Skip to content
responding-to-security-incidents logo

Responding To Security Incidents

responding-to-security-incidents

Analyze and guide security incident response, investigation, and remediation processes. Use when you need to handle security breaches, classify incidents, develop response playbooks, gather forensic evidence, or coordinate remediation efforts. Trigger with phrases like "security incident response...

SKILL.md

Full skill instructions

Responding To Security Incidents

Overview

This skill provides automated assistance for the described functionality.

Prerequisites

Before using this skill, ensure:

  • Access to system and application logs in {baseDir}/​logs/
  • Network traffic captures or SIEM data available
  • Incident response team contact information
  • Backup systems operational and accessible
  • Write permissions for incident documentation in {baseDir}/​incidents/
  • Communication channels established for stakeholder updates

Instructions

  1. Triage the incident and scope affected systems/​data.
  2. Preserve evidence (logs, snapshots, network captures) before making changes.
  3. Contain the blast radius and eradicate root cause.
  4. Recover safely and document follow-ups (AAR + backlog).

See {baseDir}/​references/​implementation.md for detailed implementation guide.

Output

The skill produces:

Primary Output: Incident response playbook saved to {baseDir}/​incidents/​incident-YYYYMMDD-HHMM.md

Playbook Structure:

# Security Incident Response - [Incident Type]

## Error Handling

See `{baseDir}/​references/​errors.md` for comprehensive error handling.

## Examples

See `{baseDir}/​references/​examples.md` for detailed examples.

## Resources

- NIST Computer Security Incident Handling Guide: https://nvlpubs.nist.gov/​nistpubs/​SpecialPublications/​NIST.SP.800-61r2.pdf
- SANS Incident Handler's Handbook: https://www.sans.org/​white-papers/​33901/
- CISA Incident Response Guide: https://www.cisa.gov/​incident-response
- Memory analysis: Volatility Framework
- Disk forensics: Autopsy, FTK Imager

More skills from HelixDevelopment

fireflies-local-dev-loop logo
HelixDevelopment/HelixAgent

fireflies-local-dev-loop

Configure Fireflies.ai local development with hot reload and testing. Use when setting up a development environment, configuring test workflows, or establishing a fast iteration cycle with Fireflies.ai. Trigger with phrases like "fireflies dev setup", "fireflies local development", "fireflies dev...

0 0
View
clerk-security-basics logo
HelixDevelopment/HelixAgent

clerk-security-basics

Implement security best practices with Clerk authentication. Use when securing your application, reviewing auth implementation, or hardening Clerk configuration. Trigger with phrases like "clerk security", "secure clerk", "clerk best practices", "clerk hardening".

0 0
View
openrouter-team-setup logo
HelixDevelopment/HelixAgent

openrouter-team-setup

Configure OpenRouter for team and organizational use. Use when setting up multi-user access or department billing. Trigger with phrases like 'openrouter team', 'openrouter organization', 'multi-user openrouter', 'openrouter rbac'.

0 0
View
coderabbit-security-basics logo
HelixDevelopment/HelixAgent

coderabbit-security-basics

Apply CodeRabbit security best practices for secrets and access control. Use when securing API keys, implementing least privilege access, or auditing CodeRabbit security configuration. Trigger with phrases like "coderabbit security", "coderabbit secrets", "secure coderabbit", "coderabbit API key ...

0 0
View
detecting-infrastructure-drift logo
HelixDevelopment/HelixAgent

detecting-infrastructure-drift

Execute use when detecting infrastructure drift from desired state. Trigger with phrases like "check for drift", "infrastructure drift detection", "compare actual vs desired state", or "detect configuration changes". Identifies discrepancies between current infrastructure and IaC definitions usin...

0 0
View
cursor-reference-architecture logo
HelixDevelopment/HelixAgent

cursor-reference-architecture

Execute reference architecture patterns for Cursor IDE projects. Triggers on "cursor architecture", "cursor project structure", "cursor best practices", "cursor team setup". Use when working with cursor reference architecture functionality. Trigger with phrases like "cursor reference architecture...

0 0
View
vastai-security-basics logo
HelixDevelopment/HelixAgent

vastai-security-basics

Apply Vast.ai security best practices for secrets and access control. Use when securing API keys, implementing least privilege access, or auditing Vast.ai security configuration. Trigger with phrases like "vastai security", "vastai secrets", "secure vastai", "vastai API key security".

0 0
View
instantly-incident-runbook logo
HelixDevelopment/HelixAgent

instantly-incident-runbook

Execute Instantly incident response procedures with triage, mitigation, and postmortem. Use when responding to Instantly-related outages, investigating errors, or running post-incident reviews for Instantly integration failures. Trigger with phrases like "instantly incident", "instantly outage", ...

0 0
View
configuring-load-balancers logo
HelixDevelopment/HelixAgent

configuring-load-balancers

Configure use when configuring load balancers including ALB, NLB, Nginx, and HAProxy. Trigger with phrases like "configure load balancer", "create ALB", "setup nginx load balancing", or "haproxy configuration". Generates production-ready configurations with health checks, SSL termination, sticky ...

0 0
View
building-recommendation-systems logo
HelixDevelopment/HelixAgent

building-recommendation-systems

Execute this skill empowers AI assistant to construct recommendation systems using collaborative filtering, content-based filtering, or hybrid approaches. it analyzes user preferences, item features, and interaction data to generate personalized recommendations... Use when appropriate context det...

0 0
View
perplexity-multi-env-setup logo
HelixDevelopment/HelixAgent

perplexity-multi-env-setup

Configure Perplexity across development, staging, and production environments. Use when setting up multi-environment deployments, configuring per-environment secrets, or implementing environment-specific Perplexity configurations. Trigger with phrases like "perplexity environments", "perplexity s...

0 0
View
juicebox-sdk-patterns logo
HelixDevelopment/HelixAgent

juicebox-sdk-patterns

Apply production-ready Juicebox SDK patterns. Use when implementing robust error handling, retry logic, or enterprise-grade Juicebox integrations. Trigger with phrases like "juicebox best practices", "juicebox patterns", "production juicebox", "juicebox SDK architecture".

0 0
View

Popular AI tools

Kaiber logo
Video

Kaiber

Generate, edit, and beat-sync AI video with leading models in one workspace.

Paid
View
Vimcal logo
Productivity

Vimcal

The world's fastest calendar for remote work

Free
View

Transform Your Design with AI Designer by ImgCreator.ai

Freemium
View
Akool AI logo
Content & writing

Akool AI

Revolutionizing Video Production with AI-Powered Creativity

Paid
View

Extend an image past the frame and let AI fill the new aspect ratio.

Freemium
View
StarByFace logo
Security

StarByFace

Discover your celebrity doppelgänger with StarByFace!

Free
View
C

ChainClarity explains 700+ crypto whitepapers in plain English, with layered summaries, comparisons, research tools, alerts, and a $4.99 Pro plan.

Freemium
View
Opus Clip logo
Coding & apps

Opus Clip

Opus.ai: Revolutionize Your Web Experience

Free
View