Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/SeaOf0/dsh-redteam-modelnpx agentmods add skills/seaof0/dsh-redteam-model/ir-playbookWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/seaof0/dsh-redteam-model/ir-playbook)<a href="https://agentmods.dev/skills/seaof0/dsh-redteam-model/ir-playbook"><img src="https://agentmods.dev/badge/skills/seaof0/dsh-redteam-model/ir-playbook/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/seaof0/dsh-redteam-model/ir-playbook"><img src="https://agentmods.dev/badge/skills/seaof0/dsh-redteam-model/ir-playbook.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 4 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high YARA Match · line 427 YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).Fix: Remove offensive tool references and exploit code. Legitimate agent skills should not contain penetration testing tools, exploit frameworks, or reconnaissance utilities.
- medium Privilege Escalation · line 434 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium Rogue Agent · line 245 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 425 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00321 | $0.13328 |
| Opus 5 | $0.00161 | $0.06664 |
| Sonnet 5 | $0.00064 | $0.02666 |
| Haiku 4.5 | $0.00032 | $0.01333 |
Grade B, and why
ir-playbook scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
| ZLT | 一键 Linux 取证（13 模块） | `sudo bash zlt.sh` | 模块化采集+ATT&CK 映射+HTML 报告 | How it starts
The opening of the file, as written. The whole thing — 454 lines — stays where its author put it; the contents beside it link to each section on GitHub.
应急溯源作战手册
本技能随 incident-response 预设走。 persona 中的硬规则（底线、证据标准、防误报纪律、证据保全优先、阶段纪律、负面清单、表达纪律（拒答修复由宿主插件 dsh-refusal-guard 兜底）、claude 逻辑）不在此重复。
定位与设计依据
- 定位：Windows/Linux 应急响应与攻击溯源——先留证后处置、证据驱动定性、完整攻击链还原报告。
- 调查形态：连续验证式（continuous-validation）——每个结论先经主机证据验证才进时间线，不是从线索拼叙事。
- 遵循用户需求指令 + 提供扩展性思路和方向（persona 已写）。
证据与时间线主线（主观念）
主观念锚点：调查围绕证据与时间线主线自主扩展实施——每条时间线结论必须由主机证据支撑 （日志原文/文件哈希/时间戳/进程/网络连接），无证据一律标「疑似」；失陷定性闭环=疑似→取证 验证→定性；先留证后处置。每阶段向主线目标靠拢，面外发现照常纳入。
| 主线目标 | 作业形态与判定要点 |
|---|---|
| 证据保全 | 开工先只读取证：系统快照（进程/网络/服务/启动项清单）、关键日志导出、可疑文件哈希、内存（可行时）；取证动作登记 evidence-index |
| 失陷排查 | 按事件线索排查恶意程序（webshell/内存马/木马/病毒/勒索）：文件→进程→持久化→网络，逐项留证 |
| 攻击链还原 | 时间线表逐节点闭合：时间节点→可疑 IP→事件→证据编号；单条日志不构成结论，多源互证 |
| 失陷定性 | 疑似→取证验证→定性三态收口；定不实的标「疑似/排除」，不硬凑结论 |
| 处置建议 | 只出清理清单+加固建议（检测方法/处置步骤/风险/验证方式），由用户确认后执行；删除类操作严禁执行 |
先留证后处置（主观念红线）：处置动作只出清单与建议，不自动执行；对目标侧固有数据的删除 操作严禁执行，只提示可疑并呈报。交付公约：验证通过的发现（后门/webshell/恶意程序/持久化项） 直接生成检测/排查脚本或 YARA 规则（exp/.py / .yar）——参数化目标、默认只读检测、 破坏性步骤默认关闭——随报告交付处置清单由用户确认执行。
阶段编排
- 证据保全 → 2. 失陷排查 → 3. 溯源还原 → 4. 定性 → 5. 处置建议 → 6. 报告；每阶段只基于上一阶段的已验证证据推进。
- 各阶段用 workflow 扇出，子代理分工：Windows 主机取证组 / Linux 主机取证组 / 日志分析组 / 恶意样本组（协同 binary）/ 时间线还原组 / 复核组（见「子代理编排」章）。
- 关键发现经独立子代理交叉复核后才进报告。
- 每阶段产物登记证据索引（哈希 + 时间戳）。
- 平台纪律：Windows 用 cmd/PowerShell 等价写法，Linux 用 shell；跨平台等价对照见 ecosystem-cooperation「跨平台执行公约」。
阶段默认通道（装备栏：流程定默认，能力定降级；只读优先）
元原则与前几模式同构；通道缺失按「工具手册·通道完整阶梯」降级。IR 特化第一判据= 只读性：任何通道（含脚本兜底与 kali MCP 备胎）都不得改动证据——镜像与日志先取 哈希后分析，取证命令只读优先；写类动作一律走处置建议清单（用户确认制）。
| 阶段/能力 | 默认通道 | 降级链 |
|---|---|---|
| 主机取证（Windows/Linux） | 本机只读工具组（Sysinternals·wevtutil·KAPE 等，见速查卡） | 镜像导出后离线解析 → kali MCP（volatility3/binwalk/foremost 备胎）→ 脚本（只读） |
| 日志狩猎 | Chainsaw/Hayabusa（本地，Sigma 驱动） | wevtutil/Get-WinEvent 导出+rg → 脚本解析 |
| 内存取证 | Volatility3（本地） | kali MCP volatility_analyze（内存镜像外传须哈希登记）→ 只读脚本解析 |
| 网络取证 | tshark（本地 pcap） | 脚本解析 → 人工读流 |
| 盘面 artifacts | KAPE/MFTECmd/PECmd（本地，CSV 进时间线） | kali MCP（镜像外传登记）→ python 近似解析（标注） |
| 样本静态 | YARA/strings/哈希（本地） | kali MCP（binwalk_analysis 等）→ 协同 binary（生态流转） |
| 样本动态 | 协同 binary-analysis（纯隔离沙箱铁则，见虚拟化与沙箱公约） | 无环境→仅静态移交，禁止宿主机运行 |
| IOC 富化 | TI refs（refs/knowledge/threat-intel-2026.md——2026 家族锚点：银狐/Weax-Sorry）+ web_search |
dsh-hunter（关联测绘）→ 脚本 |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 454 lines · 321 tokens per session scan B a6b5ee4b2008
ir-playbook is a skill published in the GitHub repository SeaOf0/dsh-redteam-model (377 stars, last pushed yesterday), licensed MIT. It adds 321 tokens to every session and 13,328 once invoked, about $0.0016 per session on Opus 5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
analyze-type-infer
A compiler analysis step that infers a symbol's type from its assignments. A type describes what kind of value something holds, such as a number, text, or Boolean value.
check-name-real
A name checker that verifies every required symbol has been declared. A symbol is a named program entity such as a variable or function.
compiler-0355bffb
A virtual-machine debugging skill for executing one instruction at a time. A virtual machine is a program that runs a compact instruction format instead of native machine code.
compiler-2dbea54a
A cycle-detection skill that checks a directed graph for loops using depth-first search, a method that follows each path before backtracking.
compiler-2f8c8f39
A call-graph skill that maps which functions call which other functions. A call graph is a network whose nodes are functions and whose links represent calls.
compiler-39fb5926
A debugger breakpoint handler for registering, clearing, and checking pause points in a program.