Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/bouob/sysadmin-skills/postmortemnpx skills add bouob/sysadmin-skills --skill postmortemgit clone --depth 1 https://github.com/bouob/sysadmin-skillsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00209 | $0.02094 |
| Opus 5 | $0.00105 | $0.01047 |
| Sonnet 5 | $0.00042 | $0.00419 |
| Haiku 4.5 | $0.00021 | $0.00209 |
Grade A, and why
postmortem scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 201 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Blameless Postmortem Workflow
Structured post-incident learning following Google SRE blameless postmortem culture. Produces a postmortem document that focuses on systemic contributing factors and actionable improvements — not individual blame.
Related Skills (auto-loaded)
- itil — reads
references/sre-integration.mdfor blameless culture principles and error budget context - done-ops — confirmation that the incident is fully resolved before starting the postmortem
Blameless Culture — Why It Matters
Traditional post-incident reviews can become blame-focused, which creates incentives to hide mistakes. Blameless postmortems assume:
Everyone involved was acting in good faith with the information and tools available to them at the time.
The goal is to find what made the failure possible at the system level — and fix those things. People don't fail; systems create conditions where failures become likely.
For full blameless culture guidance, read references/blameless-templates.md.
Output
File: {OUTPUT_DIR}/postmortem-{YYYY-MM-DD}-{slug}.md
- slug: kebab-case summary of the incident, e.g.
payment-api-timeout,auth-service-outage - Link to the incident report if one exists from the
/incidentskill
Default output directory: ./postmortems/. If a docs/postmortems/ directory exists, use that instead.
All postmortem documents are written in English. Preview for the user in their preferred language before writing.
When to Use Each Review Type
| Situation | Use |
|---|---|
| SEV-1 or SEV-2 incident, regardless of root cause | /postmortem (mandatory) |
| SEV-3 with complex contributing factors | /postmortem (recommended) |
| Root cause unknown, likely to recur | /problem (for technical tracking) + /postmortem (for learning) |
| Formal compliance/regulatory PIR required | Traditional ITIL PIR (can run alongside /postmortem) |
| Sprint retrospective | Use team's agile retro format — not this skill |
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 201 lines · 209 tokens per session scan A 54c00f292a06
postmortem is a skill published in the GitHub repository bouob/sysadmin-skills (2 stars, last pushed 3mo ago), licensed MIT. It adds 209 tokens to every session and 2,094 once invoked, about $0.0010 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
servicenow-change-management
ITSM change-management operations on the ServiceNow Change API via the servicenow-api MCP server — the full change-request lifecycle: query changes, tasks, schedules, CIs, models and standard-change templates; create/update changes and change-tasks; run risk calculation and conflict checks; approve; and delete. Use…
security-change-rollout-planning
Plan and execute a security change rollout across a service or fleet: classify the change into a time horizon (short / medium / long-term), triage affected systems by risk tier, select the appropriate rollout strategy with canarying and staged deployment, define communication strategy (internal and external), set…
abusing-dpapi-for-credential-access
Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key. Use during authorized red-team…
analyzing-apt-group-with-mitre-navigator
Query ATT&CK data with attackcti, mitreattack-python, and stix2, then build MITRE ATT&CK Navigator layers and multi-layer heatmap overlays mapping one or more APT groups' TTPs for detection-gap analysis. Use to compare threat-actor technique coverage, find gaps in detection engineering, or produce Navigator…
analyzing-bootkit-and-rootkit-samples
Analyzes bootkit and advanced rootkit malware infecting the Master Boot Record (MBR), Volume Boot Record (VBR), or UEFI firmware for below-OS persistence, covering boot sector analysis, UEFI module inspection, and anti-rootkit detection. Use when compromise survives OS reinstallation or antivirus/EDR fails to detect…
analyzing-cobalt-strike-beacon-configuration
Extract and analyze Cobalt Strike beacon configuration from PE files and memory dumps to identify C2 infrastructure, malleable profiles, and operator tradecraft.