Runs a security incident from detection to closure — triage, containment, investigation, communication, and the review afterward. Use this when a compromise is suspected or confirmed, when preparing an incident response plan or running an exercise, when deciding whether something is an incident, or when a breach may trigger notification obligations.
インストールする前に、エージェントに与えられる指示の中身を確認できます。
Breach notification runs on statutory clocks, measured in hours in several regimes. Involve Legal & Risk and qualified counsel as soon as personal data may be involved — not after the technical work is done.
The most expensive delay is the hour spent debating whether this is really an incident. Declare early; standing down a declared incident is cheap, and discovering an hour late that it was real is not.
Name an incident commander immediately. One person, coordinating, not doing the technical work. Everyone else has a defined job. Incidents fail on coordination far more than on technical capability.
1. Contain before investigating. Stop the bleeding: isolate the host, revoke the credential, disable the account, block the path. It is tempting to watch the attacker to learn more — do that only with a deliberate decision, not by default.
2. Preserve evidence while containing. Snapshot before you rebuild. Capture volatile state — memory, connections, running processes — before powering anything off. Rebuilding a compromised host destroys the only record of how they got in, and you will need it.
3. Establish scope. What was accessed, what was taken, when it started, and whether it is still happening. Assume the initial scope is understated; it usually is. Look for persistence and lateral movement before declaring containment.
4. Eradicate and recover. Remove the access, close the path, then restore. Rebuild from known good rather than cleaning in place — you cannot prove a cleaned host is clean.
Rotate every credential the attacker could have reached, not only the ones you know they used.
5. Watch after recovery. Re-entry is common. Monitor specifically for the path they used and its neighbors.
Keep one timeline as the single source of truth, updated as facts are established, with each entry timestamped and attributed. Incidents generate contradictory information at speed, and the timeline is what stops the same question being answered three ways.
Say what is known, what is not yet known, and when the next update comes. Never speculate on cause or scope externally before it is established — a retracted statement extends the story and damages credibility more than the incident did.
Blameless review, focused on the system rather than the person. The useful questions: how could this have been detected sooner, what made containment slow, what did we not have that we needed, and what made this possible in the first place.
Output actions with owners and dates. A review producing no committed changes is theater, and the same incident recurs.
The plan matters less than having run it. Exercise once a year at minimum: a tabletop against a realistic scenario finds the gaps — who has authority out of hours, where the credentials are, who calls counsel — at a time when finding them is free.
references/sources.md in this skill lists the outside authorities that settle the questions
here — what each one is authoritative for, and what you may do with it. Check them before
answering on anything they cover, and cite what you used. Most are free to read and not free
to reproduce; the use note on each is binding.
まだレビューはありません。使ってみた感想をお寄せください。
概要と使いどころ
Designs and audits who can reach what — authentication, authorization models, privileged access, service credentials, and joiner-mover-leaver process. Use this to design a permissions model, run an access review, reduce standing privilege, handle offboarding, set up SSO or MFA, manage service and machine credentials, or diagnose why permissions have sprawled.
日本語の概要は準備中です。原文の説明を表示しています。
Concentrates marketing and sales effort on a named set of accounts rather than on volume — qualifying whether the model fits your economics at all, building the account list and the buying group inside each, tiering effort against account value, coordinating so the account experiences one campaign rather than several, and measuring account progression instead of leads. Use this to decide whether to run an account-based program, build one, or work out why an existing one produces activity and no pipeline.
日本語の概要は準備中です。原文の説明を表示しています。
Gets new users from signup to first real value — signup flow, onboarding, time-to-value, and the early experience that determines whether someone becomes a user or a lapsed account. Use this to design or fix signup and onboarding, diagnose why signups do not convert to active use, reduce time-to-value, or decide what a new user must accomplish first.
日本語の概要は準備中です。原文の説明を表示しています。
Designs orchestrator-and-subagent hierarchies for a repository — splitting agents by exclusive write surface, pairing every producer with an independent auditor, and enforcing the split with a script that runs in CI. Use this whenever the user wants to set up, expand, audit, or fix a multi-agent or subagent structure for a codebase; asks how to divide work between agents; wants agent charters, roles, or a surface map written; or is hitting agents that collide on the same files, review their own work, or drift from their remit. Also use when sizing a roster or deciding whether a new agent is justified.
日本語の概要は準備中です。原文の説明を表示しています。
Governs models and AI systems in production — intended use, evaluation, monitoring, human oversight, documentation, and the decision to deploy or retire. Use this before deploying a model or AI feature, when defining evaluation criteria, when a model's behavior has drifted, when assessing AI risk or regulatory exposure, or when deciding whether an AI system is fit for a consequential decision.
日本語の概要は準備中です。原文の説明を表示しています。
Produces executive-level research — market sizing, competitor mapping, trend analysis, and strategic intelligence — grounded in cited sources with the confidence in each claim made explicit. Use this to analyze a market or industry, map competitors, evaluate a market-entry or build-versus-buy decision, produce a research brief, or assemble evidence for a decision. Also use when comparing options that need a structured, evidence-based verdict rather than an opinion.
日本語の概要は準備中です。原文の説明を表示しています。