Name: incident-response
Rating: 64.8 (1 reviews)
Author: alirezarezvani

incident-response

Use when a security incident has been detected or declared and needs classification, triage, escalation path determination, and forensic evidence collection. Covers SEV1-SEV4 classification, false positive filtering, incident taxonomy, and NIST SP 800-61 lifecycle.

Quality

78%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./.gemini/skills/incident-response/SKILL.md

The canonical home for this skill is incident-response in alirezarezvani/claude-skills

Quality

Content

63%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, actionable body with concrete commands, schemas, and sequenced workflows including a human approval gate. Its main weaknesses are mild redundancy across distinction sections, inlined reference material that belongs in separate files, and references to bundle files that are not actually present.

Suggestions

Provide the missing bundle files (scripts/incident_triage.py and references/regulatory-deadlines.md), or remove the references — currently SKILL.md points to paths that do not exist.

Move the full regulatory deadline table and the 14-type incident taxonomy into references/ files, keeping only a concise summary inline, to reduce SKILL.md length and improve progressive disclosure.

Collapse the Overview 'Distinction from Other Security Skills' table and the trailing 'Cross-References' table into a single section, and drop the redundant intro sentence that repeats the threat-hunting distinction.

Dimension	Reasoning	Score
Conciseness	Prose is lean and avoids explaining basics Claude already knows, but the body carries a full Table of Contents plus two overlapping distinction tables (Overview and Cross-References) and an intro paragraph that repeats the 'NOT threat hunting' distinction already in the tables — tightening opportunities remain.	3 / 5
Actionability	Provides concrete, copy-paste-ready commands ('python3 scripts/incident_triage.py --input event.json --classify --false-positive-check --json'), an input JSON schema, exit codes, and three worked workflows covering common cases; minor gaps are that forensic collection steps are listed without exact tool invocations.	4 / 5
Workflow Clarity	Workflows are clearly sequenced with real checkpoints — a T+ timeline, a human approval gate for containment, and containment-effectiveness assessment — but there is no explicit validate→fix→retry feedback loop for the destructive containment operations.	4 / 5
Progressive Disclosure	Internal sectioning and the TOC are clear, but nearly all reference material (full incident taxonomy, severity matrix, regulatory deadline table) is inlined into SKILL.md, and the two referenced bundle paths (scripts/incident_triage.py, references/regulatory-deadlines.md) do not exist in the bundle, leaving dangling references.	3 / 5
	Total	14 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that explicitly states both capability and trigger conditions with concrete, domain-specific actions and terms. Its only minor gap is the absence of a few common synonyms (breach, compromise) among the trigger terms.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'classification, triage, escalation path determination, and forensic evidence collection' plus 'SEV1-SEV4 classification, false positive filtering, incident taxonomy, and NIST SP 800-61 lifecycle' — giving comprehensive coverage rather than a single vague verb.	5 / 5
Completeness	Explicitly answers both 'what' (classification, triage, escalation, forensic collection) and 'when' ('Use when a security incident has been detected or declared and needs...'), with concrete trigger phrasing.	5 / 5
Trigger Term Quality	Strong natural keywords a security analyst would actually say ('security incident', 'detected or declared', 'triage', 'escalation', 'forensic evidence collection', 'SEV1-SEV4'), but a few common synonyms ('breach', 'compromise', 'security alert') are absent, keeping it just below comprehensive.	4 / 5
Distinctiveness Conflict Risk	Carves a clear niche — reactive triage of declared/active incidents — with specific triggers (SEV1-SEV4, NIST SP 800-61) that distinguish it from generic security or threat-hunting skills, giving minimal conflict risk.	5 / 5
	Total	19 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
relative_links	Relative link issues: 4 suspicious	Warning
referenced_paths_exist	Referenced path issues: 11 missing	Warning

	Total	14 / 16 Passed

Repository: alirezarezvani/claude-skills
Path: .gemini/skills/incident-response/SKILL.md
Commit: 19392f7

Reviewed: ~8 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.