ai-runbooks
github.com/dandye/ai-runbooks
| Skill | Added | Review |
|---|---|---|
cluster-documents skills/cluster-documents/SKILL.md Automated content similarity and grouping analysis. Groups related documents by topic, purpose, or content similarity. | 52 52 Impact — No eval scenarios have been run Securityby  Passed No findings from the security scan Version: 72a6863 | |
close-case-artifact skills/close-case-artifact/SKILL.md Close a case or alert with proper reason and documentation. Use when triage determines an alert is FP/BTP or investigation is complete. Requires artifact ID, type, closure reason, and root cause. | 71 71 Impact — No eval scenarios have been run Securityby Passed No findings from the security scan Version: 72a6863 | |
check-duplicates skills/check-duplicates/SKILL.md Check for duplicate or similar cases. Use before deep analysis to avoid investigating the same incident twice. Takes a CASE_ID and returns list of similar cases. | 60 60 Impact — No eval scenarios have been run Securityby Passed No findings from the security scan Version: 72a6863 | |
audit-content skills/audit-content/SKILL.md Comprehensive content quality and maintenance assessment. Evaluates documentation quality, relevance, maintenance needs, and provides actionable recommendations. | 49 49 Impact — No eval scenarios have been run Securityby Passed No findings from the security scan Version: 72a6863 | |
analyze-content-gaps skills/analyze-content-gaps/SKILL.md Identify content gaps and organizational opportunities. Analyzes missing content areas, redundancies, and consolidation opportunities. | 55 55 Impact — No eval scenarios have been run Securityby Passed No findings from the security scan Version: 72a6863 | |
full-investigation skills/_workflows/full-investigation/SKILL.md Complete Tier 2 investigation workflow. Orchestrates deep investigation of escalated cases: deep-dive-ioc, correlate-ioc, specialized triage (malware/login), pivot-on-ioc, and generate comprehensive report. Use for escalated cases requiring thorough analysis. | 59 59 Impact — No eval scenarios have been run Securityby Low Low-risk findings worth noting Version: 72a6863 | |
full-alert-triage skills/_workflows/full-alert-triage/SKILL.md Complete Tier 1 triage workflow. Orchestrates the full alert triage process: check-duplicates, triage-alert, enrich-ioc for each entity, and either close (FP/BTP) or escalate (TP/Suspicious). Use for end-to-end alert processing. | 55 55 Impact — No eval scenarios have been run Securityby Low Low-risk findings worth noting Version: 72a6863 |