Can this skill help with legal evidence preservation?

Yes, it provides specific guidance on collecting and preserving logs, network data, and application snapshots to ensure forensic integrity for potential legal action.

Is it suitable for creating post-mortem reports?

Absolutely. The skill assists in constructing a detailed timeline of events and documenting lessons learned to generate comprehensive post-incident reports.

How does the Security Incident Responder skill handle ransomware?

The skill classifies the ransomware attack, suggests immediate containment steps to isolate affected systems, and provides a recovery roadmap for restoring data from backups.

What triggers this skill in Claude Code?

The skill is triggered by keywords related to security events, such as 'data breach', 'DDoS', 'incident response plan', 'containment', or 'remediation'.

Security Incident Responder

Name: Security Incident Responder
Author: jeremylongshore

byjeremylongshore

•

883

Security & Testing

Guides users through the complete security incident response lifecycle, from initial classification to forensic evidence collection and remediation.

About

The Security Incident Responder skill empowers developers and security teams to handle breaches and attacks with a structured, professional framework. It assists in classifying incident types—such as ransomware, DDoS, or data breaches—and generates tailored playbooks for containment, eradication, and recovery. By providing guidance on evidence preservation and remediation planning, this skill ensures that security events are managed effectively while minimizing damage and supporting future forensic investigations.

Key Features

Dynamic generation of containment and recovery playbooks
Post-incident report generation and timeline construction
Step-by-step remediation planning for exploited vulnerabilities
Automated incident classification and severity assessment
Guidance for forensic evidence collection and log analysis
883 GitHub stars

Use Cases

Investigating a suspected data breach to determine the scope of compromised information
Responding to an active ransomware attack by isolating systems and planning restoration
Developing and testing organizational security incident response plans

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add jeremylongshore/claude-code-plugins-plus-skills security-incident-responder

For use in Claude.ai and ChatGPT

Download Skill

GitHub