agentsclimarketplace

Recover security incident

Skill gaelic-ghost/socket/plugins/cybersecurity-skills/skills/recover-security-incident

The Source for macOS Agent Workflows

Install
npx -y skills add gaelic-ghost/socket --skill recover-security-incident

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 6 stars6 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Eradicate verified compromise mechanisms, restore trusted service, and monitor after a cybersecurity incident. Use when affected hosts, identities, applications, cloud resources, network controls, or data need rebuild/restore, patching, secret rotation, configuration repair, validation, staged return to service, temporary-control removal, lessons learned, and residual-risk ownership.

SKILL.md

2.3 KB, 349 tokens by cl100k_base, as published. Nobody here has run it

Recover Security Incident

Overview

Return systems and people to a trusted operating state using explicit eradication and validation criteria. Recovery is complete only when restored behavior, security controls, access, monitoring, and residual risk are verified.

Read references/recovery-gates.md for staged return-to-service gates.

Workflow

  1. Establish eradication criteria.
    • Identify root/access path, persistence, affected identities/secrets, vulnerable configuration/code, related artifacts, and known scope.
  2. Choose restore basis.
    • Decide clean rebuild, known-good backup, patched image, repaired configuration, provider recovery, or controlled cleanup from evidence and integrity confidence.
  3. Eradicate.
    • Remove verified mechanisms, patch or mitigate the entry path, rotate/revoke secrets and sessions from trusted systems, repair policies/configuration, and preserve evidence of changes.
  4. Restore in stages.
    • Validate offline or isolated, restore dependencies/data, enable limited traffic/users, monitor, then broaden service.
  5. Verify security and function.
    • Reproduce the original detection/path as a negative test, confirm expected functionality, review access/persistence/network/logging, and check backups and monitoring.
  6. Remove temporary controls deliberately.
    • Inventory emergency rules, disabled services, isolation, temporary accounts, logging, tokens, and exceptions; retain only approved controls with owners/expiry.
  7. Close and improve.
    • Record timeline, root cause, affected scope, actions, notifications, evidence retention, lessons, structural hardening, and residual risk owner.

Output

Return eradication evidence, restore basis, staged recovery results, negative retest, temporary-control disposition, monitoring window, lessons/actions, and residual-risk decision.

What ships with it: 2 files

1.0 KB alongside SKILL.md

agents/

references/

Keep looking

Skills are one crate of 327,069. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.