respond-ransomware

Respond to a ransomware incident following PICERL methodology. Use when ransomware is detected or suspected. Orchestrates identification, containment, eradication, and recovery phases. Requires CASE_ID and initial indicators.

Quality

87%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Quality

Content

82%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, lean incident-response workflow with concrete tool calls and clear sequencing. The main gaps are a few abstract action steps and an implicit rather than explicit failure-feedback loop on containment.

Suggestions

Make the failure-feedback loop explicit in Step 3.4: if continued activity is detected after isolation, re-isolate and re-investigate rather than just 'monitor'.

Replace abstract actions like 'trigger endpoint isolation (via EDR or network)' and 'Perform thorough AV/EDR scans' with the specific tool call or command to invoke.

Tighten the overlap between the per-phase Required Outputs tables and the Quick Reference table so each phase's key outputs are stated once.

Dimension	Reasoning	Score
Conciseness	Lean throughout: numbered steps, parameterized tool calls, and output tables with no padding about what ransomware or PICERL is; assumes Claude's competence and every section is actionable.	5 / 5
Actionability	Provides concrete executable MCP calls (e.g. 'secops-soar.get_case_full_details(case_id=CASE_ID)') and slash commands, but a few steps stay abstract ('trigger endpoint isolation (via EDR or network)', 'Perform thorough AV/EDR scans') without the exact command.	4 / 5
Workflow Clarity	PICERL phases and sub-steps are clearly sequenced with confirmation gates ('/confirm-action') and validation checkpoints (Step 3.4 verify containment, Step 5.4 monitor), but the validate-then-retry feedback loop on containment failure is implicit rather than spelled out.	4 / 5
Progressive Disclosure	Well-organized into Inputs, Required Outputs, per-phase sections, Critical Warnings, and a Quick Reference for easy navigation; no nested references, though some phase content overlaps between Required Outputs and the Quick Reference table.	4 / 5
	Total	17 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that clearly states both capability and trigger conditions with a distinct ransomware niche. The only minor gap is keyword synonym coverage in the trigger term.

Dimension	Reasoning	Score
Specificity	Names the domain and lists multiple concrete actions across phases — 'Orchestrates identification, containment, eradication, and recovery phases' — with comprehensive coverage of the response lifecycle in third-person voice.	5 / 5
Completeness	Explicitly answers both what ('Respond to a ransomware incident following PICERL methodology') and when ('Use when ransomware is detected or suspected') with a concrete trigger phrase, plus a precondition ('Requires CASE_ID and initial indicators').	5 / 5
Trigger Term Quality	'Use when ransomware is detected or suspected' supplies the natural keyword 'ransomware', but common synonyms a user might say (ransom note, encrypted files, ransomware attack) are absent.	4 / 5
Distinctiveness Conflict Risk	The ransomware-specific niche, PICERL methodology framing, and CASE_ID precondition make this clearly distinct from other IR skills with minimal conflict risk.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: dandye/ai-runbooks
Path: skills/respond-ransomware/SKILL.md
Commit: 72a6863

Reviewed: 6 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.