The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides procedures that involve running system-level diagnostic and mitigation commands to investigate outages or breaches. Detailed forensics and system state gathering are standard components of the incident response playbooks.
Evidence: references/triage.md suggests using commands like ps aux, ss -tulpn, sosreport -k, and kubectl logs --previous to capture system state.
Evidence: references/mitigate.md mentions forensic commands for disk imaging, log extraction, and network connection auditing.
[PRIVILEGE_ESCALATION]: The skill includes instructions for high-privilege operations related to security incident mitigation and credential management, which are required for isolating breaches.
Evidence: references/mitigate.md contains procedures for rotating all exposed credentials, revoking active sessions/tokens, and isolating hosts via cloud security group modifications.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze potentially untrusted external data such as system logs, error reports, and metrics to perform its tasks.
Ingestion points: System logs (auth/syslog/app), metric snapshots, and user-provided incident descriptions defined in references/triage.md and references/mitigate.md.
Boundary markers: None explicitly defined in the instruction markdown.
Capability inventory: The agent is configured with bash, run_command, view_file, write_to_file, replace_file_content, and grep_search tools as seen in agents/openai.yaml and SKILL.md.
Sanitization: No explicit sanitization or filtering logic is provided for the external data being processed, relying on the agent's interpretation.

incident-response