Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Kin9Zeus/senior-engineer-skills --skill security-incident-responsegit clone --depth 1 https://github.com/Kin9Zeus/senior-engineer-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kin9zeus/senior-engineer-skills/security-incident-response)<a href="https://agentmods.dev/skills/kin9zeus/senior-engineer-skills/security-incident-response"><img src="https://agentmods.dev/badge/skills/kin9zeus/senior-engineer-skills/security-incident-response/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kin9zeus/senior-engineer-skills/security-incident-response"><img src="https://agentmods.dev/badge/skills/kin9zeus/senior-engineer-skills/security-incident-response.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00223 | $0.02535 |
| Opus 5.5 | $0.00089 | $0.01014 |
| Sonnet 5.5 | $0.00045 | $0.00507 |
| Haiku 4.5 | $0.00022 | $0.00253 |
Grade A, and why
security-incident-response scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 201 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Security Incident Response
When something may already be compromised, the work is different. You are no longer preventing — you are limiting damage, finding the extent, and not destroying evidence while you do it.
Scope: systems the user owns or is authorised to defend. Never "hack back", never probe a third party's infrastructure, never touch systems you were not asked about. Read-only investigation first; every destructive step (revoking, deleting, rebuilding, wiping) needs the user's confirmation.
Not legal advice. Breach-notification duties vary by jurisdiction and contract. Where this skill mentions a legal clock, it is a prompt to ask a lawyer or the data-protection officer, not an answer.
1. Triage — classify in the first fifteen minutes
Four situations need different first moves. Decide which one you are in; it can be more than one.
| Class | Signal | First move |
|---|---|---|
| A · Provider / platform breach | A vendor (host, PaaS, CI, registry, SaaS) announces unauthorised access to systems that hold your data or secrets | Rotate every secret that provider stored, then hunt for use of them. See references/platform-breach-playbook.md |
| B · Leaked credential | A key in a public repo, a log, a bundle, a paste, a screenshot; or unexplained usage on an API key | Revoke or rotate first, then check for abuse, then clean the leak. Never the reverse |
| C · Critical CVE in your runtime | A language, web server, framework or image has an actively-targeted remote-code-execution flaw | Inventory, patch, restart, then assume exposure for the window before the patch. See php-hardening for the PHP case |
| D · Active intrusion | Unknown processes, unexpected files, new admin users, outbound traffic you cannot explain | Isolate, preserve evidence, then investigate. Do not "clean up" first |
If two classes apply at once — a platform breach while a runtime CVE is open, for example — secrets exposed by A are exactly what an attacker exploiting C would read. Treat the combination as one incident with the higher severity.
What ships with it
7 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/detection-and-hunting.md 6.8 KB
- references/platform-breach-playbook.md 8.2 KB
- references/secret-rotation-playbook.md 6.7 KB
- scripts/rotation-inventory.ps1 4.7 KB runs code
- scripts/rotation-inventory.sh 5.1 KB runs code
- templates/incident-timeline.md 1.6 KB
- templates/rotation-tracker.md 1.5 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 201 lines · 223 tokens per session scan A 2c6a0be3990b
security-incident-response is a skill published in the GitHub repository Kin9Zeus/senior-engineer-skills (3 stars, last pushed 2d ago), licensed MIT. It adds 223 tokens to every session and 2,535 once invoked, about $0.0009 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-24.
Other skills, from other repositories
design-component
Design a UI component spec to the house quality bar (anatomy, variants, sizes, the 8 states, token mapping, and accessibility). Use when the user wants to design or document a component (button, input, tabs, toast, combobox, date picker, modal, etc.) at the spec level before or alongside code. For generating framework…
data-dashboard
Build a dense, data-heavy screen - an analytics console or a trading terminal - with real charts drawn from tokens: candlestick, volume, depth, stacked area, waterfall, scatter, correlation matrix, donut, gauge, sparklines, heatmaps and order books. Use when the request is a dashboard, terminal, monitoring view, data…
design-screen
Design or build a page, screen, landing page, website, app or UI from a request - the whole job, end to end. Use this for "design a landing page", "build a settings screen", "make me a website", "design the onboarding", "ออกแบบหน้าเว็บ", "ทำหน้า landing", "ออกแบบ UI", "ทำแอป". It runs the pipeline no single skill…
critique
Adversarial design critique of the current work. Render it, look at it, and argue for rejection. Run after the gates are green, never instead of them.
scaffold-project
Scaffold a new design-product project that matches the recommended Claude Code layout (the reference structure). Use when starting a fresh product/app that will be built with this design system.
design-code
Generate production-ready, accessible, token-driven component code for ANY framework (React+Tailwind, Next.js, SwiftUI, Vue, Svelte, Angular, Solid, Web Components/Lit, React Native, Flutter, Jetpack Compose, vanilla CSS, or CSS-in-JS). Use when the user wants working UI code for a component or screen in a specific…