Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/telagod/code-abyss/detecting-and-respondingnpx skills add telagod/code-abyss --skill detecting-and-respondinggit clone --depth 1 https://github.com/telagod/code-abyssWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/telagod/code-abyss/detecting-and-responding)<a href="https://agentmods.dev/skills/telagod/code-abyss/detecting-and-responding"><img src="https://agentmods.dev/badge/skills/telagod/code-abyss/detecting-and-responding.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00087 | $0.01288 |
| Opus 5 | $0.00044 | $0.00644 |
| Sonnet 5 | $0.00017 | $0.00258 |
| Haiku 4.5 | $0.00009 | $0.00129 |
Grade A, and why
detecting-and-responding scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 69 lines — stays where its author put it; the contents beside it link to each section on GitHub.
蓝队检测与响应 · 镇魔盾
判断先于执行：决定「是否做 / 选什么 / 如何取舍」（栈、方案、架构、权衡）前，先读领域判断内核
skills/_kernel/security/SKILL.md——它管 judgment，本秘典管 execution；冲突时以内核判断为准。
检测是工程，不是运气。每条规则必须能回答四问：what / why / FP rate / response。 站在防御侧，把告警当代码维护、把事件当事故管理、把狩猎当假设验证。 信级：项目日志/EDR 原始事件 > Sigma/YARA 规则库 > ATT&CK 官方矩阵 > 训练记忆（标
[unverified]）。
路由
| 意图 | 秘典 | 触发词 |
|---|---|---|
| SIEM/EDR 规则与调优 | siem-and-edr | Sigma, YARA, Splunk, Elastic, Sentinel, EDR, LOLBins, detection-as-code |
| 事件响应与取证 | incident-response | IR, NIST 800-61, triage, chain of custody, Volatility, memory, runbook, postmortem |
| 威胁狩猎与紫队 | threat-hunting | hunt, hypothesis, IOC, IOA, TTP, ATT&CK, Atomic Red Team, Caldera, 蜜罐 |
执行链
检测：日志源 → 规则编写 → 告警分级 → 调优降噪 → 覆盖矩阵
响应：识别 → 遏制 → 根因 → 清除 → 恢复 → 复盘
狩猎：假设 → 数据源 → 验证 → 规则化 → 自动化 → 紫队闭环
每环必须可回答「我看的是哪条日志？我证伪的是哪条假设？我下一步动作是什么？」
何时使用
| 场景 | 用 | 不用 |
|---|---|---|
| 写 Sigma/YARA 规则、调 SIEM | ✅ siem-and-edr | — |
| 处理已发生入侵、取证 | ✅ incident-response | — |
| 假设驱动狩猎 / 紫队演练 | ✅ threat-hunting | — |
| ATT&CK 检测覆盖打分 | ✅ threat-hunting | — |
| 设计应用层防御代码 | ❌ | defending-applications |
| 渗透测试、写 PoC | ❌ | securing-systems (pentest/red-team) |
| 威胁建模、IAM 架构 | ❌ | architecting-security |
| 代码静态扫描胶水 | ❌ | analyzing-security |
| 云配置基线、K8s 加固 | ❌ | securing-cloud-and-supply-chain |
联动
- securing-systems/red-team：攻方 TTP 是本 skill 检测规则的设计输入。
- securing-systems/threat-intel：IOC/CTI 投喂本 skill 的规则与狩猎假设。
- architecting-security/threat-modeling：威胁模型的 detective control 在本 skill 落地。
- analyzing-security：本 skill 产出的 detection-as-code 接入 CI 门禁。
- automating-devops/observability：日志/指标/链路三支柱的安全维。
铁律
- 无噪不出闸 — 任何规则上线前必须有基线 + FP rate 测量；FP > 5% 直接打回调优，不准带病上线。
- 不证伪即假设 — 狩猎必须有可证伪的假设；找不到不是结论，是数据缺失或假设错。
- 取证不破坏现场 — 先采易失证据（内存/网络/进程），再动磁盘；写阻断器 + 哈希链 + 时间戳三件套必须齐。
- 检测即代码 — 规则进 git、有 unit test、过 CI、有 owner；改规则等同改生产代码。
- 闭环到 ATT&CK — 每条规则、每次事件、每次狩猎必须映射到 ATT&CK 技术 ID；无 ID 不归档。
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 69 lines · 87 tokens per session scan A b5fb85e8ab0e
detecting-and-responding is a skill published in the GitHub repository telagod/code-abyss (239 stars, last pushed 1mo ago), licensed MIT. It adds 87 tokens to every session and 1,288 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
codexkit-api-design-reviewer
Review REST and GraphQL API designs for consistency, usability, and best practices. Covers naming conventions, versioning strategy, error format, pagination, authentication patterns, and breaking change detection. Use when reviewing API specs, designing new APIs, or auditing existing endpoints.
codexkit-change-management-plan
Build change management plans using ADKAR and Kotter's 8-Step framework. Covers stakeholder readiness, communication plans, training schedules, resistance management, and adoption metrics. Use when rolling out new systems, reorganizations, or process changes that affect people.
codexkit-crisis-communication
Draft crisis communication packages including holding statements, stakeholder updates, Q&A documents, and internal briefs. Follows ICS (Incident Command System) communication principles. Use during PR crises, data breaches, product recalls, or any event requiring rapid coordinated messaging.
codexkit-interview-guide-builder
Build structured behavioral interview guides using the STAR method. Map job competencies to interview questions, provide scoring rubrics (1–5), and include follow-up probes and red/green flag indicators. Use when preparing for hiring interviews or standardizing interview practices.
codexkit-legal-due-diligence
Conduct structured legal due diligence for M&A, joint ventures, or investment transactions. Cover all 9 workstreams — Corporate, Contracts, IP, Litigation, Regulatory, Employment, Tax, Environmental, and Data Privacy. Produce a risk matrix with deal-breaker flags and closing conditions. Use when evaluating a target or…
codexkit-a-b-test-planner
Design rigorous A/B test plans with hypothesis, sample size calculation, Minimum Detectable Effect (MDE), randomization strategy, and decision rules. Includes guardrail metrics and rollout playbook. Use when planning product experiments, conversion optimization, or data-driven feature decisions.