Skill

triaging-security-incident-with-ir-playbook

skill:mukul975/anthropic-cybersecurity-skills#triaging-security-incident-with-ir-playbook

Classifies and prioritizes security incidents using structured IR playbooks and SIEM/case-management queries (Splunk, TheHive) to determine severity, assign response teams, and initiate the appropriate response procedures. Use when a new SOC alert needs triage, multiple concurrent incidents require prioritization, or automated triage rules need validation or tuning.

SkillsMP

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 23:52 UTC at 54a7988

findings

high

highest severity

threat classes

4,532

files scanned

165/165

checks satisfied

package advisories

Why this verdict

suspicious: finding skill:skills/triaging-security-incident-with-ir-playbook:skills/triaging-security-incident-with-ir-playbook/SKILL.md:133:EXEC

Security findings 1

Code execution

highContextual riskmedium confidence

SKILL.md Steps 3 and 5 instruct the agent to read and follow IR playbook content (cat/grep) from /opt/ir/playbooks/, files the artifact does not ship, so triage behavior applies whatever occupies that runtime path.

skills/triaging-security-incident-with-ir-playbook/SKILL.md:133-135

cat /opt/ir/playbooks/ransomware_playbook.yaml

vector:instruction

Counter-argument considered

Strongest refutation case is the declared description's 'using structured IR playbooks' plus the read-only nature of cat/grep, but no declaration covers loading and applying unvalidated content from the host path /opt/ir/playbooks/ at runtime (declared claims are empty), and the concrete instruction to ingest whatever occupies those unshipped paths into triage behavior and downstream response actions is a live source→sink chain that absence of the files never neutralizes.

Open questions 8

What the analysis could not settle from the code alone.

Do the /opt/ir/playbooks/ files referenced by SKILL.md (trigger_conditions.yaml and the *_playbook.yaml files) exist on target hosts, and what instructions do they contain? The artifact does not ship them, so what the agent would load and apply at runtime is unknowable from the evidence shown.

Code execution

[file request opt/ir/playbooks/phishing_playbook.yaml] SKILL.md Step 5 also instructs the agent to cat this playbook file; is it shipped in the repository and if so what instructions does it contain?

Code execution

[file request opt/ir/playbooks/unauthorized_access_playbook.yaml] SKILL.md Step 5 also instructs the agent to cat this playbook file; is it shipped in the repository and if so what instructions does it contain?

Code execution

[file request opt/ir/playbooks/trigger_conditions.yaml] SKILL.md Step 3 greps this trigger-conditions file; is it shipped in the repository and if so what instructions does it contain?

Code execution

[file request opt/ir/playbooks/ransomware_playbook.yaml] SKILL.md Step 5 instructs the agent to cat this playbook file; is it shipped in the repository and if so what instructions does it contain?

Code execution

[file request /opt/ir/playbooks/ransomware_playbook.yaml] SKILL.md Step 5 instructs the agent to read this playbook file; does the repository ship it, and if so what instructions does it contain?

Code execution

[file request /opt/ir/playbooks/trigger_conditions.yaml] SKILL.md Step 3 greps this file for playbook trigger conditions; does the repository ship it, and if so what does it contain?

Code execution

[file request /opt/ir/playbooks/trigger_conditions.yaml] Is the playbook trigger-conditions file referenced by SKILL.md Step 3 shipped anywhere in the repository, or is it NOT IN REPOSITORY (host-only content the agent would read at runtime)?

Code execution