agentsclimarketplace

Security incident response

Skill planifest/planifest-framework/planifest-framework/external-skills/security-incident-response

A specification framework for agentic development. Agents build from complete specs - not guesses.

Install
npx -y skills add planifest/planifest-framework --skill security-incident-response

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Security incident workflow for triage, containment, eradication, and recovery evidence handling. Use when suspected or confirmed security incidents require coordinated response actions; do not use for proactive threat modeling or routine vulnerability backlog grooming.

SKILL.md

2.5 KB, as published. Nobody here has run it

Security Incident Response

Overview

Use this skill to run a structured response that minimizes blast radius, preserves evidence, and restores service safely.

Scope Boundaries

  • Indicators of compromise or security alerts require investigation.
  • Active abuse is suspected and containment decisions are needed.
  • Security incident communications and recovery criteria must be formalized.

Templates And Assets

  • Incident timeline template:
    • assets/security-incident-timeline-template.md

Inputs To Gather

  • Detection source, initial evidence, and confidence level.
  • Affected systems, data classes, and business criticality.
  • Available responders and escalation contacts.
  • Legal/compliance notification obligations and time limits.

Deliverables

  • Incident timeline with key decisions and evidence references.
  • Containment and eradication action plan with owner and deadline.
  • Stakeholder communication record and regulatory decision log.
  • Recovery validation checklist and follow-up prevention actions.

Workflow

  1. Classify severity using impact, exploitability, and blast-radius evidence.
  2. Start timeline capture with assets/security-incident-timeline-template.md.
  3. Establish a command structure (incident lead, forensic owner, comms owner).
  4. Contain actively exploited paths first, preserving forensic artifacts before destructive cleanup when feasible.
  5. Scope affected identities, services, data stores, and downstream dependencies.
  6. Eradicate root access path, rotate exposed credentials, and patch exploited weaknesses.
  7. Recover in staged rollout with explicit rollback criteria and heightened monitoring.
  8. Publish a post-incident action list with prevention owners and due dates.

Quality Standard

  • Severity classification is evidence-based and revisited as facts evolve.
  • Containment actions are traceable and reversible when possible.
  • Evidence handling preserves chain-of-custody requirements.
  • Recovery criteria include security validation, not only availability checks.

Failure Conditions

  • Stop when roles and decision authority are unclear.
  • Stop when evidence is being destroyed without explicit incident lead approval.
  • Escalate when potential legal notification thresholds are crossed.

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.