Works with the AI Agents you already use
Claude Code
Cursor
Codex CLI
Muse
Dots+22 moreClaude CodeCursorCodex CLIMuseDots
OpenClaw
Manus
Grok
Grok Bot+18 agentsIncident Investigation & Postmortem Toolkit
Turn incident evidence into sourced timelines, testable hypotheses, supported impact, and blameless postmortems.
$14.99
Incident Investigation & Postmortem Toolkit
Example session with this skill installed
Use the included examples/demo-incident.md fictional packet. Give me a compact evidence-linked incident report with supported impact, a UTC timeline, competing hypotheses, next diagnostics, and a blameless action plan. Keep the full response under 550 words. Do not access live systems or send messages.
- Read your context and instructions
- Compiled the incident investigation
Fictional demonstration. Source record IDs below refer to the included examples/demo-incident.md packet.
Harbor Cart: measured checkout availability recovered by 2026-09-18T10:30:00Z. The packet verifies recovery through that time only. Business outcomes and the incident-wide cause remain unresolved. [M1-01–06] [C1-01–04]
Impact. For all-region POST /checkout, degraded buckets [10:05Z,10:20Z) contained (180+260+120)/(1,200+1,300+1,000) = 560/3,500 = 16% unsuccessful attempts. Retries are separate attempts; failures already combine timeouts and 5xx without duplication. This is a 15-minute degraded bucket span, not an exact outage duration or 560 customers. Peak bucket p95 was 10,000 ms. Recovery buckets [10:20Z,10:25Z) and [10:25Z,10:30Z) had 2% and 1.05% errors, satisfying the two-bucket rule. Unique customers, lost/duplicate orders, payments and financial loss are unmeasured. [C1-01–04] [M1-01–06]
UTC timeline — September 18, 2026
| Original time | Evidence |
|---|---|
10:02:00.000Z → 10:03:20.000Z | Rollout starts/completes; pool maximum 20→8 per pod across 12 pods. [D1-01–06] |
10:03:00.000Z | Inventory reconciliation starts, concurrency 4. [J1-01–05] |
10:05:07.310Z; 10:06:30.000Z | Sample pool-acquisition timeout; alert fires on separate 10:01–10:06 window. [L1-01–05] |
10:09:00.000Z | Checkout session blocked by reconciliation session, idle in a transaction started 10:03:20Z; idle duration unknown. [Q1-01–02] |
10:12:00.000Z → 10:14:00.000Z | Rollback starts/completes, restoring pool maximum 20. [D1-01–06] |
10:15:20.400Z | Old-version transaction-wait timeout persists. [L1-01–05] |
10:16:00.000Z → 10:19:10.000Z | Job pause requested; active tasks finally reach zero. [J1-01–05] |
10:30:00Z | Second qualifying bucket completes. [M1-01–06] |
Machine clocks were within 150 ms of UTC at 09:55Z; later drift is unknown. Exact onset and human acknowledgment are absent. [C1-01–04]
Ranked explanations
Probable: reconciliation contention amplified by smaller pools. Local blocking and pool-acquisition failure are
confirmed, but their connection and wider contribution are unproven. [Q1-01–02] [L1-01–05]
2.
Unresolved: reconciliation contention alone. Post-rollback failure supports investigation; one snapshot cannot establish incident-wide causation. [Q1-01–02] [L1-01–05]
3.
Unresolved: pool reduction/another release change alone. Rollout association supports investigation; continued failure after rollback weakens “rollback fixed it.” Source diff is missing. [D1-01–06] [L1-01–05]
Pool maxima reached 100%; CPU maxima only 45%. Peaks need not coincide; pool percentage is per-pod, not database-wide. [M2-01–06]
Next diagnostics — proposed, unexecuted. Request bounded historical exports: blocker/connection/request correlations for 10:03–10:20Z, maximum 1,000 redacted records; pool/version metrics and source diff for 10:00–10:30Z. Linked blocking plus occupied slots supports explanation 1; pool waits without blocking favor alternatives. Compare pool 8/20 × reconciliation off/on using isolated synthetic staging data. Reconcile these attempts/retries against order/payment ledgers using idempotency keys through the documented settlement cutoff; return aggregates and unresolved counts before claiming no losses. Exports may incur load/cost; exclude secrets and personal data.
Blameless action plan. Timing and pool waits reasonably motivated rollback; decision rationale is undocumented. All actions are proposed; owners/dates TBD. [D1-01–06] [L1-01–05]
| Suggested role | Action and verification |
|---|---|
| Database/inventory maintainer | Bound offending transactions; pass when reproduced blocking clears and inventory correctness holds. |
| Checkout maintainer | Validate pool sizing with the test matrix; retain results meeting availability and connection-budget limits. |
| Incident lead/payments analyst | Verify recovery buckets and ledger outcomes; correct the draft’s unsupported customer, exact-duration, rollback and no-loss claims. [X1-01] |
No live diagnostics, changes or messages were performed.
Connects securely to your tools. The creator never sees your data.
About this skill
Investigate the incident with the evidence you actually have
Incident Investigation & Postmortem Toolkit helps your AI agent turn logs, deployment notes, metric exports, and incident notes into a reviewable investigation and blameless postmortem.
What you get
- Evidence intake: source IDs, exact locators, scope, missing records, and contradictions.
- Timeline reconciliation: preserve original timestamps, normalize explicit offsets, and keep unknown timezones visible.
- Hypothesis testing: competing explanations, supporting and contradicting evidence, and the next diagnostic that would distinguish them.
- Impact analysis: supported request counts and time windows, with assumptions and denominators attached.
- Postmortems: a concise narrative, confirmed findings, unresolved causes, mitigation evidence, and actions with verification criteria.
- Action follow-up: ownership to confirm, priorities, closure evidence, and a clear handoff.
The package includes reusable templates, a complete fictional incident and worked report, two difficult practice packets, and an optional local evidence helper. The helper orders timestamps, merges overlapping observation windows, and checks request error ratios without making network calls.
Designed for engineering teams
Useful for SaaS maintainers, software agencies, engineering leads, developers, and SREs who want consistent, source-linked reports. A deployment preceding an outage remains a correlation until evidence supports a causal claim. The instructions tell your agent to keep missing information visible and avoid unsupported root causes, customer counts, SLA breaches, action owners, or completed fixes. Review AI-generated conclusions against the evidence before use.
Requirements and limits
Use an AI agent that supports SKILL.md and can read the supporting Markdown files. The core workflows need no additional runtimes, API keys, MCP servers, or account connections. The optional helper requires Python 3.10+. AI-agent usage is separate.
Provide only evidence suitable for your chosen AI environment. This package does not automatically fetch production logs, redact secrets, change infrastructure, or send incident updates. It can draft diagnostics and communications; live execution depends on your tools and authorization. It is not a monitoring service, a legal report, or a guarantee of incident resolution.
All demonstrations are fictional and were created for this product. No employer or client materials are included. Commercial distribution; source is private. No personal consulting or managed incident response is included.
How to use
Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill passes our trust checks below.
Security scanned
Passed our 8-point scan before listing
Fresh listing
Recently published to Agensi
Money-back guarantee
Doesn't do what its page promises? You get your money back.
Trust & safety
Security scanned
Verified clean 3 days ago
- Passed all security checks, Safe to install
Requires