Incident Response
BagelHole/DevOps-Security-Agent-Skills
Handle security incidents with IR playbooks and procedures. An agent skill from BagelHole/DevOps-Security-Agent-Skills.
Runs a security incident from detection to closure — triage, containment, investigation, communication, and the review afterward.
Install Incident Response
$ npx skills add cbrock84/headcount --skill incident-response -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install cbrock84/headcount incident-response --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/cbrock84/headcount.git skills-src && mkdir -p .claude/skills && cp -r skills-src/plugins/security/skills/incident-response .claude/skills/incident-response && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "incident-response" agent skill from https://github.com/cbrock84/headcount/tree/main/plugins/security/skills/incident-response into .claude/skills/incident-response/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "incident-response", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/cbrock84/headcount/tree/main/plugins/security/skills/incident-responseType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add cbrock84/headcount --skill incident-response -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install cbrock84/headcount incident-response --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/cbrock84/headcount.git skills-src && mkdir -p .agents/skills && cp -r skills-src/plugins/security/skills/incident-response .agents/skills/incident-response && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "incident-response" agent skill from https://github.com/cbrock84/headcount/tree/main/plugins/security/skills/incident-response into .agents/skills/incident-response/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "incident-response", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add cbrock84/headcount --skill incident-response -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install cbrock84/headcount incident-response --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/cbrock84/headcount.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/plugins/security/skills/incident-response .cursor/skills/incident-response && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "incident-response" agent skill from https://github.com/cbrock84/headcount/tree/main/plugins/security/skills/incident-response into .cursor/skills/incident-response/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "incident-response", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/cbrock84/headcount.git --path plugins/security/skills/incident-response--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add cbrock84/headcount --skill incident-response -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install cbrock84/headcount incident-response --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/cbrock84/headcount.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/plugins/security/skills/incident-response .gemini/skills/incident-response && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "incident-response" agent skill from https://github.com/cbrock84/headcount/tree/main/plugins/security/skills/incident-response into .gemini/skills/incident-response/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "incident-response", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install cbrock84/headcount incident-responseInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add cbrock84/headcount --skill incident-response -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/cbrock84/headcount.git skills-src && mkdir -p .github/skills && cp -r skills-src/plugins/security/skills/incident-response .github/skills/incident-response && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "incident-response" agent skill from https://github.com/cbrock84/headcount/tree/main/plugins/security/skills/incident-response into .github/skills/incident-response/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "incident-response", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add cbrock84/headcount --skill incident-response -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install cbrock84/headcount incident-response --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/cbrock84/headcount.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/plugins/security/skills/incident-response .opencode/skills/incident-response && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "incident-response" agent skill from https://github.com/cbrock84/headcount/tree/main/plugins/security/skills/incident-response into .opencode/skills/incident-response/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "incident-response", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
incident-response- GitHub stars
- 2k
- Token cost
- ~1k tokens
- SKILL.md length
- 580 words
- Files
- 2 (incl. references)
- Skills in repo
- 178
- Repo updated
- First seen
- Licence
- MIT
At a glance
Runs a security incident from detection to closure — triage, containment, investigation, communication, and the review afterward.
- Notification obligations
- SKILL.md covers Decide it is an incident, and…, Order of operations, Communication and Afterward, plus 3 more sections
- Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
- Tasks that involve Incident response
What it does
Incident Response is an agent skill from cbrock84/headcount. Runs a security incident from detection to closure — triage, containment, investigation, communication, and the review afterward. Use this when a compromise is suspected or confirmed, when preparing an incident response plan or running an exercise, when deciding whether something is an incident, or when a breach may trigger notification obligations.
Its SKILL.md is about 1k tokens, which your agent loads only when the skill is triggered. The skill folder holds 2 other files, including reference files (for example `references/sources.md`).
It sits in DevOps & Cloud, covering Incident response and Security operations. The repository describes itself as: An agent organization structured as a company — 15+ departments, 125+ skills, each independently installable, citing the standards and regulators that settle the question. Runs… The licence is MIT.
When your agent uses it
- Notification obligations
- Tasks that involve Incident response
- Tasks that involve Security operations
Example prompts
- “/incident-response”
What it can do on your machine
Read from SKILL.md and the folder at commit 98d1c17. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md.
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Incident Response loads about 1k tokens when it runs, and up to ~1.5k if it reads all its reference files. Until then it costs about 92 tokens; SKILL.md has 580 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from cbrock84/headcount at commit 98d1c17, republished under its MIT licence (© cbrock84). 580 words, ~1,019 tokens.
Download SKILL.mdSave it as
.claude/skills/incident-response/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.- name
- incident-response
- description
- Runs a security incident from detection to closure — triage, containment, investigation, communication, and the review afterward. Use this when a compromise is suspected or confirmed, when preparing an incident response plan or running an exercise, when deciding whether something is an incident, or when a breach may trigger notification obligations.
Incident response
Breach notification runs on statutory clocks, measured in hours in several regimes. Involve Legal & Risk and qualified counsel as soon as personal data may be involved — not after the technical work is done.
Decide it is an incident, and say so
The most expensive delay is the hour spent debating whether this is really an incident. Declare early; standing down a declared incident is cheap, and discovering an hour late that it was real is not.
Name an incident commander immediately. One person, coordinating, not doing the technical work. Everyone else has a defined job. Incidents fail on coordination far more than on technical capability.
Order of operations
1. Contain before investigating. Stop the bleeding: isolate the host, revoke the credential, disable the account, block the path. It is tempting to watch the attacker to learn more — do that only with a deliberate decision, not by default.
2. Preserve evidence while containing. Snapshot before you rebuild. Capture volatile state — memory, connections, running processes — before powering anything off. Rebuilding a compromised host destroys the only record of how they got in, and you will need it.
3. Establish scope. What was accessed, what was taken, when it started, and whether it is still happening. Assume the initial scope is understated; it usually is. Look for persistence and lateral movement before declaring containment.
4. Eradicate and recover. Remove the access, close the path, then restore. Rebuild from known good rather than cleaning in place — you cannot prove a cleaned host is clean.
Rotate every credential the attacker could have reached, not only the ones you know they used.
5. Watch after recovery. Re-entry is common. Monitor specifically for the path they used and its neighbors.
Communication
Keep one timeline as the single source of truth, updated as facts are established, with each entry timestamped and attributed. Incidents generate contradictory information at speed, and the timeline is what stops the same question being answered three ways.
Say what is known, what is not yet known, and when the next update comes. Never speculate on cause or scope externally before it is established — a retracted statement extends the story and damages credibility more than the incident did.
Show full SKILL.md (215 more words)Show less
Afterward
Blameless review, focused on the system rather than the person. The useful questions: how could this have been detected sooner, what made containment slow, what did we not have that we needed, and what made this possible in the first place.
Output actions with owners and dates. A review producing no committed changes is theater, and the same incident recurs.
Preparation
The plan matters less than having run it. Exercise once a year at minimum: a tabletop against a realistic scenario finds the gaps — who has authority out of hours, where the credentials are, who calls counsel — at a time when finding them is free.
Sources
references/sources.md in this skill lists the outside authorities that settle the questions
here — what each one is authoritative for, and what you may do with it. Check them before
answering on anything they cover, and cite what you used. Most are free to read and not free
to reproduce; the use note on each is binding.
Never
- Rebuild or wipe a compromised host before evidence is captured.
- Let the person running the technical response also own external communication.
- Close an incident before you can say how entry happened and that the path is shut.
- Speculate about cause or attribution outside the response channel while the incident is open.
© cbrock84, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
SKILL.md and 1 other file (references) in plugins/security/skills/incident-response of cbrock84/headcount.
- SKILL.md
- references/sources.md
Open the folder on GitHubat commit 98d1c17
Compare with similar skills
Incident Response next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Incident Response this skillcbrock84/headcount | 2k | — | ~1k | Automated safety check: Pass | MIT | |
| Incident ResponseBagelHole/DevOps-Security-Agent-Skills | 1.1k | — | ~4.5k | Automated safety check: Pass | MIT | |
| Msp MaintenanceRTFM-IT-Services-LLC/msp-claude-skills | 115 | — | ~2.6k | Automated safety check: Pass | Custom licence | |
| Implementing Soar Playbook With Palo Alto Xsoarmukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~2.4k | Automated safety check: Pass | Apache-2.0 | |
| Incident Responsesickn33/agentic-awesome-skills | 47k | 1 repos | ~3.7k | Automated safety check: Pass | MIT | |
| Building Incident Response Dashboardmukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~2.8k | Automated safety check: Pass | Apache-2.0 |
Similar skills
Msp Maintenance
RTFM-IT-Services-LLC/msp-claude-skills
A skill your agent uses for your MSP's proactive, recurring operations: patching and update cycles, maintenance windows, backup monitoring and test restores, monitoring and alert triage, the on-call…
Implementing Soar Playbook With Palo Alto Xsoar
mukul975/Anthropic-Cybersecurity-Skills
Build automated incident response playbooks in Cortex XSOAR (Demisto) using its YAML playbook structure, integration commands, and task types to orchestrate phishing, malware, account-compromise…
Incident Response
sickn33/agentic-awesome-skills
Handle security incidents with IR playbooks and procedures. An agent skill from sickn33/agentic-awesome-skills.
Building Incident Response Dashboard
mukul975/Anthropic-Cybersecurity-Skills
Builds real-time incident response dashboards in Splunk, Elastic, or Grafana to provide SOC analysts and leadership with situational awareness during active incidents, tracking affected systems…
Conducting Cloud Incident Response
mukul975/Anthropic-Cybersecurity-Skills
Respond to security incidents in AWS, Azure, and GCP via identity-based containment, cloud-native log analysis (CloudTrail, Azure Activity Logs, GCP Audit Logs), resource isolation, and forensic…
More from cbrock84/headcount
All 178 skills in this repoAgent Hierarchy
cbrock84/headcount
Designs orchestrator-and-subagent hierarchies for a repository — splitting agents by exclusive write surface, pairing every producer with an independent auditor, and enforcing the split with a…
Access And Identity
cbrock84/headcount
Designs and audits who can reach what — authentication, authorization models, privileged access, service credentials, and joiner-mover-leaver process.
Account Based Marketing
cbrock84/headcount
Concentrates marketing and sales effort on a named set of accounts rather than on volume — qualifying whether the model fits your economics at all, building the account list and the buying group…
Activation
cbrock84/headcount
Gets new users from signup to first real value — signup flow, onboarding, time-to-value, and the early experience that determines whether someone becomes a user or a lapsed account.
AI ML Governance
cbrock84/headcount
Governs models and AI systems in production — intended use, evaluation, monitoring, human oversight, documentation, and the decision to deploy or retire.
AI Research Analyst
cbrock84/headcount
Produces executive-level research — market sizing, competitor mapping, trend analysis, and strategic intelligence — grounded in cited sources with the confidence in each claim made explicit.
Related
Categories
Questions about Incident Response
What does Incident Response do?
Runs a security incident from detection to closure — triage, containment, investigation, communication, and the review afterward. Incident Response is an agent skill from cbrock84/headcount. Runs a security incident from detection to closure — triage, containment, investigation, communication, and the review afterward.
When should I use Incident Response?
Incident Response fits situations like: notification obligations; tasks that involve Incident response; tasks that involve Security operations.
How do I install Incident Response in Claude Code?
Run `npx skills add cbrock84/headcount --skill incident-response -a claude-code`. Or copy the skill folder (plugins/security/skills/incident-response in cbrock84/headcount) into .claude/skills/incident-response in your project. Claude Code loads it when a task matches its description.
How do I install Incident Response in Codex?
Run `npx skills add cbrock84/headcount --skill incident-response -a codex`. Or copy the skill folder (plugins/security/skills/incident-response in cbrock84/headcount) into .agents/skills/incident-response in your project. Codex loads it when a task matches its description.
Can I use Incident Response in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add cbrock84/headcount --skill incident-response -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/incident-response, .gemini/skills/incident-response, .github/skills/incident-response and .opencode/skills/incident-response in your project.
What does Incident Response need to run?
SKILL.md names no scripts, command-line tools or credentials: Incident Response is instructions for the agent only.
Does Incident Response access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Incident Response safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Incident Response use?
Incident Response is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Incident Response use?
About 1k tokens (SKILL.md is roughly 4.1k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 444 tokens, read only when the agent opens those files.
What are the alternatives to Incident Response?
Skills that share tags, products or a category with Incident Response: Incident Response (BagelHole/DevOps-Security-Agent-Skills, 1.1k stars), Msp Maintenance (RTFM-IT-Services-LLC/msp-claude-skills, 115 stars), Implementing Soar Playbook With Palo Alto Xsoar (mukul975/Anthropic-Cybersecurity-Skills, 34k stars) and Incident Response (sickn33/agentic-awesome-skills, 47k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Incident Response?
cbrock84 (a GitHub user) maintains it in cbrock84/headcount, which has 2,016 GitHub stars. The repository holds 178 skills in this directory. The repository was last updated on September 17, 2026.
Source: cbrock84/headcount on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.