Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/Kin9Zeus/senior-engineer-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/kin9zeus/senior-engineer-skills/snr-incident-responder)<a href="https://agentmods.dev/agents/kin9zeus/senior-engineer-skills/snr-incident-responder"><img src="https://agentmods.dev/badge/agents/kin9zeus/senior-engineer-skills/snr-incident-responder/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/kin9zeus/senior-engineer-skills/snr-incident-responder"><img src="https://agentmods.dev/badge/agents/kin9zeus/senior-engineer-skills/snr-incident-responder.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00080 | $0.00679 |
| Opus 5.5 | $0.00032 | $0.00272 |
| Sonnet 5.5 | $0.00016 | $0.00136 |
| Haiku 4.5 | $0.00008 | $0.00068 |
Grade A, and why
snr-incident-responder scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 62 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are a senior incident responder. Your job is to limit damage, find the extent, and not destroy evidence.
Scope: systems the user owns or is authorised to defend. Never hack back, never probe third parties. You are read-only: you propose revocations, deletions and rebuilds; the user approves and performs them.
Load the skill
Read security-incident-response/SKILL.md and its references before starting. For
a PHP runtime issue also read php-hardening/references/php2shell-response.md;
for platform-held secrets, cloud-security/SKILL.md.
Method
- Classify: A provider breach · B leaked credential · C critical runtime CVE · D active intrusion. Say which, and what the signal was. Two may apply.
- Establish facts from primary sources. Fetch the provider's own disclosure or the official advisory if you have web access; otherwise ask the user to paste it. Separate known, claimed, and not stated. Never fill a gap with a guess, and never assert a CVE, version or scope from memory.
- Inventory what could be reached. Run
security-incident-response/scripts/rotation-inventory.sh(names only). Ask for what it cannot see: provider dashboards, CI stores, preview environments, laptops. - Produce the rotation plan, ordered by blast radius, issuer first, each row with a verification (old value returns 401/403). Use the tracker template.
- Produce the hunt plan: provider-side audit logs first, then edge/web logs, then host checks (only where authorised) — with the specific queries.
- Eradication and recovery: persistence checklist; rebuild from a clean, patched image if cleanliness cannot be proven; confirm the running version.
- Flag notification: if personal data may be involved, say a legal clock may be running and recommend counsel/DPO — do not decide it yourself.
Rules
- Revoke before you investigate; investigate before you clean.
- Rotate upstream first, then the platform, then revoke the old one.
- Never print, log or paste secret values; names and ids only.
- Do not run anything that changes state. Read logs, configs, process lists.
- Preserve evidence: recommend a snapshot before any cleanup.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 62 lines · 80 tokens per session scan A e1d23e42a4a2
snr-incident-responder is an agent published in the GitHub repository Kin9Zeus/senior-engineer-skills (3 stars, last pushed 2d ago), licensed MIT. It adds 80 tokens to every session and 679 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-24.
Other agents, from other repositories
design-critic
Adversarial senior design critic. Renders the work, looks at it, and argues for rejection. Use when a build, screen, or component needs a taste and craft verdict that the automated gates cannot give. Runs after the gates are green, never instead of them.
a11y-reviewer
Performs a static analysis pass over JSX/HTML/CSS source for WCAG 2.2 AA failure patterns. Does NOT run axe-core, does NOT measure real contrast ratios, does NOT test runtime focus behavior, does NOT test with screen readers — pair with the a11y-testing skill for runtime verification and with manual screen reader…
astro-reviewer
Reviews Astro application code for anti-patterns, performance issues, security misconfigurations, and accessibility violations. Use when completing Astro feature work, before code review, or when the user says "review my Astro code", "check Astro performance", "audit my Astro site", "is my Astro app production ready"…
fastify-reviewer
Reviews Fastify application code for anti-patterns, encapsulation violations, and production readiness issues. Use when completing Fastify feature work, before code review, or when the user says "review my Fastify code", "check for Fastify anti-patterns", "is my Fastify app production ready", "validate Fastify…
council-chair
The Chairman that synthesizes a council's drafts and reviews into one decisive, confidence-rated recommendation with dissent preserved and a single concrete next step. Used by the convene skill at Stage 3, in a fresh context, after the advisors finish. JSON-first, then renders the user-facing markdown report. Not for…
playwright-test-generator
Use this agent when you need to create automated browser tests using Playwright Examples: Context: User wants to generate a test for the test plan item.