Security incident response
Skill Amey-Thakur/AI-SKILLS/skills/security/security-incident-response
Plug-and-play skills and prompts for every AI coding agent
npx -y skills add Amey-Thakur/AI-SKILLS --skill security-incident-responseAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
2 things to look at
- 19 days oldThe repository was created 19 days ago. New is not bad, but a brand new repository carrying a familiar-sounding name is the shape a typosquat arrives in, and there has been no time for anyone else to find a problem with it.
- 4 stars4 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Run a security breach through containment, evidence preservation, and notification duties in the right order, under time pressure, without destroying the record you will need. Use when you suspect or confirm a compromise: leaked credentials, unauthorized access, malware, or exfiltrated data.
SKILL.md
3.4 KB, as published. Nobody here has run it
Security incident response
A breach is discovered mid-panic, and the instinct to "clean it up immediately" is exactly what wipes the forensic trail and violates notification law. Response is a sequence: contain the bleeding without tipping off or erasing the intruder, preserve what happened, then meet the legal clocks that started ticking the moment you knew. Improvising the order costs evidence, or costs a fine.
Method
- Declare the incident and assign a single coordinator. Open a dedicated channel, name one incident commander who owns decisions, and start a timestamped log of every action and finding. Diffuse ownership under pressure produces duplicated work and gaps.
- Contain without destroying evidence. Isolate affected hosts from the network rather than powering them off, which erases volatile memory. Disable or rotate the compromised credentials and revoke active sessions and tokens, so containment does not depend on the attacker's cooperation.
- Preserve the record before you remediate. Snapshot disks, capture memory, and copy relevant logs to write-once storage with hashes, because log retention windows expire and reimaging overwrites the source. You cannot investigate or notify accurately from data you deleted.
- Scope what was actually reached. From the preserved logs, establish entry point, dwell time, which accounts and systems were touched, and what data classes were accessible or exfiltrated. The notification duty depends on this answer, so resist both under- and over-claiming.
- Meet the notification clocks deliberately. GDPR requires notifying the supervisory authority within 72 hours of becoming aware of a personal-data breach; US state laws, HIPAA, PCI DSS, and contracts set their own deadlines. Loop in legal and privacy counsel early: they, not engineering, own the disclosure decision and wording.
- Eradicate, recover, then verify. Remove the foothold, patch the entry vector, restore from known-clean backups, and rotate every secret the attacker could have seen. Watch the restored systems before declaring closure, since attackers plant persistence.
- Run a blameless postmortem. Document timeline, root cause, and the control that would have caught it earlier, and turn each into a tracked action. An incident that teaches nothing invites its own rerun.
Signals
- Is there one incident commander and a timestamped action log?
- Were disks and memory snapshotted before any host was reimaged?
- Is the personal-data notification clock (72 hours for GDPR) being tracked against a known "aware" timestamp?
- Were all potentially exposed credentials and tokens rotated, not just the one known-leaked pair?
Boundaries
This is the operational spine, not legal advice: statutory and contractual duties vary by jurisdiction, data type, and industry, and counsel owns the disclosure call. It assumes preparation exists elsewhere (logging, backups, an on-call rota); a plan first drafted during the breach will show its seams.