Turn a postmortem into an on-call SKILL.md runbook
Claude compresses an incident postmortem into an executable SKILL.md runbook: detection signals, mitigation steps, escalation, and verify checks an agent or human can follow under pressure.
A committed runbook skill linked from the postmortem, with timelines removed and action items turned into numbered steps with owners replaced by roles.
- 1
Paste the postmortem with the timeline
The skill needs the failed paths, not only root cause. Steps people actually ran belong in mitigation, even if they were wrong.
- 2
Commit under your agent-skills or ops folder
Link SKILL.md from the postmortem doc and from the service README. On-call should not hunt in chat for the file.
- 3
Tabletop one step
Walk through detection and first mitigation in a drill. Update Verify lines that were ambiguous before you trust the skill in production.
The prompt to paste
Convert this incident postmortem into an on-call runbook as SKILL.md. The postmortem is narrative; the skill must be runnable at 3am without reading the whole doc. Postmortem paste: [timeline, impact, root cause, what mitigated, what failed, follow-up tickets] Systems and tools named in the incident: [monitoring, dashboards, CLI, kubectl contexts, feature flags — names only] Deliver SKILL.md with: 1. Purpose — one sentence: respond to recurrence of [incident class] using verified steps. 2. When to use / when not to use (symptoms that match vs similar false alarms). 3. Severity and escalation: who to page, in role terms (on-call primary, service owner) — pull names from postmortem if present, else [define in team roster]. 4. Detection: signals to look for (metrics, logs, alerts) with dashboard links or query snippets copied from the postmortem only. 5. Mitigation steps — numbered, each ending with Verify: and a concrete check (metric threshold, command exit 0, user-visible recovery). 6. Communication template: three bullets for status update (impact, action, next update time) — no marketing language. 7. Rollback or kill-switch steps if the postmortem mentions them; otherwise write "not documented — add before relying on this skill." 8. Pitfalls from the postmortem: five mistakes that slowed response, rewritten as do-not-do bullets. 9. Done means: incident mitigated, escalation completed if needed, follow-up ticket ids listed, postmortem link stored in skill header comment. Rules: - Do not invent runbook steps not supported by the postmortem; mark gaps as [add verification]. - Do not paste secrets, tokens, or customer data from the postmortem — redact to placeholders. - Markdown only, no preamble outside SKILL.md.
Postmortems age when architecture changes. Put a last-reviewed date in the skill header and tie refreshes to migrations or flag renames.
Sample case written by Hidden Logic Lab. Not affiliated with Claude or Claude Code or Cursor.
More in Operations
Get new cases in your inbox
Weekly notes on new use cases and agent workflows. No product pitches.