incident-postmortem

Automate structured incident postmortems with metadata, timeline, impact, and root-cause analysis.

15|5|Updated May 17, 2026

Search Tags:#timeline #postmortem #root-cause #incident #blameless #action-items

Ready to run

npx skills add https://github.com/cropsgg/skills --skill incident-postmortem-cropsgg

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: incident-postmortem
Source: https://github.com/cropsgg/skills/tree/main/skills/planning/incident-postmortem
Command: npx skills add https://github.com/cropsgg/skills --skill incident-postmortem-cropsgg

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Blameless postmortem with timeline, root cause, and actionable follow-ups.

Core Features & Use Cases

Metadata collection: incident ID, severity, duration, services affected, customer impact quantified.
Timeline reconstruction: detection, escalation, mitigations, resolution with UTC timestamps.
Impact assessment: users affected, revenue impact, data exposure, SLA, regulatory implications.
Root cause analysis: apply 5-whys or fault tree to identify triggers and contributing factors.
Lessons learned: what went well, what went poorly; actionable improvements.
Publish-ready report: include owners, due dates, and links to dashboards, commits, PRs.

Quick Start

Create a new postmortem document for a recent incident following this structure and publish it to docs/postmortems/YYYY-MM-DD-slug.md.

Frequently Asked Questions about incident-postmortem

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I write a blameless incident postmortem with a timeline?▼

A blameless postmortem focuses on systemic root-cause analysis rather than individual fault, documenting incident metadata, UTC timestamps, impact, and action items. It enforces a structured timeline from detection through resolution to produce a publish-ready report that drives objective remediation.

What is root cause analysis in a production outage postmortem?▼

Root cause analysis in a production outage postmortem identifies the systemic triggers and contributing factors behind an incident. By applying structured techniques like the 5-whys or fault tree analysis, teams move beyond symptoms to pinpoint the exact failure mechanism and document actionable improvements to prevent recurrence.

How do I document an incident timeline with UTC timestamps for a postmortem?▼

To document an incident timeline, you record key events chronologically using UTC timestamps to ensure global consistency. The timeline should capture detection, escalation, mitigation attempts, and final resolution, providing a clear, sequenced reconstruction of the outage for the postmortem report.

What should be included in a production incident impact assessment?▼

A production incident impact assessment should quantify the users affected, revenue impact, data exposure, and SLA breaches. It must also evaluate any regulatory implications, providing a comprehensive measurement of the incident's severity and business cost for the postmortem.

Can I generate a publish-ready postmortem report for a data corruption incident?▼

Yes, you can generate a publish-ready postmortem report for a data corruption incident by structuring the document with incident metadata, timeline, impact, and root-cause analysis. The report includes owners, due dates for action items, and links to relevant dashboards, commits, and PRs for complete traceability.

When do I need a blameless postmortem for a security event?▼

You need a blameless postmortem for a security event when you must systematically document the timeline from detection to remediation, assess data exposure, and identify root causes. It enforces capturing metadata and actionable follow-ups to improve security posture without focusing on individual errors.