security-incident-response
Run or document a security incident response — contain, eradicate, recover, and learn. Use when responding to a breach/compromise/security incident, writing an IR plan or runbook, or producing a post-incident report. Produces a phase-by-phase response (triage, contain, eradicate, recover, post-incident) with the immediate actions, comms, evidence-handling, and a blameless review. For incidents on systems you own or defend.
npx skills add mohitagw15856/pm-claude-skills --skill security-incident-response --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Security Incident Response Skill In a security incident, the order of operations matters: contain before you clean, preserve evidence before you wipe, and communicate deliberately. This skill drives a structured response through the standard phases, or documents one after the fact — with the immediate actions, decision points, comms, and a blameless post-incident review. For systems you own or are authorized to defend. ## Required Inputs Ask for these only if they aren't already provided: - **What's happening** — the observed incident (malware, unauthorized access, data exfiltration, ransomware, account compromise), and how it was detected. - **Scope so far** — affected systems/accounts/data, whether it's ongoing, entry point if known. - **Environment & stakes** — what's at risk (PII, funds, availability), regulatory/notification obligations. - **Resources** — who's responding, tooling/access available, and any IR plan already in place. ## Output Format ### Incident response: [incident] **Severity & summary** — classify severity (e.g. SEV1–3) and state, in two lines, what's known and what's at stake. **Phase-by-phase actions:** 1. **Triage & declare** — confirm it's a real incide
- Required Inputs
- Output Format
- Incident response: [incident]
- Quality Checks
- Anti-Patterns
- Based On
What does the security-incident-response skill do?
Run or document a security incident response — contain, eradicate, recover, and learn. Use when responding to a breach/compromise/security incident, writing an IR plan or runbook, or producing a post-incident report. Produces a phase-by-phase response (triage, contain, eradicate, recover, post-incident) with the immediate actions, comms, evidence-handling, and a blameless review. For incidents on systems you own or defend.
How do I install it?
Run `npx skills add mohitagw15856/pm-claude-skills --skill security-incident-response --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From mohitagw15856/pm-claude-skills, a repository with 1,255 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.