Security Alert Triage
elastic/agent-skills
Triage Elastic Security alerts — gather context, classify threats, create cases, and acknowledge.
安全事件响应助手 - 专业的安全事件处置与应急响应专家。适用场景： (1) 安全事件识别与分类 (2) 应急响应计划制定 (3) 事件调查与取证分析 (4) 遏制与根除方案设计 (5) 系统恢复与业务连续性 (6) 事件复盘与改进建议 (7) 安全事件报告撰写 触发关键词：安全事件、应急响应、事件处置、入侵检测、安全告警、取证分析、恢复计划、事件复盘、安全报告、勒索软件、数据泄露
Install Information Security Security Incident Response
$ npx skills add chendongqi/OPB-Skills --skill information-security-security-incident-response -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install chendongqi/OPB-Skills information-security-security-incident-response --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/chendongqi/OPB-Skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/information-security-security-incident-response .claude/skills/information-security-security-incident-response && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "information-security-security-incident-response" agent skill from https://github.com/chendongqi/OPB-Skills/tree/main/skills/information-security-security-incident-response into .claude/skills/information-security-security-incident-response/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "information-security-security-incident-response", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/chendongqi/OPB-Skills/tree/main/skills/information-security-security-incident-responseType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add chendongqi/OPB-Skills --skill information-security-security-incident-response -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install chendongqi/OPB-Skills information-security-security-incident-response --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/chendongqi/OPB-Skills.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/information-security-security-incident-response .agents/skills/information-security-security-incident-response && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "information-security-security-incident-response" agent skill from https://github.com/chendongqi/OPB-Skills/tree/main/skills/information-security-security-incident-response into .agents/skills/information-security-security-incident-response/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "information-security-security-incident-response", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add chendongqi/OPB-Skills --skill information-security-security-incident-response -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install chendongqi/OPB-Skills information-security-security-incident-response --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/chendongqi/OPB-Skills.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/information-security-security-incident-response .cursor/skills/information-security-security-incident-response && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "information-security-security-incident-response" agent skill from https://github.com/chendongqi/OPB-Skills/tree/main/skills/information-security-security-incident-response into .cursor/skills/information-security-security-incident-response/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "information-security-security-incident-response", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/chendongqi/OPB-Skills.git --path skills/information-security-security-incident-response--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add chendongqi/OPB-Skills --skill information-security-security-incident-response -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install chendongqi/OPB-Skills information-security-security-incident-response --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/chendongqi/OPB-Skills.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/information-security-security-incident-response .gemini/skills/information-security-security-incident-response && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "information-security-security-incident-response" agent skill from https://github.com/chendongqi/OPB-Skills/tree/main/skills/information-security-security-incident-response into .gemini/skills/information-security-security-incident-response/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "information-security-security-incident-response", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install chendongqi/OPB-Skills information-security-security-incident-responseInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add chendongqi/OPB-Skills --skill information-security-security-incident-response -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/chendongqi/OPB-Skills.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/information-security-security-incident-response .github/skills/information-security-security-incident-response && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "information-security-security-incident-response" agent skill from https://github.com/chendongqi/OPB-Skills/tree/main/skills/information-security-security-incident-response into .github/skills/information-security-security-incident-response/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "information-security-security-incident-response", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add chendongqi/OPB-Skills --skill information-security-security-incident-response -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install chendongqi/OPB-Skills information-security-security-incident-response --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/chendongqi/OPB-Skills.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/information-security-security-incident-response .opencode/skills/information-security-security-incident-response && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "information-security-security-incident-response" agent skill from https://github.com/chendongqi/OPB-Skills/tree/main/skills/information-security-security-incident-response into .opencode/skills/information-security-security-incident-response/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "information-security-security-incident-response", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
information-security-security-incident-response- GitHub stars
- 126
- Token cost
- ~999 tokens
- SKILL.md length
- 92 words
- Files
- 1
- Skills in repo
- 75
- Repo updated
- First seen
- Licence
- None found
At a glance
安全事件响应助手 - 专业的安全事件处置与应急响应专家。适用场景： (1) 安全事件识别与分类 (2) 应急响应计划制定 (3) 事件调查与取证分析 (4) 遏制与根除方案设计 (5) 系统恢复与业务连续性 (6) 事件复盘与改进建议 (7) 安全事件报告撰写 触发关键词：安全事件、应急响应、事件处置、入侵检测、安全告警、取证分析、恢复计划、事件复盘、安全报告、勒索软件、数据泄露
- Works in 6 steps: 安全事件分类 → 应急响应流程 → 事件调查与取证 → …
- Tasks that involve Security operations
- SKILL.md covers 核心工作流程, 输出模板 and 最佳实践
- Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
What it does
Information Security Security Incident Response is an agent skill from chendongqi/OPB-Skills. 安全事件响应助手 - 专业的安全事件处置与应急响应专家。适用场景： (1) 安全事件识别与分类 (2) 应急响应计划制定 (3) 事件调查与取证分析 (4) 遏制与根除方案设计 (5) 系统恢复与业务连续性 (6) 事件复盘与改进建议 (7) 安全事件报告撰写 触发关键词：安全事件、应急响应、事件处置、入侵检测、安全告警、取证分析、恢复计划、事件复盘、安全报告、勒索软件、数据泄露
Its SKILL.md is about 1000 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in Security, covering Security operations. The repository describes itself as: 一套覆盖一个公司完整业务的SKILL，适用ClaudeCode，Codex，OpenCode等工具.
When your agent uses it
- Tasks that involve Security operations
Example prompts
- “/information-security-security-incident-response”
Workflow steps
6 steps, taken from the step headings in SKILL.md.
- 安全事件分类
- 应急响应流程
- 事件调查与取证
- 常见事件处置
- 应急响应计划
- 事件复盘与改进
What it can do on your machine
Read from SKILL.md and the folder at commit d587882. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md.
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Information Security Security Incident Response loads about 999 tokens when it runs. Until then it costs about 60 tokens; SKILL.md has 92 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
Without a licence we can't republish the file, so here is its outline and opening line. It has 92 words (~999 tokens).
- name
- information-security-security-incident-response
Files
Just SKILL.md in skills/information-security-security-incident-response of chendongqi/OPB-Skills.
Open the folder on GitHubat commit d587882
Compare with similar skills
Information Security Security Incident Response next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Information Security Security Incident Response this skillchendongqi/OPB-Skills | 126 | — | ~999 | Automated safety check: Pass | None | |
| Security Alert Triageelastic/agent-skills | 592 | 1 repos | ~3.5k | Automated safety check: Notes | Apache-2.0 | |
| Kubernetes Network Security Auditkubeshark/kubeshark | 12k | — | ~7.3k | Automated safety check: Notes | Apache-2.0 | |
| Security Detection Rule Managementelastic/agent-skills | 592 | 1 repos | ~3.9k | Automated safety check: Notes | Apache-2.0 | |
| Chaitin CLIchaitin/chaitin-cli | 115 | — | ~15k | Automated safety check: Notes | GPL-3.0 | |
| GatesNebulock-Inc/agentic-threat-hunting-framework | 388 | — | ~12k | Automated safety check: Pass | MIT |
Similar skills
- Official
Kubernetes Network Security Audit
kubeshark/kubeshark
Hunts for compromised workloads and malicious traffic in a Kubernetes cluster by sweeping network data through Kubeshark MCP, mapped to MITRE ATT&CK.
- Official
Security Detection Rule Management
elastic/agent-skills
Create, tune, and manage Elastic Security detection rules (SIEM and Endpoint).
Chaitin CLI
chaitin/chaitin-cli
A skill your agent uses when running chaitin-cli commands to manage Chaitin security products: SafeLine WAF (site management, IP blocking, ACL, policy rules, attack logs), X-Ray vulnerability…
Gates
Nebulock-Inc/agentic-threat-hunting-framework
GATES method validation for hunt-derived detections. An agent skill from Nebulock-Inc/agentic-threat-hunting-framework.
Elasticsearch Audit
aspectrr/deer
Enable, configure, and query Elasticsearch security audit logs.
More from chendongqi/OPB-Skills
All 75 skills in this repoRnd Tech Arch Diagrammer
chendongqi/OPB-Skills
Technical architecture diagram creator using Excalidraw MCP tools.
Rnd Technical Writer
chendongqi/OPB-Skills
Technical article writing assistant. An agent skill from chendongqi/OPB-Skills.
App Namer
chendongqi/OPB-Skills
Generate creative, memorable, and appropriate names for software applications, products, and services.
Rnd Blog Series Planner
chendongqi/OPB-Skills
Technical blog series planning assistant. An agent skill from chendongqi/OPB-Skills.
Rnd Code Simplify
chendongqi/OPB-Skills
Expert code simplification and refactoring specialist that autonomously enhances code clarity, consistency, and maintainability while preserving exact functionality.
Aspice Sys To Swe
chendongqi/OPB-Skills
Analyze automotive system requirements (ASPICE SYS.2) and decompose them into software requirements (ASPICE SWE.1) for new energy vehicle onboard systems.
Related
Categories
Questions about Information Security Security Incident Response
What does Information Security Security Incident Response do?
安全事件响应助手 - 专业的安全事件处置与应急响应专家。适用场景： (1) 安全事件识别与分类 (2) 应急响应计划制定 (3) 事件调查与取证分析 (4) 遏制与根除方案设计 (5) 系统恢复与业务连续性 (6) 事件复盘与改进建议 (7) 安全事件报告撰写 触发关键词：安全事件、应急响应、事件处置、入侵检测、安全告警、取证分析、恢复计划、事件复盘、安全报告、勒索软件、数据泄露. Information Security Security Incident Response is an agent skill from chendongqi/OPB-Skills.
When should I use Information Security Security Incident Response?
Information Security Security Incident Response fits situations like: tasks that involve Security operations.
How do I install Information Security Security Incident Response in Claude Code?
Run `npx skills add chendongqi/OPB-Skills --skill information-security-security-incident-response -a claude-code`. Or copy the skill folder (skills/information-security-security-incident-response in chendongqi/OPB-Skills) into .claude/skills/information-security-security-incident-response in your project. Claude Code loads it when a task matches its description.
How do I install Information Security Security Incident Response in Codex?
Run `npx skills add chendongqi/OPB-Skills --skill information-security-security-incident-response -a codex`. Or copy the skill folder (skills/information-security-security-incident-response in chendongqi/OPB-Skills) into .agents/skills/information-security-security-incident-response in your project. Codex loads it when a task matches its description.
Can I use Information Security Security Incident Response in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add chendongqi/OPB-Skills --skill information-security-security-incident-response -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/information-security-security-incident-response, .gemini/skills/information-security-security-incident-response, .github/skills/information-security-security-incident-response and .opencode/skills/information-security-security-incident-response in your project.
What does Information Security Security Incident Response need to run?
SKILL.md names no scripts, command-line tools or credentials: Information Security Security Incident Response is instructions for the agent only.
Does Information Security Security Incident Response access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Information Security Security Incident Response safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Information Security Security Incident Response use?
No licence was found for Information Security Security Incident Response or its repository. Without one, default copyright applies: ask the author before reusing or redistributing it.
How many tokens does Information Security Security Incident Response use?
About 999 tokens (SKILL.md is roughly 4k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Information Security Security Incident Response?
Skills that share tags, products or a category with Information Security Security Incident Response: Security Alert Triage (elastic/agent-skills, 592 stars), Kubernetes Network Security Audit (kubeshark/kubeshark, 12k stars), Security Detection Rule Management (elastic/agent-skills, 592 stars) and Chaitin CLI (chaitin/chaitin-cli, 115 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Information Security Security Incident Response?
chendongqi (a GitHub user) maintains it in chendongqi/OPB-Skills, which has 126 GitHub stars. The repository holds 75 skills in this directory. The repository was last updated on February 11, 2026.
Source: chendongqi/OPB-Skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.