New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Responding To Security Incidents

by jeremylongshore in jeremylongshore/tons-of-skills-marketplace

Analyze and guide security incident response, investigation, and remediation processes.

MITAuto-check passedSecurity

Install Responding To Security Incidents

skills CLI
$ npx skills add jeremylongshore/tons-of-skills-marketplace --skill responding-to-security-incidents -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install jeremylongshore/tons-of-skills-marketplace responding-to-security-incidents --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/jeremylongshore/tons-of-skills-marketplace.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/.curated/responding-to-security-incidents .claude/skills/responding-to-security-incidents && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
responding-to-security-incidents
GitHub stars
2.8k
Token cost
~1.6k tokens
SKILL.md length
596 words
Files
8 (incl. scripts, references, assets)
Skills in repo
3,342
Repo updated
First seen
Licence
MIT

At a glance

Analyze and guide security incident response, investigation, and remediation processes.

  • Works in 10 steps: Classify the incident: determine type… → Scope affected systems: identify all… → Preserve evidence before any changes:… → …
  • You need to handle security breaches
  • SKILL.md covers Overview, Prerequisites, Instructions and Output, plus 3 more sections
  • Runs Python scripts from its folder

What it does

Responding To Security Incidents is an agent skill from jeremylongshore/tons-of-skills-marketplace. Analyze and guide security incident response, investigation, and remediation processes. Use when you need to handle security breaches, classify incidents, develop response playbooks, gather forensic evidence, or coordinate remediation efforts. Trigger with phrases like "security incident response", "ransomware attack response", "data breach investigation", "incident playbook", or "security forensics".

Its SKILL.md is about 1.6k tokens, which your agent loads only when the skill is triggered. The skill folder holds 10 other files, including scripts, reference files and assets (for example `assets/README.md`, `references/README.md` and `references/errors.md`). Compatibility notes: Designed for Claude Code

It sits in Security, covering Security operations. The repository describes itself as: Model-agnostic agent-skills platform with a harness-free canonical layer, verified adapters, and the ccpi package manager. Explore at tonsofskills.com. The licence is MIT.

When your agent uses it

  • You need to handle security breaches
  • Classify incidents
  • Develop response playbooks
  • Gather forensic evidence

Example prompts

  • “security incident response”
  • “ransomware attack response”
  • “data breach investigation”
  • “/responding-to-security-incidents”

Requirements

  • Python 3
  • Compatibility (from SKILL.md): Designed for Claude Code
  • Pre-approved tools (allowed-tools): Read, Write, Edit, Grep, Glob, Bash(log-analysis:*), Bash(forensics:*), Bash(network-trace:*)

Workflow steps

10 steps, taken from the first numbered list in SKILL.md.

  1. Classify the incident: determine type (ransomware, data breach, DDoS, phishing, insider threat), assign severity…
  2. Scope affected systems: identify all compromised hosts, user accounts, data stores, and network segments. Map the blast radius.
  3. Preserve evidence before any changes: capture memory dumps (volatility -f memdump.raw imageinfo), create disk images, export running…
  4. Collect log evidence: gather authentication logs (successful and failed), application error logs, firewall/IDS alerts, DNS query logs, and…
  5. Contain the threat: isolate affected systems from the network, disable compromised accounts, block malicious IPs at the firewall, and…
  6. Investigate and reconstruct timeline: identify initial access vector, map lateral movement, determine data exfiltration scope, locate…
  7. Eradicate the threat: remove malware and backdoors, patch exploited vulnerabilities, reset all potentially compromised credentials, and…
  8. Recover operations: restore from verified clean backups, rebuild compromised systems from hardened images, validate system integrity, and…
  9. Document the incident: produce a comprehensive report at ${CLAUDE_SKILL_DIR}/incidents/incident-YYYYMMDD-HHMM.md containing executive…
  10. Create remediation backlog: list all follow-up actions (patch gaps, monitoring improvements, policy changes) with owners and deadlines.

What it can do on your machine

Read from SKILL.md and the folder at commit cfae287. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves these tools, so the agent can use them without asking each time:

    • Read
    • Write
    • Edit
    • Grep
    • Glob
    • Bash(log-analysis:*)
    • Bash(forensics:*)
    • Bash(network-trace:*)

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Ships 2 files in scripts/ (Python), which the agent can run.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Links to these hosts (documentation or services it may open):

    • nvlpubs.nist.gov
    • sans.org
    • volatilityfoundation.org
    • autopsy.com
    • intentsolutions.io

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

  • Compatibility

    Designed for Claude Code

    From compatibility in the SKILL.md frontmatter.

Context cost

Responding To Security Incidents loads about 1.6k tokens when it runs, and up to ~2.6k if it reads all its reference files. Until then it costs about 109 tokens; SKILL.md has 596 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~109
When it runs · the whole SKILL.md, loaded when a task matches
~1.6k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~2.6k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from jeremylongshore/tons-of-skills-marketplace at commit cfae287, republished under its MIT licence (© jeremylongshore). 596 words, ~1,551 tokens.

Download SKILL.mdSave it as .claude/skills/responding-to-security-incidents/SKILL.md (or your agent's skills folder). This skill also uses 7 other files; get the full folder from GitHub.
name
responding-to-security-incidents
description
Analyze and guide security incident response, investigation, and remediation processes. Use when you need to handle security breaches, classify incidents, develop response playbooks, gather forensic evidence, or coordinate remediation efforts. Trigger with phrases like "security incident response", "ransomware attack response", "data breach investigation", "incident playbook", or "security forensics".
allowed-tools
Read, Write, Edit, Grep, Glob, Bash(log-analysis:*), Bash(forensics:*), Bash(network-trace:*)
compatibility
Designed for Claude Code
version
1.32.0
author
Jeremy Longshore <jeremy@intentsolutions.io>
license
MIT
tags
security, incident-response, responding-security

Responding To Security Incidents

Overview

Guide the full NIST SP 800-61 incident response lifecycle: detection, containment, eradication, recovery, and post-incident analysis. Classify incidents by type (ransomware, data breach, DDoS, credential compromise, insider threat) and severity, then coordinate evidence preservation, threat containment, and root-cause investigation.

Prerequisites

  • System and application logs accessible in ${CLAUDE_SKILL_DIR}/logs/ (auth logs, web server logs, database access logs)
  • Network traffic captures (PCAP) or SIEM alert exports available
  • Incident response team contact information and escalation paths documented
  • Backup systems operational and recovery procedures tested
  • Write permissions for incident documentation in ${CLAUDE_SKILL_DIR}/incidents/
  • Forensic tools available: Volatility (memory), Autopsy/FTK Imager (disk), tcpdump/Wireshark (network)

Instructions

  1. Classify the incident: determine type (ransomware, data breach, DDoS, phishing, insider threat), assign severity (Critical/High/Medium/Low), and record initial detection timestamp and method.
  2. Scope affected systems: identify all compromised hosts, user accounts, data stores, and network segments. Map the blast radius.
  3. Preserve evidence before any changes: capture memory dumps (volatility -f memdump.raw imageinfo), create disk images, export running process lists (ps auxf), and snapshot network connection state (ss -tulnp).
  4. Collect log evidence: gather authentication logs (successful and failed), application error logs, firewall/IDS alerts, DNS query logs, and proxy server logs. Store originals in ${CLAUDE_SKILL_DIR}/incidents/evidence/.
  5. Contain the threat: isolate affected systems from the network, disable compromised accounts, block malicious IPs at the firewall, and revoke compromised API keys or tokens.
  6. Investigate and reconstruct timeline: identify initial access vector, map lateral movement, determine data exfiltration scope, locate persistence mechanisms (cron jobs, startup scripts, web shells), and document all IOCs (IPs, hashes, domains, file paths).
  7. Eradicate the threat: remove malware and backdoors, patch exploited vulnerabilities, reset all potentially compromised credentials, and update firewall rules.
  8. Recover operations: restore from verified clean backups, rebuild compromised systems from hardened images, validate system integrity, and monitor for reinfection with heightened alerting.
  9. Document the incident: produce a comprehensive report at ${CLAUDE_SKILL_DIR}/incidents/incident-YYYYMMDD-HHMM.md containing executive summary, detailed timeline, root cause analysis, IOC list, and lessons learned.
  10. Create remediation backlog: list all follow-up actions (patch gaps, monitoring improvements, policy changes) with owners and deadlines.

See ${CLAUDE_SKILL_DIR}/references/implementation.md for the seven-phase implementation workflow.

Show full SKILL.md (244 more words)Show less

Output

  • Incident Report: ${CLAUDE_SKILL_DIR}/incidents/incident-YYYYMMDD-HHMM.md with timeline, root cause, IOCs, and impact assessment
  • IOC List: machine-readable indicators (IP addresses, file hashes, domains, YARA rules)
  • After-Action Review: lessons learned, process gaps, and recommended improvements
  • Remediation Backlog: prioritized follow-up tasks with owners and deadlines

Error Handling

ErrorCauseSolution
Critical logs missing from ${CLAUDE_SKILL_DIR}/logs/Log rotation, deletion, or attacker tamperingWork with available data; note gaps; improve logging retention for future incidents
System state modified before evidence collectionFirst responder made changes before forensic captureDocument contamination; collect remaining evidence; prioritize network and SIEM logs
Attacker still has active access during investigationOngoing compromise detectedPrioritize containment over investigation; implement emergency network isolation
Permission denied accessing system memoryInsufficient forensic tool privilegesEscalate to obtain root/admin access; fall back to available log and network data
Backups encrypted or corrupted by ransomwareAttacker targeted backup infrastructureIdentify offline/air-gapped backups; assess rebuild-from-scratch feasibility

Examples

  • "Credential stuffing detected. Use logs in ${CLAUDE_SKILL_DIR}/logs/ to triage the incident, scope affected accounts, and propose containment steps."
  • "Create an incident response plan for a suspected data breach: list evidence to collect, containment actions, and notification requirements."
  • "Investigate a web shell found at /var/www/html/uploads/cmd.php. Trace the initial access vector, identify persistence mechanisms, and produce an IOC list."

Resources

© jeremylongshore, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 7 other files (scripts, references, assets) in skills/.curated/responding-to-security-incidents of jeremylongshore/tons-of-skills-marketplace.

  • SKILL.md
  • assets/README.md
  • references/README.md
  • references/errors.md
  • references/examples.md
  • references/implementation.md
  • scripts/README.md
  • scripts/evidence_collector.py

Open the folder on GitHubat commit cfae287

Compare with similar skills

Responding To Security Incidents next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Responding To Security Incidents compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Responding To Security Incidents this skilljeremylongshore/tons-of-skills-marketplace2.8k—~1.6kAutomated safety check: PassMIT
Security Alert Triageelastic/agent-skills5921 repos~3.5kAutomated safety check: NotesApache-2.0
Kubernetes Network Security Auditkubeshark/kubeshark12k—~7.3kAutomated safety check: NotesApache-2.0
Security Detection Rule Managementelastic/agent-skills5921 repos~3.9kAutomated safety check: NotesApache-2.0
Chaitin CLIchaitin/chaitin-cli115—~15kAutomated safety check: NotesGPL-3.0
GatesNebulock-Inc/agentic-threat-hunting-framework388—~12kAutomated safety check: PassMIT

Similar skills

  • Security Alert Triage

    elastic/agent-skills

    Official

    Triage Elastic Security alerts — gather context, classify threats, create cases, and acknowledge.

    592 GitHub starsUsed in 1 repo~3.5k tokens
    SecurityAuto-check: notes

  • Kubernetes Network Security Audit

    kubeshark/kubeshark

    Hunts for compromised workloads and malicious traffic in a Kubernetes cluster by sweeping network data through Kubeshark MCP, mapped to MITRE ATT&CK.

    12k GitHub stars~7.3k tokensUpdated yesterday
    SecurityAuto-check: notes

  • Security Detection Rule Management

    elastic/agent-skills

    Official

    Create, tune, and manage Elastic Security detection rules (SIEM and Endpoint).

    592 GitHub starsUsed in 1 repo~3.9k tokens
    SecurityAuto-check: notes

  • Chaitin CLI

    chaitin/chaitin-cli

    A skill your agent uses when running chaitin-cli commands to manage Chaitin security products: SafeLine WAF (site management, IP blocking, ACL, policy rules, attack logs), X-Ray vulnerability…

    115 GitHub stars~15k tokensUpdated 12 days ago
    SecurityAuto-check: notes

  • Gates

    Nebulock-Inc/agentic-threat-hunting-framework

    GATES method validation for hunt-derived detections. An agent skill from Nebulock-Inc/agentic-threat-hunting-framework.

    388 GitHub stars~12k tokensUpdated 2 days ago
    SecurityAuto-check passed

  • Elasticsearch Audit

    aspectrr/deer

    Enable, configure, and query Elasticsearch security audit logs.

    405 GitHub stars~1.7k tokensUpdated 5 mo ago
    SecurityAuto-check passed

More from jeremylongshore/tons-of-skills-marketplace

All 3,342 skills in this repo

  • Performing Security Code Review

    jeremylongshore/tons-of-skills-marketplace

    Execute this skill enables AI assistant to conduct a security-focused code review using the security-agent plugin.

    2.8k GitHub starsUsed in 2 repos~1.3k tokens
    Auto-check: notes

  • Adapting Transfer Learning Models

    jeremylongshore/tons-of-skills-marketplace

    Build this skill automates the adaptation of pre-trained machine learning models using transfer learning techniques.

    2.8k GitHub stars~1.1k tokensUpdated today
    Auto-check passed

  • Agent Context Loader

    jeremylongshore/tons-of-skills-marketplace

    Execute proactive auto-loading: automatically detects and loads agents.md files.

    2.8k GitHub stars~1.1k tokensUpdated today
    Auto-check passed

  • Aggregating Performance Metrics

    jeremylongshore/tons-of-skills-marketplace

    Aggregate and centralize performance metrics from applications, systems, databases, caches, and services.

    2.8k GitHub stars~1.2k tokensUpdated today
    Auto-check passed

  • Analyzing Capacity Planning

    jeremylongshore/tons-of-skills-marketplace

    Execute this skill enables AI assistant to analyze capacity requirements and plan for future growth.

    2.8k GitHub stars~947 tokensUpdated today
    Auto-check passed

  • Analyzing Database Indexes

    jeremylongshore/tons-of-skills-marketplace

    Process use when you need to work with database indexing. An agent skill from jeremylongshore/tons-of-skills-marketplace.

    2.8k GitHub stars~2k tokensUpdated today
    Auto-check passed

Categories

Questions about Responding To Security Incidents

What does Responding To Security Incidents do?

Analyze and guide security incident response, investigation, and remediation processes. Responding To Security Incidents is an agent skill from jeremylongshore/tons-of-skills-marketplace. Analyze and guide security incident response, investigation, and remediation processes.

When should I use Responding To Security Incidents?

Responding To Security Incidents fits situations like: you need to handle security breaches; classify incidents; develop response playbooks; gather forensic evidence.

How do I install Responding To Security Incidents in Claude Code?

Run `npx skills add jeremylongshore/tons-of-skills-marketplace --skill responding-to-security-incidents -a claude-code`. Or copy the skill folder (skills/.curated/responding-to-security-incidents in jeremylongshore/tons-of-skills-marketplace) into .claude/skills/responding-to-security-incidents in your project. Claude Code loads it when a task matches its description.

How do I install Responding To Security Incidents in Codex?

Run `npx skills add jeremylongshore/tons-of-skills-marketplace --skill responding-to-security-incidents -a codex`. Or copy the skill folder (skills/.curated/responding-to-security-incidents in jeremylongshore/tons-of-skills-marketplace) into .agents/skills/responding-to-security-incidents in your project. Codex loads it when a task matches its description.

Can I use Responding To Security Incidents in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add jeremylongshore/tons-of-skills-marketplace --skill responding-to-security-incidents -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/responding-to-security-incidents, .gemini/skills/responding-to-security-incidents, .github/skills/responding-to-security-incidents and .opencode/skills/responding-to-security-incidents in your project.

What does Responding To Security Incidents need to run?

Going by SKILL.md and its folder, Responding To Security Incidents needs Python for the scripts in its folder. Our summary lists: Python 3. Its frontmatter pre-approves these tools: Read, Write, Edit, Grep, Glob, Bash(log-analysis:*), Bash(forensics:*), Bash(network-trace:*). Compatibility (from SKILL.md): Designed for Claude Code.

Does Responding To Security Incidents access the network?

SKILL.md names 5 domains. As links in the text: nvlpubs.nist.gov, sans.org, volatilityfoundation.org, autopsy.com and intentsolutions.io. This is read from the text; nothing was executed.

Is Responding To Security Incidents safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.

What licence does Responding To Security Incidents use?

Responding To Security Incidents is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Responding To Security Incidents use?

About 1.6k tokens (SKILL.md is roughly 6.2k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 1.1k tokens, read only when the agent opens those files.

What are the alternatives to Responding To Security Incidents?

Skills that share tags, products or a category with Responding To Security Incidents: Security Alert Triage (elastic/agent-skills, 592 stars), Kubernetes Network Security Audit (kubeshark/kubeshark, 12k stars), Security Detection Rule Management (elastic/agent-skills, 592 stars) and Chaitin CLI (chaitin/chaitin-cli, 115 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Responding To Security Incidents?

jeremylongshore (a GitHub user) maintains it in jeremylongshore/tons-of-skills-marketplace, which has 2,827 GitHub stars. The repository holds 3,342 skills in this directory. The repository was last updated on October 10, 2026.

Source: jeremylongshore/tons-of-skills-marketplace on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.