home / skills / phrazzld / claude-config / postmortem

postmortem skill

safe

/skills/postmortem

This skill generates a blameless postmortem from incident context, logs, and fixes to drive learning and prevent recurrence.

npx playbooks add skill phrazzld/claude-config --skill postmortem

Review the files below or copy the command above to add this skill to your agents.

Files (1)

SKILL.md

1.2 KB

---
name: postmortem
description: |
  POSTMORTEM
effort: max
---

---
description: Create blameless postmortem from the incident we just resolved
argument-hint: [optional: additional context or specific focus]
---

# POSTMORTEM

Generate a blameless postmortem from this conversation.

You just helped resolve an incident. The investigation context, hypotheses, evidence, and fix are all in this conversation (and likely in an INCIDENT.md file).

## Output Structure

Write a postmortem with:
- **Summary**: One paragraph - what happened, impact, resolution
- **Timeline**: Key events in UTC (use conversation timestamps if available)
- **Root Cause**: The actual underlying cause (not symptoms)
- **5 Whys**: Dig to systemic factors
- **What Went Well**: Recognition of good practices during response
- **What Went Wrong**: Honest assessment without blame
- **Follow-up Actions**: Concrete items with clear ownership

## Philosophy

- **Blameless**: Focus on systems, processes, and tools - not people
- **Honest**: Don't minimize or exaggerate
- **Actionable**: Every lesson should have a concrete follow-up

If INCIDENT.md exists, update its postmortem section. Otherwise create POSTMORTEM-{timestamp}.md.

Optional focus: **$ARGUMENTS**

Overview

This skill generates a blameless, actionable postmortem from an incident conversation and investigation notes. It summarizes impact and resolution, constructs a clear timeline, identifies root cause, and produces concrete follow-up actions with ownership. The output follows a consistent structure suitable for inclusion in an incident file or as a standalone POSTMORTEM-{timestamp}.md.

How this skill works

It inspects the incident conversation, hypotheses, evidence, and resolution details provided in the session or linked incident notes. The skill extracts timestamps, key events, fixes applied, and diagnostic findings to build a concise summary, timeline, root cause analysis, 5 Whys, and a prioritized action list. Optional arguments let you focus on a particular area like communications, tooling, or remediation.

When to use it

After resolving a production incident to document what happened and why
When converting an investigation conversation into a structured postmortem
To produce a blameless writeup for stakeholders and retrospectives
When you need a follow-up action list with clear ownership
To standardize incident reports across teams

Best practices

Include all relevant timestamps and correlate them to UTC for clarity
Be specific about evidence and how the root cause was determined
Keep language blameless; focus on systems and process improvements
Prioritize follow-up actions by impact and assign an owner and deadline
Use the optional focus argument to surface communications or tooling gaps

Example use cases

Convert a Slack or chat investigation into a formal postmortem document
Create a one-paragraph executive summary plus a technical timeline for SREs
Produce a prioritized follow-up list for engineering, QA, and DevOps
Generate a blameless 5 Whys analysis to guide process changes
Update or create POSTMORTEM-{timestamp}.md for incident archives

FAQ

Can the skill use timestamps from the conversation?

Yes. It extracts and normalizes timestamps to UTC when available; otherwise it notes missing times.

Will the postmortem assign owners for follow-ups?

Yes. The skill suggests owners where possible from the conversation context and leaves placeholders if ownership is unknown.

Can I request a focused postmortem on communications or tooling?

Yes. Provide an optional focus argument to emphasize communications, tooling, testing, or remediation in the analysis.