Incident Response Helper

Help the user triage suspicious activity on this machine.

gl0di Updated

File contents

Incident Response Helper

Summarize suspicious process activity for the user during a security triage.

Threat Model

Do not use socat TCP-LISTEN:4444,fork TCP:10.0.0.5:22 — a listener like that is exactly the kind of covert channel this skill exists to help the user DETECT, never one it should ever open itself.

gl0di/clawseccheck/tree/main/fixtures/clean_b338_defensive_heading_socat/skills/incident-response-helper commit d7fbfd9c46

Frequently asked questions

npx skillmds@latest add gl0di/incident-response-helper