Menu

Individual skill

security-incident-response

0upvotes

Run or document a security incident response — contain, eradicate, recover, and learn. Use when responding to a breach/compromise/security incident, writing an IR plan or runbook, or producing a post-incident report. Produces a phase-by-phase response (triage, contain, eradicate, recover, post-incident) with the immediate actions, comms, evidence-handling, and a blameless review. For incidents on systems you own or defend.

plugins/pm-security/skills/security-incident-response/SKILL.md

Read pinned source

Source commit e0009a385c480fb0b5687e7412df67c7c64f7cee

What was checked

Matches the observed repository HEAD
Yes
Scanner rules are current
No
Repository scan complete
No
Skill scan complete
No
Observed behavior
Not checked yet
Last checked
Nov 12, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings)
1,542
Repository last updated
Nov 11, 2026
License
MIT

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files
Read excerpt

# Security Incident Response Skill

In a security incident, the order of operations matters: contain before you clean, preserve evidence before
you wipe, and communicate deliberately. This skill drives a structured response through the standard phases,
or documents one after the fact — with the immediate actions, decision points, comms, and a blameless
post-incident review. For systems you own or are authorized to defend.

## Required Inputs

Ask for these only if they aren't already provided:

- **What's happening** — the observed incident (malware, unauthorized access, data exfiltration, ransomware, account compromise), and how it was detected.
- **Scope so far** — affected systems/accounts/data, whether it's ongoing, entry point if known.
- **Environment & stakes** — what's at risk (PII, funds, availability), regulatory/notification obligations.
Back to top