Repository
dandye/ai-runbooks agent skills
- skills
- 27
- GitHub stars
- 127
- Stars
- 127 (35 forks)
- Licence
- Apache-2.0
- Last push
- Aug 2026
- Created
- May 2025
- ai-agents
- blueteam
- chronicle-siem
- claude-code
- cybersecurity
- gemini
- incident-response
- model-context-protocol
- playbooks
- runbooks
- security-automation
- security-operations
- siem
- soar
- threat-hunting
- threat-intelligence
Install all skills
npx skills add dandye/ai-runbooksAdd --skill <name> for a single skill and -a <agent> to choose the agent (see the agent guides).
Skills in dandye/ai-runbooks, ranked
Ranked by score. Sort bymost stars,trending,newest,recently updated
| # | Skill | Repository | Stars | Used in | Tokens | Auto-check | Licence | Updated |
|---|---|---|---|---|---|---|---|---|
| 1 | Close a case or alert with proper reason and documentation. An agent skill from dandye/ai-runbooks. | dandye/ | 127 | — | ~615 | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
| 2 | Check for existing SIEM alerts and case management entries related to IOCs. | dandye/ | 127 | — | ~624 | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
| 3 | Perform exhaustive analysis of a critical IOC. An agent skill from dandye/ai-runbooks. | dandye/ | 127 | — | ~1.1k | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
| 4 | Enrich an IOC (IP, domain, hash, URL) with threat intelligence. | dandye/ | 127 | — | ~702 | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
| 5 | Search for existing cases related to specific indicators or entities. | dandye/ | 127 | — | ~562 | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
| 6 | Complete Tier 1 triage workflow. An agent skill from dandye/ai-runbooks. | dandye/ | 127 | — | ~1.8k | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
| 7 | 7.Hunt Apt Hunt for a specific APT/threat actor in your environment. An agent skill from dandye/ai-runbooks. | dandye/ | 127 | — | ~1.1k | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
| 8 | 8.Hunt Ioc Hunt for specific IOCs across your environment. An agent skill from dandye/ai-runbooks. | dandye/ | 127 | — | ~958 | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
| 9 | Conduct proactive, hypothesis-driven threat hunting. An agent skill from dandye/ai-runbooks. | dandye/ | 127 | — | ~1.4k | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
| 10 | Hunt for credential access techniques like LSASS dumping or browser credential theft. | dandye/ | 127 | — | ~1.1k | Automated safety check: Warn | Apache-2.0 | 1 mo ago |
| 11 | 11.Pivot On Ioc Explore GTI relationships for an IOC to discover related entities. | dandye/ | 127 | — | ~690 | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
| 12 | Respond to a malware incident following PICERL methodology. An agent skill from dandye/ai-runbooks. | dandye/ | 127 | — | ~1.5k | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
| 13 | Respond to a ransomware incident following PICERL methodology. | dandye/ | 127 | — | ~1.7k | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
| 14 | 14.Triage Alert Triage a security alert or case. An agent skill from dandye/ai-runbooks. | dandye/ | 127 | — | ~1.2k | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
| 15 | Triage suspicious login alerts like impossible travel, untrusted location, or multiple failures. | dandye/ | 127 | — | ~1k | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
| 16 | Add a comment to a case to document findings, actions, or recommendations. | dandye/ | 127 | — | ~450 | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
| 17 | Check for duplicate or similar cases. An agent skill from dandye/ai-runbooks. | dandye/ | 127 | — | ~480 | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
| 18 | Ask the user to confirm before taking a significant action. An agent skill from dandye/ai-runbooks. | dandye/ | 127 | — | ~523 | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
| 19 | Save investigation findings to a markdown report file. An agent skill from dandye/ai-runbooks. | dandye/ | 127 | — | ~587 | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
| 20 | Generate hierarchical site structure and navigation maps. An agent skill from dandye/ai-runbooks. | dandye/ | 127 | — | ~583 | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
| 21 | Generate controlled vocabulary thesaurus for content domains. | dandye/ | 127 | — | ~656 | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
| 22 | Identify content gaps and organizational opportunities. An agent skill from dandye/ai-runbooks. | dandye/ | 127 | — | ~568 | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
| 23 | Automated content similarity and grouping analysis. An agent skill from dandye/ai-runbooks. | dandye/ | 127 | — | ~484 | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
| 24 | Develop hierarchical classification systems. An agent skill from dandye/ai-runbooks. | dandye/ | 127 | — | ~561 | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
| 25 | Comprehensive content quality and maintenance assessment. An agent skill from dandye/ai-runbooks. | dandye/ | 127 | — | ~636 | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
| 26 | Design comprehensive metadata frameworks. An agent skill from dandye/ai-runbooks. | dandye/ | 127 | — | ~588 | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
| 27 | Systematic cataloging of information assets. An agent skill from dandye/ai-runbooks. | dandye/ | 127 | — | ~621 | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
Questions, answered from the data.
What is the best skill in dandye/ai-runbooks?
Close Case Artifact from dandye/ai-runbooks ranks first of the 27 skills in dandye/ai-runbooks listed here, with the highest score: its repository has 127 GitHub stars, its SKILL.md loads about 615 tokens and it passes the automated safety check with no findings. Next come Correlate Ioc and Deep Dive Ioc.
Are the skills in dandye/ai-runbooks official?
None yet. All 27 skills in dandye/ai-runbooks listed here come from community repositories; a skill counts as official when the product's own GitHub organization publishes it.
How do I install all skills from dandye/ai-runbooks?
Run npx skills add dandye/ai-runbooks in your project: the open-source skills CLI installs the repository's skills into your coding agent's skills folder. To install a single skill, open its page here for the exact command.
How are these skills ranked?
By Skill Navigator score, which combines the GitHub stars of the skill's repository (shared across that repo's skills and discounted for large collections), how many other GitHub owners carry a copy of the skill, and automated SKILL.md quality checks, minus penalties for safety-check warnings and for each further skill from the same repository. Skills that fail the safety check are not listed.