Installs into .claude/skills of the current project.
Are you the author of Incident Postmortem?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/z-zihan-incident-postmortem)
---
name: incident-postmortem
description: Create a blameless postmortem from logs, notes, tickets, timelines, and user-provided incident evidence.
---
# Incident Postmortem
1. Define incident window, affected users/systems, severity, data sources, and confidence gaps.
2. Build a timestamped timeline. Distinguish observed events, operator decisions, automated actions, and later hypotheses.
3. Quantify impact where evidence exists. Do not manufacture duration, user counts, revenue, or data-loss estimates.
4. Separate trigger, contributing conditions, root causes, detection gaps, and response gaps. Avoid person-focused blame.
5. Map each corrective action to a failure mode, owner, due date, verification, and rollback risk.
6. Check whether actions improve prevention, detection, mitigation, recovery, or learning; avoid vague tasks such as “be more careful.”
Return executive summary, impact, timeline, causal analysis, what worked, gaps, corrective actions, and open evidence questions.
