Search
Incident response
Skills
Sort:BestMost starsTrending todayTrending this weekTrending this monthNewestRecently updatedName
| # | Skill | Repository | Stars | Used in | Tokens | Auto-check | Licence | Updated |
|---|---|---|---|---|---|---|---|---|
| 97 | Performs tabletop exercises for SOC teams simulating security incidents through discussion-based scenarios to test incident response procedures, communication workflows, and decision-making under… | mukul975/ | 34k | — | ~4.2k | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
| 98 | Create structured incident response runbooks with step-by-step procedures, escalation paths, and recovery actions. | wshobson/ | 40k | — | ~1.4k | Automated safety check: Pass | MIT | 6 days ago |
| 99 | Master on-call shift handoffs with context transfer, escalation procedures, and documentation. | wshobson/ | 40k | — | ~917 | Automated safety check: Pass | MIT | 6 days ago |
| 100 | A skill your agent uses when a security incident has been detected or declared and needs classification, triage, escalation path determination, and forensic evidence collection. | alirezarezvani/ | 28k | — | ~3.8k | Automated safety check: Pass | MIT | 1 mo ago |
| 101 | Generate operational runbooks from a service name — deployment, incident response, maintenance, and rollback workflows. | alirezarezvani/ | 28k | — | ~535 | Automated safety check: Pass | MIT | 1 mo ago |
| 102 | 102.Senior Security A skill your agent uses when the user asks for STRIDE threat modeling, DREAD risk scoring, data-flow-diagram threat analysis, or a quick secret scan — or when a security request needs routing to the… | alirezarezvani/ | 28k | — | ~1.3k | Automated safety check: Pass | MIT | 1 mo ago |
| 103 | 103.Vpe Advisor VP of Engineering advisory for startups: delivery throughput (DORA 4 metrics + bottleneck identification), engineering hiring funnel (sourcing → screen → onsite → offer conversion + time-to-fill +… | alirezarezvani/ | 28k | — | ~3.3k | Automated safety check: Pass | MIT | 1 mo ago |
| 104 | Guide incident response from detection to post-mortem using SRE principles, severity classification, on-call management, blameless culture, and communication protocols. | ancoleman/ | 525 | — | ~3.6k | Automated safety check: Pass | MIT | 10 mo ago |
| 105 | 105.It Operations Manages IT infrastructure, monitoring, incident response, and service reliability. | davila7/ | 33k | 1 repo | ~3.7k | Automated safety check: Pass | MIT | yesterday |
| 106 | Production-ready templates for incident response runbooks covering detection, triage, mitigation, resolution, and communication. | aiskillstore/ | 433 | 8 repos | ~2.8k | Automated safety check: Pass | No licence | yesterday |
| 107 | Effective patterns for on-call shift transitions, ensuring continuity, context transfer, and reliable incident response across shifts. | aiskillstore/ | 433 | 8 repos | ~2.9k | Automated safety check: Pass | No licence | yesterday |
| 108 | Facilitate structured post-incident reviews to identify root causes, document what worked and failed, and produce actionable recommendations to improve future incident response. | mukul975/ | 34k | — | ~1.7k | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
| 109 | Systematically deobfuscates multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure. | mukul975/ | 34k | — | ~3.5k | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
| 110 | Deploy and configure Velociraptor for scalable endpoint forensic artifact collection during incident response using VQL queries, hunts, and pre-built artifact packs across Windows, Linux, and macOS… | mukul975/ | 34k | — | ~2.3k | Automated safety check: Notes | Apache-2.0 | 1 mo ago |
| 111 | Perform forensic acquisition of cloud storage services including Google Drive, OneDrive, Dropbox, and Box by pulling API-based remote data such as revision history and audit logs, and collecting… | mukul975/ | 34k | — | ~3.5k | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
| 112 | Automates the full SSL/TLS certificate lifecycle, including generating Certificate Signing Requests, issuing, deploying, monitoring, renewing, and revoking X.509 certificates, using Python and ACME… | mukul975/ | 34k | — | ~867 | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
| 113 | The Common Vulnerability Scoring System (CVSS) is the industry standard framework maintained by FIRST (Forum of Incident Response and Security Teams) for assessing vulnerability severity. | mukul975/ | 34k | — | ~1.9k | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
| 114 | Inspects Filestore capacity and utilization on Google Cloud, evaluates storage scaling rules, and performs capacity autoscaling (scale UP for low free space or scale DOWN for cost optimization). | google/ | 21k | — | ~3.2k | Automated safety check: Pass | Apache-2.0 | yesterday |
| 115 | Expert DevOps troubleshooter specializing in rapid incident response, advanced debugging, and modern observability. | aiskillstore/ | 433 | 7 repos | ~2.5k | Automated safety check: Pass | No licence | yesterday |
| 116 | Identify ransomware-related network indicators, including C2 beaconing patterns, TOR exit node connections, data exfiltration flows, and encryption key exchange, by analyzing Zeek conn.log and… | mukul975/ | 34k | — | ~796 | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
| 117 | Executes containment strategies to stop active adversary operations and prevent lateral movement during a confirmed security breach. | mukul975/ | 34k | — | ~2.7k | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
| 118 | Uses Rekall memory forensics framework to analyze memory dumps for process hollowing, injected code via VAD anomalies, hidden processes, and rootkit detection. | mukul975/ | 34k | — | ~642 | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
| 119 | Hunts for MITRE ATT&CK T1098 account manipulation - shadow admin creation, SID history injection, group membership changes, and credential modifications - by analyzing Windows Security Event Log IDs… | mukul975/ | 34k | — | ~730 | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
| 120 | Detects suspicious Windows service installations (MITRE ATT&CK T1543.003) by parsing System event log Event ID 7045, analyzing service binary paths, and flagging indicators of persistence mechanisms… | mukul975/ | 34k | — | ~677 | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
| 121 | Parse Windows forensic artifacts—$MFT/$J (MFTECmd), Prefetch (PECmd), registry hives (RECmd), shellbags, and Amcache—into normalized CSV/JSON with Eric Zimmerman's EZ Tools, then load results into… | mukul975/ | 34k | — | ~2k | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
| 122 | Enrich malware file hashes (MD5, SHA-1, SHA-256) using the VirusTotal API v3 to retrieve multi-engine detection rates, sandbox behavioral analysis, YARA rule matches, related indicators, and… | mukul975/ | 34k | — | ~3.6k | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
| 123 | Analyze volatile memory (RAM) dumps using the Volatility 3 framework to extract running processes, network connections, loaded modules, credentials, and encryption keys, and to detect process… | mukul975/ | 34k | — | ~3k | Automated safety check: Notes | Apache-2.0 | 1 mo ago |
| 124 | Analyzes network traffic generated by malware during sandbox execution or live incident response to identify C2 protocols, data exfiltration channels, payload downloads, and lateral movement… | mukul975/ | 34k | — | ~3k | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
| 125 | 125.Error Monitoring A skill your agent uses when setting up a new project's production observability stack, reviewing incident response readiness, or investigating why errors are going undetected. | thedaviddias/ | 74k | — | ~556 | Automated safety check: Pass | MIT | 5 days ago |
| 126 | A skill your agent uses when training SDRs on calls, building call frameworks, or handling common phone scenarios — a 1-minute cold call script in 5 steps, a no-show phone script, and objection… | swan-gtm/ | 172 | — | ~665 | Automated safety check: Pass | MIT | 3 days ago |
| 127 | Triage PostHog error tracking issues during a daily or on-call review. | PostHog/ | 40k | — | ~1.9k | Automated safety check: Pass | Unknown | yesterday |
| 128 | Audit JS/TS projects against NPM Security Guidelines covering project setup, dependency hygiene, CI/CD pipeline, Dependabot, and incident response. | c0x12c/ | 106 | — | ~1.6k | Automated safety check: Warn | No licence | 3 mo ago |
| 129 | A skill your agent uses when an outage, production incident, or significant service degradation has occurred and the team needs to write a structured blameless post-mortem. | github/ | 40k | — | ~1.8k | Automated safety check: Pass | MIT | 2 days ago |
| 130 | 130.Malware Analyst Expert malware analyst specializing in defensive malware research, threat intelligence, and incident response. | aiskillstore/ | 433 | 6 repos | ~1.7k | Automated safety check: Pass | No licence | yesterday |
| 131 | 131.Rescue Triage an outage, loss of stakeholder trust or a failing engagement direction. | suboss87/ | 957 | — | ~342 | Automated safety check: Pass | MIT | 2 days ago |
| 132 | Diagnose and respond to production incidents. An agent skill from agulli/atlas-agents. | agulli/ | 579 | — | ~587 | Automated safety check: Pass | MIT | 2 mo ago |
| 133 | Group food ordering through the DoorDash CLI (dd-cli) from a persistent team roster. | davila7/ | 33k | — | ~1.3k | Automated safety check: Pass | MIT | yesterday |
| 134 | 134.Incident Triage Guide rapid triage and initial response to security incidents following NIST SP 800-61 methodology. | briiirussell/ | 413 | — | ~1.5k | Automated safety check: Notes | MIT | 4 mo ago |
| 135 | 135.Soc Operations Build, run, and improve a Security Operations Center — alert prioritization, runbook authoring, escalation criteria, on-call structure, alert tuning workflow, MTTD / MTTR / fidelity KPIs, analyst… | briiirussell/ | 413 | — | ~2.9k | Automated safety check: Pass | MIT | 4 mo ago |
| 136 | Design and run a monitoring system for a website or web app. | rampstackco/ | 945 | — | ~2.6k | Automated safety check: Pass | MIT | 4 days ago |
| 137 | A skill your agent uses when working with incident response incident response | aiskillstore/ | 433 | 8 repos | ~2.8k | Automated safety check: Pass | No licence | yesterday |
| 138 | Route alerts, run on-call rotations, and drive incidents in Grafana IRM / OnCall — integrations (Alertmanager / Grafana Alerting / generic webhook / PagerDuty), Jinja2 routing + grouping templates… | grafana/ | 282 | — | ~1.4k | Automated safety check: Pass | Apache-2.0 | 2 days ago |
| 139 | [Extended thinking: This workflow implements a sophisticated debugging and resolution pipeline that leverages AI-assisted debugging tools and observability platforms to systematically diagnose and res | aiskillstore/ | 433 | 7 repos | ~923 | Automated safety check: Pass | No licence | yesterday |
| 140 | Scan Linux systems for persistence mechanisms including crontab/systemd entries, LDPRELOAD injection, shell profile modifications (.bashrc, .profile), and SSH authorizedkeys backdoors, then… | mukul975/ | 34k | — | ~801 | Automated safety check: Notes | Apache-2.0 | 1 mo ago |
| 141 | Triage playbook for when cold email deliverability breaks. An agent skill from growthenginenowoslawski/coldoutboundskills. | growthenginenowoslawski/ | 753 | — | ~3.5k | Automated safety check: Pass | MIT | 5 days ago |
| 142 | Create operational playbooks for incident response, deployments, and maintenance during PRD v0.8 Deployment & Ops. | mattgierhart/ | 180 | — | ~4.5k | Automated safety check: Notes | MIT | 1 mo ago |
| 143 | Design, audit, or implement application structured logging architecture from repository evidence. | majiayu000/ | 287 | — | ~1.7k | Automated safety check: Pass | MIT | 3 days ago |
| 144 | [omh] Production is down or an incident is open: command an incident that is still open -- severity as declared live state, commander and roles, an append-only timeline, a recorded temporary… | rlaope/ | 3.2k | — | ~2.7k | Automated safety check: Pass | MIT | yesterday |
