Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add meltedinhex/analyst-ai-pack --skill scoping-an-incident-from-a-single-indicatorgit clone --depth 1 https://github.com/meltedinhex/analyst-ai-packWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/meltedinhex/analyst-ai-pack/scoping-an-incident-from-a-single-indicator)<a href="https://agentmods.dev/skills/meltedinhex/analyst-ai-pack/scoping-an-incident-from-a-single-indicator"><img src="https://agentmods.dev/badge/skills/meltedinhex/analyst-ai-pack/scoping-an-incident-from-a-single-indicator/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/meltedinhex/analyst-ai-pack/scoping-an-incident-from-a-single-indicator"><img src="https://agentmods.dev/badge/skills/meltedinhex/analyst-ai-pack/scoping-an-incident-from-a-single-indicator.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00075 | $0.00731 |
| Opus 5 | $0.00037 | $0.00365 |
| Sonnet 5 | $0.00015 | $0.00146 |
| Haiku 4.5 | $0.00007 | $0.00073 |
Grade A, and why
scoping-an-incident-from-a-single-indicator scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 92 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Scoping an Incident from a Single Indicator
When to Use
- A detection fired on one indicator (a hash, IP, domain, or account) and you must find the full extent of the activity.
- You need to bound the incident — which hosts, accounts, and infrastructure are involved — before containment.
- You are building an investigative timeline from a single starting point.
Do not use premature containment on the first indicator alone — acting before scoping can tip off the adversary and leave footholds you have not yet found.
Prerequisites
- Access to relevant data sources (EDR, proxy, DNS, auth logs) and the pivoting/enrichment skills.
Workflow
Step 1: Characterize the seed indicator
Establish what the indicator is, when it was first/last seen, and on which host/account it appeared.
Step 2: Pivot to related artifacts
Expand outward: the file's other hosts, the IP's other connections, the account's other logons, the domain's other resolvers. Each pivot yields new indicators to pivot again.
python scripts/analyst.py scope events.json --seed <sha256-or-ip>
Step 3: Build the timeline
Order all discovered events chronologically to reconstruct the activity and find the earliest sign (candidate patient zero / initial access).
Step 4: Bound the scope
Define affected vs. unaffected explicitly: list involved hosts/accounts/infrastructure and the evidence for inclusion, and note what was checked and cleared.
Step 5: Hand off to containment
Produce the scoped picture (entities, timeline, indicators) so containment is coordinated and complete rather than piecemeal.
Validation
- Every included entity has explicit evidence tying it to the incident.
- The timeline has a defensible earliest event (initial access candidate).
- Cleared entities are documented, so scope is bounded, not open-ended.
Pitfalls
- Containing the first host before pivoting, alerting the adversary and missing other footholds.
- Pivoting only one hop and missing second-order related entities.
- No timeline, so initial access and dwell time stay unknown.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 92 lines · 75 tokens per session scan A ea3ba46a863b
scoping-an-incident-from-a-single-indicator is a skill published in the GitHub repository meltedinhex/analyst-ai-pack (22 stars, last pushed 2mo ago), licensed Apache-2.0. It adds 75 tokens to every session and 731 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-malicious-pdf-with-peepdf
Perform static analysis of malicious PDF documents using peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects. Use when triaging a suspicious PDF attachment from a phishing email, analyzing a PDF-based exploit document, or building detection signatures for weaponized PDF…
analyzing-cobalt-strike-beacon-configuration
Extract and analyze Cobalt Strike beacon configuration from PE files and memory dumps to identify C2 infrastructure, malleable profiles, and operator tradecraft.
analyzing-network-covert-channels-in-malware
Detect and analyze covert communication channels used by malware, including DNS tunneling, ICMP exfiltration, steganographic HTTP, and other protocol abuse used for C2 and data exfiltration. Use when investigating suspicious DNS/ICMP/HTTP traffic patterns, hunting for hidden C2 channels in network captures, or…
analyzing-malware-persistence-with-autoruns
Use Sysinternals Autoruns to systematically enumerate and analyze malware persistence mechanisms across Windows registry run keys, scheduled tasks, services, drivers, and startup locations. Use when hunting for persistence during Windows incident response, triaging a compromised endpoint, or validating that malware…
analyzing-heap-spray-exploitation
Detect and analyze heap spray attacks in memory dumps using Volatility3 plugins to identify NOP sled patterns, shellcode landing zones, and suspicious large allocations in process virtual address space.