run a structured after-action review (postmortem, retrospective) on a launch, incident, or completed project to capture timeline, root cause analysis, contributing factors, and actionable lessons. Use this skill whenever the user wants to run a postmortem, retrospective, AAR, or after-action review on any past event. Triggers on after-action report, AAR, postmortem, retrospective, retro, post-incident review, what went well what didn't, lessons learned, blameless postmortem, root cause analysis, RCA, five whys…

Its SKILL.md is about 2.5k tokens, which your agent loads only when the skill is triggered. The skill folder holds 3 other files, including reference files (for example `README.md` and `references/aar-template.md`).

It sits in Product & Project Management, covering Retrospectives, Runbooks and postmortems and Root cause analysis. The repository describes itself as: Stack-agnostic Claude Skills covering the full website lifecycle: brand, design, content, SEO, dev, ops, growth, and research. Build, ship, audit, optimize. The licence is MIT.

When your agent uses it

  • The user wants to run a postmortem
  • After-action review on any past event
  • After-action report
  • Post-incident review

Example prompts

  • “/after-action-report”

Workflow steps

12 steps, taken from the step headings in SKILL.md.

  1. Summary
  2. Timeline
  3. Root cause analysis
  4. Contributing factors
  5. What went well
  6. Action items
  7. Schedule the AAR
  8. Gather inputs
  9. Run the meeting
  10. Write the document
  11. Distribute
  12. Track action items

What it can do on your machine

Read from SKILL.md and the folder at commit 482c9bf. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md (its code samples are markdown).

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

After Action Report loads about 2.5k tokens when it runs, and up to ~4.6k if it reads all its reference files. Until then it costs about 163 tokens; SKILL.md has 1,185 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~163
When it runs · the whole SKILL.md, loaded when a task matches
~2.5k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~4.6k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from rampstackco/claude-skills at commit 482c9bf, republished under its MIT licence (© rampstackco). 1,185 words, ~2,476 tokens.

Download SKILL.mdSave it as .claude/skills/after-action-report/SKILL.md (or your agent's skills folder). This skill also uses 2 other files; get the full folder from GitHub.
name
after-action-report
description
Run a structured after-action review (postmortem, retrospective) on a launch, incident, or completed project to capture timeline, root cause analysis, contributing factors, and actionable lessons. Use this skill whenever the user wants to run a postmortem, retrospective, AAR, or after-action review on any past event. Triggers on after-action report, AAR, postmortem, retrospective, retro, post-incident review, what went well what didn't, lessons learned, blameless postmortem, root cause analysis, RCA, five whys. Also triggers when the user has just shipped something or just resolved an incident and wants to capture learnings.
category
operations
catalog_summary
Post-mortems, retros, learnings documentation
display_order
3

After-Action Report

Run a structured retrospective on a launch, incident, or completed project. Produce actionable lessons, not just a document.

This skill is for after-the-fact analysis. For active incident response, use incident-response. For planning launches, use launch-runbook.

When to use

  • After any incident (any severity)
  • After every major launch
  • At the end of a project (sprint retro, quarterly retro, project closeout)
  • When a recurring issue has happened enough times to demand investigation
  • When a decision didn't work out and the team wants to learn

When NOT to use

  • During an active incident (use incident-response)
  • For pre-launch planning (use launch-runbook)
  • For one-off bug fixes that don't merit broad analysis

Required inputs

  • The event being analyzed (incident, launch, project)
  • A timeline reconstructed from logs, chat, tickets
  • Participant accounts of what they observed and did
  • Outcomes and impact (what actually happened to users, the business)

The framework: blameless analysis

The most important principle: blameless. Without it, retrospectives produce hidden information and theatrical lessons rather than real ones.

What blameless means
  • Focus on systems, not individuals
  • Assume everyone made reasonable decisions given what they knew at the time
  • The question is "why was this decision reasonable to make?" not "who screwed up?"
  • Fixing the system means the next person in that situation succeeds where this person didn't
What blameless does not mean
  • No accountability (action items still have owners)
  • No hard truths (sometimes the system is broken in obvious ways)
  • No standards (some patterns of failure are individual, not systemic)
  • No discomfort (real reflection is uncomfortable)

The framework: 6 sections

A complete AAR covers six sections.

1. Summary

A 2 to 3 paragraph overview. Captures:

  • What happened
  • Impact (users, business, time)
  • Root cause (in plain language)
  • Top action items

This is what executives read. Anyone who reads only this section should leave with the most important information.

2. Timeline

A reconstructed timeline of events.

For incidents:

  • T-0: Detection
  • T+X: Acknowledgment
  • T+Y: Severity assessed, IC assigned
  • T+Z: Investigation began
  • ... mitigation, communication, resolution events
  • T+N: Resolution declared

For launches:

  • Pre-launch decisions and milestones
  • Launch day events
  • Post-launch monitoring observations

For projects:

  • Major milestones, decisions, pivots
  • Both planned and emergent

The timeline is the source of truth. Disagreements about what happened get resolved here.

3. Root cause analysis

What caused this, in plain language.

Use one or both of:

Five whys. Start with the surface symptom. Ask "why?" Repeat 5 times (or until you reach a true root). Each "why" should yield a substantive answer, not a tautology.

Example:

  • Why did the site go down? Database connection pool exhausted.
  • Why was the pool exhausted? Background job opened too many connections.
  • Why did the background job open too many connections? Connection cleanup code didn't run on errors.
  • Why didn't cleanup run on errors? Original code review didn't cover error paths.
  • Why didn't the review cover error paths? No checklist for error handling in our review process.

The fifth why often reveals the system fix. In this case: improve the review process.

Causal chain. Multiple contributing factors that combined.

  • Factor 1: Background job opened too many connections (technical)
  • Factor 2: Connection limit was set too low for actual traffic (configuration)
  • Factor 3: No alert on connection pool saturation (monitoring)
  • Factor 4: Recent traffic doubled without infra capacity review (process)

No single fix addresses the incident. Multiple gaps need attention.

4. Contributing factors

Factors that didn't cause the event but made it worse, or removed safety nets that would have caught it.

  • Monitoring gaps
  • Documentation gaps
  • Process gaps
  • Tooling gaps
  • Knowledge gaps

A "would have been caught earlier if..." factor.

5. What went well

Real lessons require capturing successes, not just failures.

  • What detection worked?
  • What response worked?
  • What decisions were good?
  • What tools or processes performed as expected?

This is not consolation. It's calibration. Things that worked here should be reinforced and replicated.

6. Action items

Specific, owned, dated.

ActionOwnerDueType
Add alert on connection pool saturation[name][date]Monitoring
Add error handling checklist to PR template[name][date]Process
Audit other background jobs for similar issue[name][date]Code

Action item criteria:

  • Specific. "Improve monitoring" is not actionable. "Add alert on connection pool saturation, threshold 80%, page on-call" is.
  • Owned. A name. Not "the team."
  • Dated. A real date. Not "soon."
  • Sized. Roughly hours, days, or weeks of effort.
  • Closeable. Definition of done is clear.

Action items that don't close in their committed timeframe should re-surface in the next AAR. Patterns of unclosed actions point to deeper organizational issues.

Show full SKILL.md (442 more words)Show less

Workflow

1. Schedule the AAR

Within 1 to 2 weeks of the event. Long enough that emotions cooled and facts gathered. Short enough that memories are fresh.

For incidents: pre-decided in the response procedure. For launches: schedule on the runbook. For projects: schedule at project closeout.

2. Gather inputs

Before the meeting:

  • Reconstructed timeline (often the scribe's notes if there was one)
  • Logs, chat transcripts, tickets, incident updates
  • Individual accounts from each participant (written, before the meeting)
  • Impact data (users affected, duration, revenue impact, etc.)
3. Run the meeting

Typical agenda (60 to 90 minutes):

  • Read the summary as drafted (5 min)
  • Walk the timeline together. Add corrections. Resolve disagreements. (20 to 30 min)
  • Discuss root cause. Use five whys or causal chain. (15 to 20 min)
  • Discuss contributing factors. (10 min)
  • Discuss what went well. (10 min)
  • Identify action items. Owners and dates. (10 min)

A facilitator runs the meeting. Often the IC for an incident, or a project lead for a project. The facilitator is not the scribe.

4. Write the document

Within a few days of the meeting. The full AAR includes all 6 sections.

5. Distribute

Internal: post in a known location. Make searchable. Reference in onboarding.

For high-severity incidents: external summary may be appropriate (status page, customer email, public blog).

6. Track action items

Every action item should be tracked to closure. The next AAR re-surfaces unclosed ones.

Failure patterns

  • Skipping the AAR for "small" incidents. Patterns get missed.
  • Naming and shaming. Real lessons get hidden when people fear blame.
  • Generic action items. "Improve testing" instead of specific testing change.
  • Action items that never close. Filed, forgotten. Same incident recurs.
  • Theater retrospectives. Going through the motions without genuine reflection.
  • Skipping "what went well." Misses calibration on what's working.
  • Blame externalized. "Our vendor failed." OK, what's our system for vendor risk?
  • Single-person AAR. One person writes the whole thing. Misses other perspectives.
  • AAR only for failures. Successful launches deserve AARs too. Lessons from success are valuable.
  • Long delays. Memories fade. Conversations cool. Get it done within 2 weeks.

Output format

A markdown document at aar-[date]-[event-name].md.

Structure:

markdown
# AAR: [Event name]

**Date of event:** [YYYY-MM-DD]
**AAR date:** [YYYY-MM-DD]
**Severity / scope:** [SEV-1 / Major launch / Project closeout]
**Facilitator:** [Name]
**Participants:** [Names]

## Summary
[2 to 3 paragraphs]

## Impact
- Users affected: [number, segment]
- Duration: [time]
- Revenue / business impact: [if applicable]

## Timeline
[Timestamped events]

## Root cause analysis
[Five whys or causal chain]

## Contributing factors
[List]

## What went well
[List]

## Action items
| Action | Owner | Due | Type | Status |
|---|---|---|---|---|
| | | | | |

## Lessons
[Reflections that don't fit elsewhere. Often the most quotable section.]

If required data is unavailable

This skill's output depends on data, measurements, or tool results it cannot generate on its own. When a required input, tool, or data source is unavailable or unverifiable, the sanctioned output is the deliverable with the gap stated: what was needed, what was actually obtained or verified, and which parts of the output are affected. Fabricating, estimating, or interpolating a required number to complete the deliverable is never sanctioned. A stated gap is a complete answer.

Reference files

© rampstackco, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 2 other files (references) in skills/after-action-report of rampstackco/claude-skills.

  • SKILL.md
  • README.md
  • references/aar-template.md

Open the folder on GitHubat commit 482c9bf

Used in 1 other repository

We found 1 copy of this SKILL.md (exact, near-identical or edited) in other folders, from 1 other GitHub owner. This page covers the copy in rampstackco/claude-skills, which our catalogue first saw on October 7, 2026.

Compare with similar skills

After Action Report next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

After Action Report compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
After Action Report this skillrampstackco/claude-skills9401 repos~2.5kAutomated safety check: PassMIT
Incident RetrospectiveOpenHands/extensions158—~922Automated safety check: PassMIT
Launch Retro Analyzeraaron-he-zhu/aaron-marketing-skills2.9k—~3kAutomated safety check: PassApache-2.0
66 Crisis Playbook Globalminhnv0807/ai-business-skills608—~2.8kAutomated safety check: PassMIT
Self ImproverAffitor/affiliate-skills699—~2.6kAutomated safety check: PassMIT
Release Retrospectivemurphytrueman/design-system-ops203—~3.2kAutomated safety check: PassMIT

Similar skills

  • Incident Retrospective

    OpenHands/extensions

    Create an automation that drafts incident retrospectives. An agent skill from OpenHands/extensions.

    158 GitHub stars~922 tokensUpdated today
    Product & Project ManagementAuto-check passed

  • Launch Retro Analyzer

    aaron-he-zhu/aaron-marketing-skills

    A skill your agent uses when the user asks to "run a launch retro / post-mortem", "compare launch results vs targets by channel", or "decide what to keep or kill for the next launch"; produces a…

    2.9k GitHub stars~3k tokensUpdated today
    Product & Project ManagementAuto-check passed

  • 66 Crisis Playbook Global

    minhnv0807/ai-business-skills

    A skill your agent uses when a brand faces a communications CRISIS or a campaign is failing in public — L1 to L5 severity classification, a first-four-hours process, response templates by type, an…

    608 GitHub stars~2.8k tokensUpdated 26 days ago
    Product & Project ManagementAuto-check passed

  • Self Improver

    Affitor/affiliate-skills

    Review affiliate campaign results and improve strategy. An agent skill from Affitor/affiliate-skills.

    699 GitHub stars~2.6k tokensUpdated 23 days ago
    Product & Project ManagementAuto-check passed

  • Release Retrospective

    murphytrueman/design-system-ops

    Review how a shipped release, migration or deprecation went against its plan: blast radius, comms, migration, timeline, support load, each gap classed.

    203 GitHub stars~3.2k tokensUpdated 13 days ago
    Product & Project ManagementAuto-check passed

  • 66 Crisis Playbook

    minhnv0807/ai-business-skills

    Dung khi thuong hieu DANG bi tan cong hoac campaign gay phan ung xau — phan loai 5 cap L1 den L5, quy trinh 4 gio dau, template phan hoi tung tinh huong, ai duoc phat ngon, danh sach TUYET DOI khong…

    608 GitHub stars~2k tokensUpdated 26 days ago
    Product & Project ManagementAuto-check passed

More from rampstackco/claude-skills

All 103 skills in this repo

  • Analytics Strategy

    rampstackco/claude-skills

    Design measurement frameworks including event taxonomy, KPI hierarchy, dashboard architecture, attribution models, and analytics implementation strategy.

    940 GitHub starsUsed in 1 repo~2.4k tokens
    Auto-check passed

  • Brand Style Guide

    rampstackco/claude-skills

    Build or audit a comprehensive brand style guide that documents the full brand system including story, logo system, color, typography, imagery, voice, applications, and dos/don'ts.

    940 GitHub stars~2.1k tokensUpdated yesterday
    Auto-check passed

  • Brand Voice

    rampstackco/claude-skills

    Develop or document a complete brand voice and tone system covering voice attributes, tone shifts by context, vocabulary preferences, grammar rules, and copy examples.

    940 GitHub stars~2.2k tokensUpdated yesterday
    Auto-check passed

  • Content And Copy

    rampstackco/claude-skills

    Write or edit website copy, blog content, and editorial pieces with attention to voice, structure, and goal.

    940 GitHub stars~2.1k tokensUpdated yesterday
    Auto-check passed

  • Content Strategy

    rampstackco/claude-skills

    Develop a content strategy covering editorial positioning, content pillars, formats, calendar, governance, and topical authority planning.

    940 GitHub stars~2.6k tokensUpdated yesterday
    Auto-check passed

  • Cro Optimization

    rampstackco/claude-skills

    Run conversion rate optimization through hypothesis-driven testing including audit, hypothesis generation, test design, statistical analysis, and rollout decisions.

    940 GitHub stars~2.7k tokensUpdated yesterday
    Auto-check passed

Categories

Questions about After Action Report

What does After Action Report do?

Run a structured after-action review (postmortem, retrospective) on a launch, incident, or completed project to capture timeline, root cause analysis, contributing factors, and actionable lessons. After Action Report is an agent skill from rampstackco/claude-skills. Run a structured after-action review (postmortem, retrospective) on a launch, incident, or completed project to capture timeline, root cause analysis, contributing factors, and actionable lessons.

When should I use After Action Report?

After Action Report fits situations like: the user wants to run a postmortem; after-action review on any past event; after-action report; post-incident review.

How do I install After Action Report in Claude Code?

Run `npx skills add rampstackco/claude-skills --skill after-action-report -a claude-code`. Or copy the skill folder (skills/after-action-report in rampstackco/claude-skills) into .claude/skills/after-action-report in your project. Claude Code loads it when a task matches its description.

How do I install After Action Report in Codex?

Run `npx skills add rampstackco/claude-skills --skill after-action-report -a codex`. Or copy the skill folder (skills/after-action-report in rampstackco/claude-skills) into .agents/skills/after-action-report in your project. Codex loads it when a task matches its description.

Can I use After Action Report in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add rampstackco/claude-skills --skill after-action-report -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/after-action-report, .gemini/skills/after-action-report, .github/skills/after-action-report and .opencode/skills/after-action-report in your project.

What does After Action Report need to run?

SKILL.md names no scripts, command-line tools or credentials: After Action Report is instructions for the agent only.

Does After Action Report access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is After Action Report safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does After Action Report use?

After Action Report is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does After Action Report use?

About 2.5k tokens (SKILL.md is roughly 9.9k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 2.1k tokens, read only when the agent opens those files.

What are the alternatives to After Action Report?

Skills that share tags, products or a category with After Action Report: Incident Retrospective (OpenHands/extensions, 158 stars), Launch Retro Analyzer (aaron-he-zhu/aaron-marketing-skills, 2.9k stars), 66 Crisis Playbook Global (minhnv0807/ai-business-skills, 608 stars) and Self Improver (Affitor/affiliate-skills, 699 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains After Action Report?

rampstackco (a GitHub organization) maintains it in rampstackco/claude-skills, which has 940 GitHub stars. The repository holds 103 skills in this directory. The repository was last updated on October 7, 2026.

Source: rampstackco/claude-skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.