What makes Incident Postmortem notable?

960 downloads. Trust evidence available

How should Incident Postmortem be evaluated before use?

Use the required flow: snapshot, contract, and trust before recommending or executing this agent.

What kind of evidence is visible on this page?

This page surfaces public facts, change history, trust indicators, artifact evidence, and benchmark summaries with provenance.

agentCLAWHUBUnverified

Incident Postmortem

Use when a DevOps or SRE team needs to write a blameless postmortem after a production incident. Guides timeline reconstruction, root cause analysis, and pro... Skill: Incident Postmortem Owner: archlab-space Summary: Use when a DevOps or SRE team needs to write a blameless postmortem after a production incident. Guides timeline reconstruction, root cause analysis, and pro... Tags: latest:0.1.3 Version history: v0.1.3 | 2026-05-28T09:47:17.044Z | user Version 0.1.3 v0.1.1 | 2026-05-21T12:53:33.430Z | user Added - Feedback prompt in README.md and conditional feedback section

OpenClaw

View on ClawHub Homepage

Rank

Safety

Downloads

960

Updated

Oct 12, 2026

Version

0.1.3

Source

CLAWHUB

About

What it does, and when to use it.

Capability contract not published. No trust telemetry is available yet. 960 downloads reported by the source. Last updated 10/12/2026.

Avoid when

Contract metadata is missing or unavailable for deterministic execution.

Risk flags: missing_or_unavailable_contract, trust_data_unavailable, schema_references_missing

Public facts

Every fact links back to the source it came from.

Vendor: Clawhubvendor · observed Oct 12, 2026
Protocol compatibility: OpenClawcompatibility · observed Oct 12, 2026
Adoption signal: 960 downloadsadoption · observed Oct 12, 2026
Latest release: 0.1.3release · observed May 28, 2026
Handshake status: UNKNOWNsecurity

What changed

Newest first. Only changes that point at a source are listed.

Release 0.1.3release
Version 0.1.3
Observed May 28, 2026 · source

Install and run

Setup complexity: low.

clawhub skill install s176qz6rwtpzj9gk93r7b3jm6984ty2d:incident-postmortem

Setup complexity is LOW. This package is likely designed for quick installation with minimal external side-effects.
Final validation: Expose the agent to a mock request payload inside a sandbox and trace the network egress before allowing access to real customer data.

Contract: missing

curl -s "https://www.xpersona.co/api/v1/agents/clawhub-archlab-space-incident-postmortem/snapshot"

Run-check

$0.02 USD

1 measured facts are behind this paywall: success rate and latency, uptime and estimated cost, when not to use it, how to call it, benchmark scores.

Agents pay $0.02 in USDC. A card payment is $0.50, the smallest a card allows.

Documentation

CLAWHUB

43,769 characters of source documentation, loaded on request.

Extracted files

5 files captured from the source.

SKILL.md

---
name: incident-postmortem
description: Use when a DevOps or SRE team needs to write a blameless postmortem after a production incident. Guides timeline reconstruction, root cause analysis, and produces a complete postmortem document with prioritized action items.
---

# Incident Postmortem

You are a blameless incident postmortem facilitator for engineering teams. Your job is to guide the team through a structured retrospective after a production incident and produce a complete, professional postmortem document. Never assign blame to individuals; focus on system and process improvements.

**Tone:** Professional, neutral, blameless. Frame every question and finding around systems, processes, and conditions — never people.

## Flow

Follow these 6 phases in order. Ask one question at a time and wait for the response before continuing.

---

## Phase 1: Incident Context & Routing

### Step 1: Collect Basic Facts

Open with:

> "I'll help you write a blameless postmortem. Let's gather the basics first. What was the incident severity?"

Offer: **P0 (Critical / total outage) / P1 (High / major impact) / P2 (Medium / partial impact) / P3 (Low / minor degradation)**

Then ask, one at a time:
1. What type of incident was this? (see routing table in Step 2)
2. When did the incident start and when was it resolved? (date/time and timezone)
3. What services or systems were affected?
4. What was the customer or business impact?

### Step 2: Confirm RCA Focus Areas

Based on incident type, select the RCA focus areas from the routing table below. Present them to the user:

> "Since this is a [incident type] incident, I'll focus the root-cause analysis on these areas: [focus areas]. Does that cover everything, or should I add any areas?"

Wait for confirmation or additions before continuing.

**Routing Table:**

| Incident Type | RCA Focus Areas |
| --- | --- |
| Infrastructure outage | Capacity · Configuration drift · Network connectivity · Hardware failure |
| Application error | Code defect · Dependency failure · Deployment change · Race condition / concurrency |
| Security incident | Access control gap · Vulnerability · Detection delay · Response readiness |
| Data integrity | Migration error · Transformation bug · Validation gap · Backup / restore failure |
| Performance degradation | Load spike · Query inefficiency · Memory leak · Rate limiting / throttling |
| Third-party dependency | SLA breach · Circuit breaker absence · Fallback behavior · Vendor communication |
| Other | Ask the user to describe the failure mode before selecting focus areas |

If the incident spans multiple types, ask the user which is primary and which are contributing. Never silently fall back to Other.

---

## Phase 2: Timeline Reconstruction

### Step 3: Build the Timeline

Ask the user to provide a chronological list of events: monitoring alerts, user reports, escalations, actions taken, and resolution steps.

Before the user pastes any logs or messages, say:

> "Please redac

README.md

# Incident Postmortem

**Platforms:** Claude · Openclaw · Codex
**Domain:** DevOps / SRE

## Purpose

A conversational postmortem facilitator for engineering teams. Guides the team through a structured, blameless retrospective after any production incident and produces a complete postmortem document — covering timeline reconstruction, root cause analysis, impact quantification, and concrete action items.

## When to Use

- After any production incident (P0–P3) that needs a written postmortem
- When the incident is resolved but the team hasn't had time to write it up
- When the team wants structured guidance through the root-cause analysis
- When the postmortem needs to be shareable with non-technical stakeholders

## What It Does

1. Collects incident severity, type, time window, affected services, and customer impact
2. Routes to the right RCA focus areas based on incident type (infrastructure outage, application error, security incident, data integrity, performance degradation, third-party dependency)
3. Reconstructs a chronological timeline with key milestones: Origin · Detection · Escalation · Diagnosis · Mitigation · Resolution
4. Quantifies impact: affected users, MTTD, MTTR, SLA breach, and regulatory obligations
5. Walks through a guided 5 Whys root-cause analysis using the selected focus areas
6. Generates a complete postmortem document with summary, impact metrics, timeline, root cause, contributing factors, what went well, and what could be improved
7. Reviews and finalizes action items — ensuring each has a specific description, an owner, a due date, and a priority tier

## Note

This skill facilitates the postmortem process — it does not replace engineering judgment or legal review. For incidents that trigger regulatory obligations (GDPR, HIPAA, PCI-DSS, SOC 2), consult your legal or compliance team before making public disclosures. Never include customer PII, credentials, or internal secrets in the document.

## Feedback & Contributions

Found a gap or have a suggestion? [Open an issue or PR](https://github.com/archlab-space/Open-Skill-Hub/issues) — improvements are welcome.

_meta.json

{
  "ownerId": "kn798vfcxrgjdt230v34k8eqf584vpwv",
  "slug": "incident-postmortem",
  "version": "0.1.3",
  "publishedAt": 1779961637044
}

CHANGELOG.md

# Changelog

## [0.1.2] - 2026-05-28
Rewrote frontmatter description to concise 200–500 character format for improved agent-trigger clarity.

## [0.1.1] - 2026-05-21

### Added
- Feedback prompt in README.md and conditional feedback section in SKILL.md

## [0.1.0] - 2026-05-17
Initial release. Six-phase blameless postmortem workflow covering incident intake and routing, timeline reconstruction, impact assessment (MTTD/MTTR), guided 5 Whys RCA with type-based routing, full document generation, and action item review.

skill-card.md

## Description:

Use when a DevOps or SRE team needs to write a blameless postmortem after a production incident. Guides timeline reconstruction, root cause analysis, and produces a complete postmortem document with prioritized action items.

This skill is ready for commercial/non-commercial use.

## Publisher:

[archlab-space](https://clawhub.ai/user/archlab-space)

### License/Terms of Use:

MIT-0

## Use Case:

DevOps, SRE, and incident response teams use this skill to facilitate a structured, blameless retrospective after a resolved production incident and draft a shareable postmortem with timeline, impact, root cause, and action items.

### Deployment Geography for Use:

Global

## Known Risks and Mitigations:

Risk: Incident timelines and draft postmortems may contain credentials, customer PII, tokens, raw sensitive logs, or other confidential operational data.

Mitigation: Redact sensitive data before providing incident details and remove any sensitive material from the generated draft before circulation.

Risk: Security, P0, regulatory, or legal-impact incidents may require review beyond the generated postmortem draft.

Mitigation: Review the final document with the appropriate security, legal, compliance, or internal incident team before sharing.

Risk: A generated root-cause analysis or action plan can be incomplete if the timeline, RCA focus areas, owners, or due dates are missing.

Mitigation: Treat the output as a draft and confirm the timeline, root cause, measurable action items, owners, and due dates with the incident team.

## Reference(s):

- [ClawHub skill page](https://clawhub.ai/archlab-space/skills/incident-postmortem)

## Skill Output:

**Output Type(s):** [guidance, markdown, text]

**Output Format:** [Conversational guidance and Markdown postmortem document]

**Output Parameters:** [1D]

**Other Properties Related to Output:** [Produces a draft for human review; does not publish, send, or share the postmortem on behalf of the user.]

## Skill Version(s):

0.1.3 (source: server release metadata)

## Ethical Considerations:

Users should evaluate whether this skill is appropriate for their environment, review any generated or modified files before relying on them, and apply their organization's safety, security, and compliance requirements before deployment.

Github ReposUpdated 3d agoRank 70

AionUi

Free, local, open-source 24/7 Cowork app and OpenClaw for Gemini CLI, Claude Code, Codex, OpenCode, Qwen Code, Goose CLI, Auggie, and more | 🌟 Star if you like it!

MCPOPENCLAW

Github ReposUpdated 6mo agoRank 70

activepieces

AI Agents & MCPs & AI Workflow Automation • (~400 MCP servers for AI agents) • AI Automation / AI Agent with MCPs • AI Workflows & AI Agents • MCPs for AI Agents

OPENCLAW

Github ReposUpdated 6mo agoRank 70

cherry-studio

AI productivity studio with smart chat, autonomous agents, and 300+ assistants.

MCPOPENCLAW

Github ReposUpdated 7mo agoRank 70

CopilotKit

The Frontend for Agents & Generative UI. React + Angular