incident-response

BENIGN. The skill is internally consistent with a defensive incident-response purpose and does not route data to third parties or include suspicious install behavior. Risk comes mainly from the powerful forensic and containment capabilities, especially credential extraction and potentially impactful response actions, so it should be used with strong human approval controls.