incident-response

Use when a security incident has been detected or declared and needs classification, triage, escalation path determination, and forensic evidence collection. Covers SEV1-SEV4 classification, false positive filtering, incident taxonomy, and NIST SP 800-61 lifecycle.

Quality

89%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

—

The risk profile of this skill

Quality

Content

86%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, highly actionable incident-response skill with executable commands, clear timelines, and excellent progressive disclosure of regulatory detail to a one-level reference. Its weak spots are minor conciseness redundancy and an implicit (rather than explicit) error-recovery loop in the destructive containment workflow.

Suggestions

Add an explicit feedback loop to the SEV1 workflow, e.g. after "Assess containment effectiveness" state "if ineffective, re-isolate and re-assess" to match the top workflow-clarity anchor.

Tighten redundancy between the Overview distinction table and the Cross-References table, which partially restate the same skill boundaries.

Dimension	Reasoning	Score
Conciseness	The body is information-dense with genuinely IR-specific reference data (14-type taxonomy, regulatory deadlines, SLAs, exit codes) rather than concepts Claude already knows, but there is minor redundancy between the Overview distinction table, the frontmatter niche statement, and the Cross-References table that could be trimmed.	4 / 5
Actionability	Fully executable, copy-paste-ready commands throughout ("python3 scripts/incident_triage.py --input event.json --classify --false-positive-check --json", stdin piping, jq pipelines), with a concrete JSON input schema and exit-code table covering the common triage, severity-forcing, and tabletop cases.	5 / 5
Workflow Clarity	Workflows are clearly sequenced (T+0 to T+72h timeline, numbered Quick Triage steps) with key checkpoints present ("Human approval gate for any containment action", false-positive check before escalation, "Assess containment effectiveness"), but lack an explicit validate->fix->retry feedback loop for failed containment, leaving a minor validation gap.	4 / 5
Progressive Disclosure	Clear overview with a Table of Contents, well-signaled one-level-deep reference ("Full deadline reference: references/regulatory-deadlines.md"), and appropriately split content (bulky deadline detail in references/, tooling in scripts/); both referenced bundle paths exist and navigation is easy via anchor links.	5 / 5
	Total	18 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description with an explicit "Use when" trigger and concrete actions anchored to recognized frameworks (SEV1-SEV4, NIST SP 800-61). The only gap is keyword synonym coverage, which keeps trigger term quality just below the top anchor.

Suggestions

Add common user synonyms such as "breach", "compromise", or "security alert" to broaden trigger term coverage toward the top anchor.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions ("classification, triage, escalation path determination, and forensic evidence collection") plus specific frameworks ("SEV1-SEV4 classification", "NIST SP 800-61 lifecycle"), giving comprehensive coverage rather than just several actions.	5 / 5
Completeness	Explicitly answers both: the "Use when a security incident has been detected or declared..." trigger phrase and the "Covers SEV1-SEV4 classification, false positive filtering, incident taxonomy, and NIST SP 800-61 lifecycle" statement of what it does.	5 / 5
Trigger Term Quality	Good natural keyword coverage ("security incident", "detected or declared", "triage", "SEV1-SEV4", "false positive filtering") a SOC user would say, but common synonyms like "breach", "compromise", or "security alert" are missing, so it falls short of comprehensive.	4 / 5
Distinctiveness Conflict Risk	The triggers ("incident has been detected or declared", "triage", "SEV1-SEV4", "forensic evidence collection", "NIST SP 800-61") point unambiguously to active incident response, a clear niche unlikely to fire for threat hunting or compliance mapping.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
relative_links	Relative link issues: 4 suspicious	Warning

	Total	15 / 16 Passed

Repository: alirezarezvani/claude-skills
Path: engineering-team/skills/incident-response/SKILL.md
Commit: 19392f7

Reviewed: ~9 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.