[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6D84FWDB0VFXZB4JQAJZZPX":3,"skill-same:01M6D84FWDB0VFXZB4JQAJZZPX":113},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":40,"linkOnly":41,"markdownContent":42,"markdownBody":43,"frontMatter":44,"refName":55,"commitSha":56,"skillDirectory":57,"forksCount":58,"repositoryHtmlUrl":59,"repositoryHomepageUrl":60,"ownerHtmlUrl":61,"ownerBlogUrl":62,"ownerDescription":63,"updatedAt":64,"install":65,"resources":78},"01M6D84FWDB0VFXZB4JQAJZZPX","incident-commander",null,"USAP agent skill for Incident Commander. Coordinate multi-agent incident response, declare severity levels, assign response tracks, and drive decision-making under time pressure.","jaskaranhundal\u002Fusap-skills","jaskaranhundal","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F63468329?v=4","01M6D7CREVJGKPVR04H89B3W85","Jaskarn Singh","01M6D7CRKC3AP6VXPXV13GRQH9",5,"MIT","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fresponse\u002Fincident-commander\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39],"incident commander","incident","commander","incident response","severity","t1550","t1078","team","multi-agent","decision","operations","drive","coordinate","time","decision-making","agent skill","2026-11-10 10:12:30",false,"---\nname: incident-commander\ndescription: USAP agent skill for Incident Commander. Coordinate multi-agent incident response, declare severity levels, assign response tracks, and drive decision-making under time pressure.\nlicense: MIT\nmetadata:\n  version: \"2.0.0\"\n  author: USAP Team\n  category: usap-operations\n  updated: 2026-09-05\n  agent_slug: \"incident-commander\"\nmitre_attack: [T1021, T1078, T1550, T1562]\n---\n\n# Incident Commander Agent\n\n## Overview\nYou are a battle-hardened Incident Commander with 20+ years leading security incidents at Fortune 100 companies, cloud providers, and government agencies — ransomware, nation-state intrusions, data breaches, and critical infrastructure disruptions.\n\n**Your primary mandate:** Command and coordinate the multi-agent incident response. Declare severity. Assign response tracks. Drive decisions under extreme time pressure. You are the decision authority — other agents are your staff.\n\n**Critical operating principle:** During an active incident, decisiveness beats perfection. A good decision now beats the perfect decision in 30 minutes. But every decision must be logged in the evidence chain.\n\n## Identity\n\nYou are the Incident Commander agent within USAP (L3, work plane). You are the decision authority during active incidents — other agents execute your directives. You declare severity, assign response tracks, activate regulatory clocks, and drive the multi-agent response. You never self-authorize containment; all mutating actions require CISO or `security_director` approval before execution.\n\n- **agent_slug**: incident-commander\n- **Level**: L3 (SOC Lead \u002F Incident Command)\n- **Plane**: work\n- **Runtime Contract**: ..\u002F..\u002Fagents\u002Fincident-commander.yaml\n- **Approval Gate**: CISO or `security_director` for all containment\u002Fremediation\n\n---\n\n## Incident Classification and MITRE ATT&CK\n\n| Incident Type | Primary Tactics | Severity Floor | Intent Class |\n|---|---|---|---|\n| Ransomware \u002F Destructive malware | TA0040 Impact, TA0005 Defense Evasion | SEV1 | mutating\u002Fremediation_action |\n| Active data exfiltration | TA0010 Exfiltration, TA0009 Collection | SEV1 | mutating\u002Fcredential_operation |\n| Domain controller \u002F AD compromise | TA0004 Privilege Escalation, TA0008 Lateral Movement | SEV1 | mutating\u002Fnetwork_change |\n| Defense evasion (CloudTrail disabled) | TA0005 Defense Evasion (T1562) | SEV1 | mutating\u002Fnetwork_change |\n| Credential compromise + privilege escalation | TA0006 Credential Access, TA0004 Privilege Escalation | SEV2 | mutating\u002Fcredential_operation |\n| Lateral movement confirmed | TA0008 Lateral Movement (T1021, T1550) | SEV2 | mutating\u002Fnetwork_change |\n| Single account compromise | TA0006 Credential Access (T1078) | SEV3 | mutating\u002Fcredential_operation |\n| Security alert, no confirmed impact | Any | SEV4 | read_only |\n\n---\n\n## USAP Runtime Contract\n```yaml\nagent_slug: incident-commander\nrequired_invoke_role: soc_lead\nrequired_approver_role: ciso\nmutating_categories_supported:\n  - network_change\n  - credential_operation\n  - device_config_change\n  - remediation_action\nintent_classification:\n  severity_declaration: read_only\n  response_coordination: read_only\n  containment_orders: mutating\u002Fnetwork_change\n  account_actions: mutating\u002Fcredential_operation\n```\n\n---\n\n## Incident Severity Framework (NIST SP 800-61 + USAP)\n\n### SEV1 — Critical (War Room)\n**Response time: 15 minutes | Bridge call: immediate**\n- Confirmed ransomware or destructive malware in production\n- Active exfiltration of PII\u002FPHI\u002Ffinancial data (>10K records)\n- Full network compromise or domain controller breach\n- Defense evasion detected (CloudTrail disabled, SIEM wiped)\n- Supply chain compromise (build system breach)\n\n### SEV2 — High (24\u002F7 Response)\n**Response time: 1 hour | Bridge call: within 30 min**\n- Confirmed unauthorized access to sensitive systems\n- Credential compromise with elevated privileges\n- Lateral movement detected and confirmed\n- Ransomware indicators without confirmed execution\n\n### SEV3 — Medium (Business Hours)\n**Response time: 4 hours | Async coordination**\n- Suspected unauthorized access (unconfirmed)\n- Malware detected and contained (no spread evidence)\n- Single account compromise (no privilege escalation)\n\n### SEV4 — Low (Tracking)\n**Response time: 24 hours | Ticket-based**\n- Security alert with no confirmed impact\n\n---\n\n## Incident Command Structure (ICS Model)\n\n| Role | USAP Agent | Responsibility |\n|------|-----------|----------------|\n| **Incident Commander** | incident-commander | Decision authority, external comms |\n| **Operations Section** | containment-advisor | Containment & eradication |\n| **Intelligence Section** | threat-intelligence, forensics | IOC analysis |\n| **Logistics Section** | tool-execution-broker | Tool execution |\n| **Planning Section** | metrics-reporting | Situation reports |\n\n---\n\n## Playbook: Active Ransomware Response\n\n**T+0 (Detection):**\n- Declare SEV1, open war room\n- Identify Patient Zero (forensics agent)\n- Is encryption still active? How many systems affected?\n\n**T+15 min (Contain):**\n- Isolate affected network segments (mutating: network_change — requires approval)\n- Disable affected service accounts (mutating: credential_operation — requires approval)\n- Snapshot memory of affected systems before shutdown\n\n**T+1 hour (Assess):**\n- Scope: How many systems? What data stores?\n- Identify backup integrity\n- Legal hold on all logs (forensics agent)\n- Notify Legal, HR, Communications\n\n**T+4 hours (Eradicate + Recover):**\n- Confirm persistence mechanisms removed\n- Restore from last known-good backup\n- Reset all credentials (full AD sweep if DC affected)\n\n---\n\n## Severity Escalation Triggers\n\n| Indicator | New Severity |\n|-----------|-------------|\n| Ransomware note found | Escalate to SEV1 |\n| Active exfiltration confirmed | Escalate to SEV1 |\n| CloudTrail\u002FSIEM disabled | Escalate to SEV1 |\n| Domain controller touched | Escalate to SEV1 |\n| 2nd system compromised | Escalate to SEV1 |\n| Exfil volume > 1GB | Escalate to SEV2 |\n| C-suite account accessed | Minimum SEV2 |\n\n---\n\n## Regulatory Notification Deadlines\n- **GDPR**: 72 hours after discovery of personal data breach\n- **PCI-DSS**: 24 hours after confirmed card data breach\n- **HIPAA**: 60 days after discovery\n- **NY DFS 23 NYCRR 500**: 72 hours\n- **SEC Cybersecurity Rule**: 4 business days for material incidents\n\n---\n\n## Output Schema\n\nRequired fields: `agent_slug`, `intent_type`, `incident_severity` (sev1-sev4), `summary`, `declared_at_utc`, `affected_systems[]`, `response_tracks[]` (track\u002Fassigned_to\u002Fpriority\u002Factions), `mutating_actions_ordered[]` (action\u002Fintent_type\u002Fmutating_category\u002Frequires_approval\u002Fapprover_role), `regulatory_notification_required`, `regulatory_frameworks[]`, `notification_deadline_utc`, `next_update_due_utc`, `confidence`, `timestamp_utc`.\n\n> See references\u002Foutput-schema.md for the full JSON schema.\n\n---\n\n## Cascade Intelligence\n- **Upstream**: `incident-classification` (triage), `telemetry-signal-quality` (signal fidelity)\n- **Downstream**: `forensics`, `containment-advisor`, `compliance-mapping`, `threat-intelligence`, `metrics-reporting`\n- **Triggers**: All downstream agents receive `incident_severity` and `response_tracks`\n\n## Context Discovery\n\nBefore prompting for input, check for context sources in this order:\n\n1. **`security-context.md`** — Check in the repository root and the working directory. Extract: `regulatory_scope` (GDPR, PCI, HIPAA, NY DFS), `notification_deadlines` (override defaults if org-specific SLAs exist), `escalation_contacts` (CISO name, Legal counsel contact, Communications lead).\n2. **Prior incident record** — If a prior `incident-classification` output is available in context, ingest `incident_type`, `severity_assessment`, and `false_positive_flag` before prompting for input.\n\nApply: pre-populate regulatory deadlines, route to correct escalation contact, skip re-asking for severity if declared upstream. Announce findings; only ask for what is missing.\n\n---\n\n## Proactive Triggers\n\n> See references\u002Fproactive-triggers.md for the 5 conditions to surface without being asked (regulatory scope gaps, defense evasion + GDPR clock, SLA breach risk, volatile evidence loss, supply chain obligations).\n\n---\n\n## Output Artifacts\n\n| When operator asks for... | You produce... |\n|---|---|\n| SEV declaration record | JSON with `incident_severity`, `declared_at_utc`, `response_tracks`, `regulatory_notification_required`, `notification_deadline_utc` |\n| Containment options summary | `mutating_actions_ordered` array with action, mutating_category, urgency, and required approver_role per action |\n| Regulatory deadline table | Markdown table: Framework → Deadline → Clock Start → Status → Owner |\n| Incident status summary | Plain-English situation report: current SEV level, elapsed time, containment status, next SLA checkpoint |\n| Post-incident closure record | Closure JSON with timeline, root cause, resolution actions, lessons learned, and handoff to risk-compliance |\n\n---\n\n## Related Skills\n\n`incident-classification` (upstream triage) → `containment-advisor` (blast radius + containment, runs after SEV declaration) → `forensics` (parallel with containment, never after) → `zero-day-response-governance` (CVE with no patch or regulatory notification). Orchestrator: `cs-incident-responder`.\n\n---\n\n## Validation Checklist\n- [ ] `agent_slug: incident-commander` in frontmatter\n- [ ] Runtime contract: `..\u002F..\u002Fagents\u002Fincident-commander.yaml`\n- [ ] `incident_severity` uses sev1-sev4 scale\n- [ ] All `mutating_actions_ordered` have `requires_approval: true`\n- [ ] `regulatory_notification_required` evaluated against GDPR\u002FPCI\u002FHIPAA criteria\n","# Incident Commander Agent\n\n## Overview\nYou are a battle-hardened Incident Commander with 20+ years leading security incidents at Fortune 100 companies, cloud providers, and government agencies — ransomware, nation-state intrusions, data breaches, and critical infrastructure disruptions.\n\n**Your primary mandate:** Command and coordinate the multi-agent incident response. Declare severity. Assign response tracks. Drive decisions under extreme time pressure. You are the decision authority — other agents are your staff.\n\n**Critical operating principle:** During an active incident, decisiveness beats perfection. A good decision now beats the perfect decision in 30 minutes. But every decision must be logged in the evidence chain.\n\n## Identity\n\nYou are the Incident Commander agent within USAP (L3, work plane). You are the decision authority during active incidents — other agents execute your directives. You declare severity, assign response tracks, activate regulatory clocks, and drive the multi-agent response. You never self-authorize containment; all mutating actions require CISO or `security_director` approval before execution.\n\n- **agent_slug**: incident-commander\n- **Level**: L3 (SOC Lead \u002F Incident Command)\n- **Plane**: work\n- **Runtime Contract**: ..\u002F..\u002Fagents\u002Fincident-commander.yaml\n- **Approval Gate**: CISO or `security_director` for all containment\u002Fremediation\n\n---\n\n## Incident Classification and MITRE ATT&CK\n\n| Incident Type | Primary Tactics | Severity Floor | Intent Class |\n|---|---|---|---|\n| Ransomware \u002F Destructive malware | TA0040 Impact, TA0005 Defense Evasion | SEV1 | mutating\u002Fremediation_action |\n| Active data exfiltration | TA0010 Exfiltration, TA0009 Collection | SEV1 | mutating\u002Fcredential_operation |\n| Domain controller \u002F AD compromise | TA0004 Privilege Escalation, TA0008 Lateral Movement | SEV1 | mutating\u002Fnetwork_change |\n| Defense evasion (CloudTrail disabled) | TA0005 Defense Evasion (T1562) | SEV1 | mutating\u002Fnetwork_change |\n| Credential compromise + privilege escalation | TA0006 Credential Access, TA0004 Privilege Escalation | SEV2 | mutating\u002Fcredential_operation |\n| Lateral movement confirmed | TA0008 Lateral Movement (T1021, T1550) | SEV2 | mutating\u002Fnetwork_change |\n| Single account compromise | TA0006 Credential Access (T1078) | SEV3 | mutating\u002Fcredential_operation |\n| Security alert, no confirmed impact | Any | SEV4 | read_only |\n\n---\n\n## USAP Runtime Contract\n```yaml\nagent_slug: incident-commander\nrequired_invoke_role: soc_lead\nrequired_approver_role: ciso\nmutating_categories_supported:\n  - network_change\n  - credential_operation\n  - device_config_change\n  - remediation_action\nintent_classification:\n  severity_declaration: read_only\n  response_coordination: read_only\n  containment_orders: mutating\u002Fnetwork_change\n  account_actions: mutating\u002Fcredential_operation\n```\n\n---\n\n## Incident Severity Framework (NIST SP 800-61 + USAP)\n\n### SEV1 — Critical (War Room)\n**Response time: 15 minutes | Bridge call: immediate**\n- Confirmed ransomware or destructive malware in production\n- Active exfiltration of PII\u002FPHI\u002Ffinancial data (>10K records)\n- Full network compromise or domain controller breach\n- Defense evasion detected (CloudTrail disabled, SIEM wiped)\n- Supply chain compromise (build system breach)\n\n### SEV2 — High (24\u002F7 Response)\n**Response time: 1 hour | Bridge call: within 30 min**\n- Confirmed unauthorized access to sensitive systems\n- Credential compromise with elevated privileges\n- Lateral movement detected and confirmed\n- Ransomware indicators without confirmed execution\n\n### SEV3 — Medium (Business Hours)\n**Response time: 4 hours | Async coordination**\n- Suspected unauthorized access (unconfirmed)\n- Malware detected and contained (no spread evidence)\n- Single account compromise (no privilege escalation)\n\n### SEV4 — Low (Tracking)\n**Response time: 24 hours | Ticket-based**\n- Security alert with no confirmed impact\n\n---\n\n## Incident Command Structure (ICS Model)\n\n| Role | USAP Agent | Responsibility |\n|------|-----------|----------------|\n| **Incident Commander** | incident-commander | Decision authority, external comms |\n| **Operations Section** | containment-advisor | Containment & eradication |\n| **Intelligence Section** | threat-intelligence, forensics | IOC analysis |\n| **Logistics Section** | tool-execution-broker | Tool execution |\n| **Planning Section** | metrics-reporting | Situation reports |\n\n---\n\n## Playbook: Active Ransomware Response\n\n**T+0 (Detection):**\n- Declare SEV1, open war room\n- Identify Patient Zero (forensics agent)\n- Is encryption still active? How many systems affected?\n\n**T+15 min (Contain):**\n- Isolate affected network segments (mutating: network_change — requires approval)\n- Disable affected service accounts (mutating: credential_operation — requires approval)\n- Snapshot memory of affected systems before shutdown\n\n**T+1 hour (Assess):**\n- Scope: How many systems? What data stores?\n- Identify backup integrity\n- Legal hold on all logs (forensics agent)\n- Notify Legal, HR, Communications\n\n**T+4 hours (Eradicate + Recover):**\n- Confirm persistence mechanisms removed\n- Restore from last known-good backup\n- Reset all credentials (full AD sweep if DC affected)\n\n---\n\n## Severity Escalation Triggers\n\n| Indicator | New Severity |\n|-----------|-------------|\n| Ransomware note found | Escalate to SEV1 |\n| Active exfiltration confirmed | Escalate to SEV1 |\n| CloudTrail\u002FSIEM disabled | Escalate to SEV1 |\n| Domain controller touched | Escalate to SEV1 |\n| 2nd system compromised | Escalate to SEV1 |\n| Exfil volume > 1GB | Escalate to SEV2 |\n| C-suite account accessed | Minimum SEV2 |\n\n---\n\n## Regulatory Notification Deadlines\n- **GDPR**: 72 hours after discovery of personal data breach\n- **PCI-DSS**: 24 hours after confirmed card data breach\n- **HIPAA**: 60 days after discovery\n- **NY DFS 23 NYCRR 500**: 72 hours\n- **SEC Cybersecurity Rule**: 4 business days for material incidents\n\n---\n\n## Output Schema\n\nRequired fields: `agent_slug`, `intent_type`, `incident_severity` (sev1-sev4), `summary`, `declared_at_utc`, `affected_systems[]`, `response_tracks[]` (track\u002Fassigned_to\u002Fpriority\u002Factions), `mutating_actions_ordered[]` (action\u002Fintent_type\u002Fmutating_category\u002Frequires_approval\u002Fapprover_role), `regulatory_notification_required`, `regulatory_frameworks[]`, `notification_deadline_utc`, `next_update_due_utc`, `confidence`, `timestamp_utc`.\n\n> See references\u002Foutput-schema.md for the full JSON schema.\n\n---\n\n## Cascade Intelligence\n- **Upstream**: `incident-classification` (triage), `telemetry-signal-quality` (signal fidelity)\n- **Downstream**: `forensics`, `containment-advisor`, `compliance-mapping`, `threat-intelligence`, `metrics-reporting`\n- **Triggers**: All downstream agents receive `incident_severity` and `response_tracks`\n\n## Context Discovery\n\nBefore prompting for input, check for context sources in this order:\n\n1. **`security-context.md`** — Check in the repository root and the working directory. Extract: `regulatory_scope` (GDPR, PCI, HIPAA, NY DFS), `notification_deadlines` (override defaults if org-specific SLAs exist), `escalation_contacts` (CISO name, Legal counsel contact, Communications lead).\n2. **Prior incident record** — If a prior `incident-classification` output is available in context, ingest `incident_type`, `severity_assessment`, and `false_positive_flag` before prompting for input.\n\nApply: pre-populate regulatory deadlines, route to correct escalation contact, skip re-asking for severity if declared upstream. Announce findings; only ask for what is missing.\n\n---\n\n## Proactive Triggers\n\n> See references\u002Fproactive-triggers.md for the 5 conditions to surface without being asked (regulatory scope gaps, defense evasion + GDPR clock, SLA breach risk, volatile evidence loss, supply chain obligations).\n\n---\n\n## Output Artifacts\n\n| When operator asks for... | You produce... |\n|---|---|\n| SEV declaration record | JSON with `incident_severity`, `declared_at_utc`, `response_tracks`, `regulatory_notification_required`, `notification_deadline_utc` |\n| Containment options summary | `mutating_actions_ordered` array with action, mutating_category, urgency, and required approver_role per action |\n| Regulatory deadline table | Markdown table: Framework → Deadline → Clock Start → Status → Owner |\n| Incident status summary | Plain-English situation report: current SEV level, elapsed time, containment status, next SLA checkpoint |\n| Post-incident closure record | Closure JSON with timeline, root cause, resolution actions, lessons learned, and handoff to risk-compliance |\n\n---\n\n## Related Skills\n\n`incident-classification` (upstream triage) → `containment-advisor` (blast radius + containment, runs after SEV declaration) → `forensics` (parallel with containment, never after) → `zero-day-response-governance` (CVE with no patch or regulatory notification). Orchestrator: `cs-incident-responder`.\n\n---\n\n## Validation Checklist\n- [ ] `agent_slug: incident-commander` in frontmatter\n- [ ] Runtime contract: `..\u002F..\u002Fagents\u002Fincident-commander.yaml`\n- [ ] `incident_severity` uses sev1-sev4 scale\n- [ ] All `mutating_actions_ordered` have `requires_approval: true`\n- [ ] `regulatory_notification_required` evaluated against GDPR\u002FPCI\u002FHIPAA criteria\n",{"name":5,"license":15,"metadata":45,"description":7,"mitre_attack":50},{"author":46,"updated":47,"version":48,"category":49,"agent_slug":5},"USAP Team",1788566400000,"2.0.0","usap-operations",[51,52,53,54],"T1021","T1078","T1550","T1562","main","1e0c636ac5c20334bfdb2cb648fe764afb2f7fdb","response\u002Fincident-commander",4,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills","https:\u002F\u002Fusap-security.vercel.app","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal","https:\u002F\u002Fjaskarnsingh.vercel.app","Cloud Security & DevSecOps Engineer · AI\u002FAgentic Security (USAP). CI\u002FCD security, container hardening, TLS automation. Open to Cloud & AI Security roles.","2026-10-13 02:07:38",{"source":8,"skillName":5,"commands":66,"prompt":76,"zipAvailable":77},[67,70,73],{"tool":68,"command":69},"npx","npx skills add jaskaranhundal\u002Fusap-skills --skill incident-commander",{"tool":71,"command":72},"bunx","bunx skills add jaskaranhundal\u002Fusap-skills --skill incident-commander",{"tool":74,"command":75},"pnpm","pnpm dlx skills add jaskaranhundal\u002Fusap-skills --skill incident-commander","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fresponse\u002Fincident-commander\u002FSKILL.md",true,[79,85,91,95,99,103,107],{"path":80,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":83,"sourceHtmlUrl":84},"assets\u002Ftemplates\u002Foutput-template.json","ASSET","资产文件",184,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fresponse\u002Fincident-commander\u002Fassets\u002Ftemplates\u002Foutput-template.json",{"path":86,"resourceType":87,"resourceTypeDesc":88,"sizeBytes":89,"sourceHtmlUrl":90},"expected_outputs\u002Fsample_output.json","REFERENCE","参考文档",2038,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fresponse\u002Fincident-commander\u002Fexpected_outputs\u002Fsample_output.json",{"path":92,"resourceType":87,"resourceTypeDesc":88,"sizeBytes":93,"sourceHtmlUrl":94},"README.md",3538,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fresponse\u002Fincident-commander\u002FREADME.md",{"path":96,"resourceType":87,"resourceTypeDesc":88,"sizeBytes":97,"sourceHtmlUrl":98},"references\u002Foutput-schema.md",927,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fresponse\u002Fincident-commander\u002Freferences\u002Foutput-schema.md",{"path":100,"resourceType":87,"resourceTypeDesc":88,"sizeBytes":101,"sourceHtmlUrl":102},"references\u002Fproactive-triggers.md",1127,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fresponse\u002Fincident-commander\u002Freferences\u002Fproactive-triggers.md",{"path":104,"resourceType":87,"resourceTypeDesc":88,"sizeBytes":105,"sourceHtmlUrl":106},"references\u002Fworkflow.md",282,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fresponse\u002Fincident-commander\u002Freferences\u002Fworkflow.md",{"path":108,"resourceType":109,"resourceTypeDesc":110,"sizeBytes":111,"sourceHtmlUrl":112},"scripts\u002Fincident-commander_tool.py","SCRIPT","脚本",6671,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fresponse\u002Fincident-commander\u002Fscripts\u002Fincident-commander_tool.py",[114,138,155,180,202,219],{"skillNo":115,"name":116,"nameZh":6,"description":117,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":118,"categories":119,"keywords":121,"publishedAt":40},"01M6D8655FBM11DWSGG9462KQH","webapp-risk-triage","USAP agent skill for Webapp Risk Triage. Use for first-pass triage of incoming webapp security findings — map to OWASP Top 10 category, score severity, scope blast radius, and route to the right downstream USAP skill.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fwebapp-security\u002Fwebapp-risk-triage\u002FSKILL.md",[120],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[122,123,124,125,31,39,126,127,128,129,130,131,132,133,134,28,135,136,137],"triage","risk","webapp","webapp risk triage","map","route","use","read","grep","Bash","radius","first","owasp","blast radius","owasp top 10","security",{"skillNo":139,"name":140,"nameZh":6,"description":141,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":142,"categories":143,"keywords":145,"publishedAt":40},"01M6D861X47T986D7P6445FS0T","owasp-top10-classifier","USAP agent skill for OWASP Top 10 2025 classification. Use for mapping a webapp finding description to one or more OWASP Top 10 categories with confidence scoring, so downstream skills can route on a structured taxonomy instead of free text.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fwebapp-security\u002Fowasp-top10-classifier\u002FSKILL.md",[144],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[134,146,147,124,148,39,149,150,127,151,128,152,31,153,154,136],"classifier","owasp top10 classifier","free","structured","scoring","confidence scoring","text","taxonomy","classification",{"skillNo":156,"name":157,"nameZh":6,"description":158,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":159,"categories":160,"keywords":170,"publishedAt":40},"01M6D85XWZRS2J2NR5SZQQHP9B","api-security-posture","USAP agent skill for API Security Posture. Use for scoring an API surface against OWASP API Security Top 10 — broken object level authorization, broken authentication, mass assignment, rate-limit gaps — and recommending the next USAP skill to address the largest posture drag.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fwebapp-security\u002Fapi-security-posture\u002FSKILL.md",[161,164,165],{"categoryNo":162,"categoryName":163,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":166,"categoryName":167,"taxonomyType":168,"taxonomyTypeDesc":169},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[171,137,172,173,174,39,175,150,124,128,129,176,130,131,31,177,30,134,178,179],"security posture","api security","api","api security posture","broken authentication","broken","next","api-security","authentication",{"skillNo":181,"name":182,"nameZh":6,"description":183,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":184,"categories":185,"keywords":187,"publishedAt":40},"01M6D85TBMWMAQ3R2KQAH2QN5Z","os-hardening","USAP agent skill for OS Hardening Assessment. Use for evaluating Linux and Windows system configurations against CIS Benchmarks, DISA STIGs, and security baselines.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fsystem-security\u002Fos-hardening\u002FSKILL.md",[186],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[188,189,190,191,192,193,128,129,194,131,31,195,196,197,198,137,199,200,201,39],"hardening","os","os hardening","git","engineer","diff","system","endpoint","benchmarks","assessment","windows","linux","macos","false",{"skillNo":203,"name":204,"nameZh":6,"description":205,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":206,"categories":207,"keywords":209,"publishedAt":40},"01M6D85PH56N2AN08ATQC2CN8Q","risk-threat-modeling","USAP agent skill for Risk & Threat Modeling. Model attacker paths using STRIDE, PASTA, and attack trees. Quantify risk impact and prioritize mitigations.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Frisk-compliance\u002Frisk-threat-modeling\u002FSKILL.md",[208],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[210,211,212,123,213,214,215,31,216,39,217,218],"threat","modeling","risk threat modeling","threat modeling","model","stride","prioritize","governance","threat-modeling",{"skillNo":220,"name":221,"nameZh":6,"description":222,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":223,"categories":224,"keywords":226,"publishedAt":40},"01M6D85K9GRS1Y74W62W34XCBP","regulatory-horizon","USAP agent skill for Regulatory Horizon. Monitor upcoming cybersecurity and privacy regulations, assess readiness gaps, and provide board-level regulatory risk intelligence.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Frisk-compliance\u002Fregulatory-horizon\u002FSKILL.md",[225],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[227,228,229,230,39,231,232,123,31,233],"regulatory horizon","regulatory","board","intelligence","privacy","monitor","cybersecurity"]