Menu
[experimental] Generate a structured post-incident retrospective from incident data. Forked-subagent flow may not have MCP access in all Claude Code contexts.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Set up the Rootly plugin. Verifies MCP server connection via OAuth2 or API token and guides through configuration. Run this after installing the plugin.
Manage incident action items from the terminal. Subcommands - list (default - your open action items) or add <incident> "<summary>" (create one on an incident). Use to capture follow-ups during or after an incident without opening the Rootly UI.
Draft a stakeholder-facing status update for an active incident, then post it after explicit confirmation. Useful for incident commanders pushing public-status-page or internal updates without opening the Rootly UI. Write action - never posts without confirming.
Offer to cover someone else's on-call shift. Lists upcoming shifts on a team or schedule and creates an override placing you on the chosen one after explicit confirmation. Write action - never executes without confirming.
Request someone to cover one of your upcoming on-call shifts. Lists your shifts, helps identify a candidate based on availability, and creates an override after explicit confirmation. Write action - never executes without confirming.
Triage a Rootly alert by short ID. Pulls the alert record, its event timeline, related alerts in the same group, and any incident the alert is attached to. Use when a page comes in and you want context before opening Rootly.
| name | retro |
| description | [experimental] Generate a structured post-incident retrospective from incident data. Forked-subagent flow may not have MCP access in all Claude Code contexts. |
| argument-hint | ["incident-id"] |
| disable-model-invocation | true |
| context | fork |
| agent | rootly:retro-analyst |
| allowed-tools | ["mcp__rootly__*"] |
Experimental: this skill uses
context: forkto delegate to theretro-analystagent. In some Claude Code contexts the forked subagent does not inherit the plugin's MCP tools. If the agent reports MCP tools unavailable, use/rootly:brief <incident>for a basic incident summary instead.
You are generating a structured post-incident retrospective. The output should be copy-pasteable markdown.
The incident ID should be provided in $ARGUMENTS. If not provided, ask the user for it.
mcp__rootly__getIncident for the full incident recordstarted (still active), warn the user: "This incident is still active. Retrospectives are typically done after resolution. Continue anyway?" Wait for confirmation before proceeding.mcp__rootly__get_alert_by_short_id or alert search tools for the alert timelinemcp__rootly__find_related_incidents to check for recurring patternsOutput as clean, copy-pasteable markdown:
# Retrospective: [Incident Title]
**Incident ID**: [id]
**Date**: [date]
**Duration**: [start] to [end] ([total duration])
**Severity**: [severity]
## Summary
[1-2 sentence summary of what happened]
## Impact
- **Duration**: [time from detection to resolution]
- **Affected services**: [list]
- **Severity**: [level]
- **User impact**: [description if available]
## Timeline
| Time | Event |
|------|-------|
| [time] | [event] |
| ... | ... |
## Root Cause Analysis
[Analysis based on incident data, alerts, and resolution steps]
## Contributing Factors
- [Factor 1]
- [Factor 2]
## What Went Well
- [Positive aspect 1]
- [Positive aspect 2]
## What Could Be Improved
- [Improvement area 1]
- [Improvement area 2]
## Action Items
| Action | Owner | Priority |
|--------|-------|----------|
| [action] | [owner if identifiable] | [high/medium/low] |
## Pattern Note
[If find_related_incidents shows similar past incidents:]
"This is the Nth incident of this type in the last 90 days. Consider systemic fixes."
[If no similar incidents: omit this section]
Base the analysis on actual incident data. Do not fabricate details. If information is unavailable, note it as "Not available in incident data" rather than guessing.