More screenshots

    Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIMuseMuseDotsDots+22 more

    Postmortem Forge: Incident Postmortem & RCA

    1

    Build a source-linked incident timeline from Slack exports, PagerDuty JSON and logs. Review the milestones, calculate TTD/TTM, then lint the postmortem for missing owners, dates and verification.

    $5

    Secure checkout via Stripe

    Money-back guarantee

    Converts to your local currency at checkout

    Security scanned
    Postmortem Forge: Incident Postmortem & RCA

    Postmortem Forge: Incident Postmortem & RCA

    Example session with this skill installed

    Use the included synthetic inventory incident exports to draft a blameless postmortem. Show the source-linked timeline, explain which milestone IDs were reviewed, and calculate TTD and TTM without guessing missing facts.

    • Read your context and instructions
    • Compiled the postmortem forge

    Reproducible synthetic example, not a production case study. This is the complete captured JSON output from the packaged timeline script with examples/milestones.json. Milestone choices and the finished report are included in examples/README.md and examples/postmortem.md.

    {
  "events": [
    {
      "id": "E001",
      "time": "2026-10-17T14:02:08.000Z",
      "text": "2026-10-17 14:02:08 UTC deploy: inventory-api release b7c41a2 (PR #681)",
      "kind": "change",
      "sources": [
        "examples/raw/deploy.log:1"
      ]
    },
    {
      "id": "E002",
      "time": "2026-10-17T14:03:00.000Z",
      "text": "2026-10-17 14:03:00 UTC synthetic trace: first inventory reservation timeout",
      "kind": "note",
      "sources": [
        "examples/raw/deploy.log:2"
      ]
    },
    {
      "id": "E003",
      "time": "2026-10-17T14:10:12.000Z",
      "text": "triggered_at: inventory-api p99 latency above 800ms",
      "kind": "detection",
      "sources": [
        "examples/raw/pagerduty.json#/alerts/0/triggered_at"
      ]
    },
    {
      "id": "E004",
      "time": "2026-10-17T14:11:30.000Z",
      "text": "acknowledged_at: inventory-api p99 latency above 800ms",
      "kind": "note",
      "sources": [
        "examples/raw/pagerduty.json#/alerts/0/acknowledged_at"
      ]
    },
    {
      "id": "E005",
      "time": "2026-10-17T14:15:00.000Z",
      "text": "[2:15 PM] Eli: maybe it is Redis? checking connection counts",
      "kind": "hypothesis",
      "sources": [
        "examples/raw/slack-export.txt:2"
      ]
    },
    {
      "id": "E006",
      "time": "2026-10-17T14:20:00.000Z",
      "text": "[2:20 PM] Noor: Redis healthy; reject the Redis hypothesis",
      "kind": "hypothesis",
      "sources": [
        "examples/raw/slack-export.txt:5"
      ]
    },
    {
      "id": "E007",
      "time": "2026-10-17T14:25:00.000Z",
      "text": "[2:25 PM] Noor: flipped inventory_cache_v2 off; checking effect",
      "kind": "note",
      "sources": [
        "examples/raw/slack-export.txt:4"
      ]
    },
    {
      "id": "E008",
      "time": "2026-10-17T14:31:00.000Z",
      "text": "[2:31 PM] Eli: mitigation verified: inventory latency under 500ms for 6 minutes",
      "kind": "note",
      "sources": [
        "examples/raw/slack-export.txt:3"
      ]
    },
    {
      "id": "E009",
      "time": "2026-10-17T14:47:00.000Z",
      "text": "[2:47 PM] Noor: confirmed cache TTL was zero after PR #681; schema allowed zero",
      "kind": "diagnosis",
      "sources": [
        "examples/raw/slack-export.txt:1"
      ]
    },
    {
      "id": "E010",
      "time": "2026-10-17T15:03:22.000Z",
      "text": "2026-10-17 15:03:22 UTC deploy: inventory-api reverted PR #681",
      "kind": "mitigation",
      "sources": [
        "examples/raw/deploy.log:3"
      ]
    },
    {
      "id": "E011",
      "time": "2026-10-17T15:19:40.000Z",
      "text": "resolved_at: inventory-api p99 latency above 800ms",
      "kind": "note",
      "sources": [
        "examples/raw/pagerduty.json#/alerts/0/resolved_at"
      ]
    }
  ],
  "milestones": {
    "started": {
      "id": "E002",
      "time": "2026-10-17T14:03:00.000Z",
      "sources": [
        "examples/raw/deploy.log:2"
      ]
    },
    "detected": {
      "id": "E003",
      "time": "2026-10-17T14:10:12.000Z",
      "sources": [
        "examples/raw/pagerduty.json#/alerts/0/triggered_at"
      ]
    },
    "diagnosed": {
      "id": "E009",
      "time": "2026-10-17T14:47:00.000Z",
      "sources": [
        "examples/raw/slack-export.txt:1"
      ]
    },
    "mitigated": {
      "id": "E008",
      "time": "2026-10-17T14:31:00.000Z",
      "sources": [
        "examples/raw/slack-export.txt:3"
      ]
    },
    "resolved": {
      "id": "E011",
      "time": "2026-10-17T15:19:40.000Z",
      "sources": [
        "examples/raw/pagerduty.json#/alerts/0/resolved_at"
      ]
    }
  },
  "metrics": {
    "ttd": {
      "seconds": 432,
      "from": "E002",
      "to": "E003"
    },
    "ttcd": {
      "seconds": 2208,
      "from": "E003",
      "to": "E009"
    },
    "ttm": {
      "seconds": 1248,
      "from": "E003",
      "to": "E008"
    },
    "duration": {
      "seconds": 4600,
      "from": "E002",
      "to": "E011"
    }
  },
  "warnings": []
}

    Connects securely to your tools. The creator never sees your data.

    About this skill

    An incident report needs evidence you can check. Postmortem Forge reads local exports, keeps the source beside each event, and calculates durations after you review the milestones.

    The important boundary: a deploy does not prove when impact started. A rollback attempt does not prove recovery. Suggested tags stay suggestions, and missing milestones return unknown.

    What you get:

    • A UTC timeline builder for timestamped text, Slack JSON exports, PagerDuty lifecycle records and deploy logs. It preserves dates and seconds, handles explicit timezone offsets, sorts events and merges exact duplicates without dropping their sources.
    • A Markdown report linter. Missing sections, vague tasks, and action items without an owner, a valid ISO due date or a verification step fail the check. Blame language, timeline gaps, metric presence and Prevent/Detect/Mitigate coverage produce review advisories.
    • A contributing-factors playbook, report template and runnable synthetic example. The example includes the raw evidence, reviewed milestone IDs and a finished report. You can also lint a report you already wrote.

    Use it for a blameless incident postmortem, root cause analysis (RCA), outage report, post-incident review (PIR), or correction-of-error (COE) draft.

    The included example contains 11 events. TTD is 7m12s, measured from the first observed timeout to the alert. The flag is switched off before mitigation is verified. Those are separate events on purpose.

    Requires Node.js 18+ and an agent that can run local scripts. No package installation or API keys. Scripts make no network requests; your agent's usual provider policy still applies to any evidence or output it receives.

    Limits: the parser supports documented export shapes, not every vendor format. Clock-only messages require a date and UTC offset. Named timezones and daylight-saving transitions need explicit offsets. Optional masking catches common secrets, emails and IPv4 patterns, but it cannot guarantee safe sharing. Human review remains necessary.

    How to use

    Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill passes our trust checks below.

    Security scanned

    Passed our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    Money-back guarantee

    Doesn't do what its page promises? You get your money back.

    Trust & safety

    Security scanned

    Verified clean 2 days ago

    • Passed all security checks, Safe to install

    Requires

    Node.js 18+

    Listed2 days ago

    What's inside

    Frequently Asked Questions