respond-compromised-account

Respond to a potentially compromised user account. Use when impossible travel, credential stuffing, successful phishing, or suspicious activity indicates account compromise. Investigates activity, contains the account, removes persistence, and restores access.

Quality

87%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Medium

Suggest reviewing before use

Quality

Content

75%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, actionable IR workflow with concrete tool calls and real validation checkpoints for destructive operations. Minor gaps in failure-path feedback and a little reference-table repetition keep it just short of top marks.

Suggestions

Add explicit feedback loops: e.g., after Step 3.3, state 'If activity continues, escalate containment (re-disable, widen session revocation) and re-verify.'

Tighten the duplication between the Containment Decision Matrix / Common Persistence Mechanisms tables and the Phase 3/4 prose, or move the tables to a references file and link to them.

Flesh out the conditional gaps — specify fallback actions when Identity Provider or email/cloud platform tools are unavailable rather than marking steps optional.

Dimension	Reasoning	Score
Conciseness	Mostly lean — real tool calls, bullet lists, and tables with no conceptual over-explanation — but the Containment Decision Matrix and Common Persistence Mechanisms table partially restate Phase 3/4 content, a minor trim opportunity.	4 / 5
Actionability	Provides executable calls like secops-mcp.lookup_entity and /confirm-action, but a few steps remain conditional ('Requires Identity Provider tools', 'Trigger endpoint triage') with gaps a 5 would close.	4 / 5
Workflow Clarity	PICERL phases are clearly sequenced with checkpoints (3.3 verify containment, 5.1 ensure threat removed) and confirmation gates guarding destructive ops, but failure-feedback loops (what to do if post-containment activity persists) are less explicit than the 5 anchor.	4 / 5
Progressive Disclosure	Single cohesive file with well-organized sections and no nested references; the two reference tables are compact enough to justify inline placement, though at ~285 lines a split reference file could be considered.	4 / 5
	Total	16 / 20 Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A model description: third-person voice, explicit trigger clause, comprehensive concrete actions, and a distinctive niche. No vague fluff or over-claims.

Dimension	Reasoning	Score
Specificity	Names the domain and lists four concrete actions — 'Investigates activity, contains the account, removes persistence, and restores access' — giving comprehensive coverage of the response lifecycle.	5 / 5
Completeness	Explicitly answers both what ('Respond to a potentially compromised user account') and when ('Use when impossible travel, credential stuffing, successful phishing, or suspicious activity indicates account compromise') with concrete trigger phrases.	5 / 5
Trigger Term Quality	'impossible travel, credential stuffing, successful phishing, or suspicious activity' are natural terms a security analyst would actually say when requesting this skill, with strong synonym coverage around account compromise.	5 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (compromised-account IR) with distinct security-specific triggers unlikely to fire for unrelated skills.	5 / 5
	Total	20 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: dandye/ai-runbooks
Path: skills/respond-compromised-account/SKILL.md
Commit: 72a6863

Reviewed: 6 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.