Claude Skills by rfxn

Renders the final incident-commander brief: executive summary, technical narrative, kill-chain stanzas (intrusion → persistence → execution → lateral → exfil), remediation ledger, and open-risk assessment. Use when the case is closing and the operator needs a structured human-readable handoff document.

Executes case lifecycle state transitions (open / hold / reopen / close), maintains the INDEX row, and emits agentic-minutes status blocks with next-step + blocking-question. Use when the case needs lifecycle adjudication, status reporting, or close-criteria evaluation.

Extracts, deduplicates, and clusters IPs (with /24 grouping and CDN-safelist awareness), domains (punycode-decoded, subdomain-flattened), file hashes (MD5/SHA256), URL patterns, and webshell fingerprint families from raw evidence. Use when the case needs IOC normalization or aggregation for downstream rule scoping or attribution.

Adjudicates ModSec deny-events, APF blocks, YARA/LMD signature hits, or anomaly flags as genuine threat or benign-pattern match. Records suppression rationale. Use when the case has a candidate alert that needs FP/TP classification before downstream rule authoring or escalation.

Authors ModSec rules, APF/CSF/iptables/nftables firewall blocks, and LMD/ClamAV signature submissions for confirmed attack patterns. Validates with apachectl preflight, FP-corpus checks, and CDN-safelist awareness. Use when the case requires generating a defensive rule, signature, or block to prevent recurrence.

Correlates forensic evidence across log streams (apache.access, apache.error, modsec.audit, journald, fs mtime clusters, cron events) to build attribution-grounded hypotheses with cross-stream citations. Use when the case needs evidence consolidation across multiple sources, hypothesis grounding, or kill-chain reconstruction.

Loaded when the curator session opens with `bl consult --sweep-mode --cve <id>` (DESIGN.md §5.2 retrospective posture) or `bl consult --new --trigger <advisory-pub-event>`. The bundle is the operator playbook for the inverted incident-response shape — read advisory, emit detection, gate-check, deploy ahead of any local fire. ---

**Always load at session start.** This file is the curator's enforcement reference for every verb, tier, gate, and schema constraint that the `bl` wrapper exposes. Read this before proposing any step or tier classification to the operator. Reference source: `src/bl.d/` part files. Schema source: `schemas/step.json`, `schemas/ledger-event.json`. Gate behavior source: `DESIGN.md §6`. Read order: load `/skills/foundations.md` (ir-playbook lifecycle rules) alongside this file. They are complement...

**Scenario.** A cPanel EA4 host. The curator has proposed `defend.modsec` to lock in a SecRule blocking the APSB25-94 initial-access endpoint pattern. The wrapper detects `_bl_cpanel_present()` returns true (both `/usr/local/cpanel/` exists and `/usr/local/cpanel/scripts/restartsrv_httpd` is executable). The cPanel apply path fires instead of the vanilla `apachectl configtest` path. The substrate router's non-obvious rule: the global path and the per-user vhost path are mutually exclusive dec...

Loaded by the router when `substrate-report` names an `os.id` matching `centos6 | rhel6 | ubuntu1204 | ubuntu1404`, or when the curator authors shell for any `clean.*` or `defend.*` step. The pitch reads "compatible from CentOS 6 (2011) through modern distros." This bundle keeps the emit honoring that floor.

**Scenario.** It is 02:47. A cPanel shared-hosting server runs LMD 1.6.4 with `post_scan_hook` configured. LMD completes a scan, writes a 12-row TSV to `/var/lib/maldetect/sessions/<scanid>`, and fires the hook. The `/etc/blacklight/hooks/bl-lmd-hook` adapter runs `bl trigger lmd` with `--scanid`, `--session-file`, and `--unattended`. Within 8 seconds a new `bl-case` case is open with the cluster fingerprint in the ledger. The curator is awake with LMD's evidence pre-loaded. The non-obvious r...

Loaded by the router whenever a `defend.*` step is pending or `bl observe substrate` has emitted a substrate report. Companion to `defense-synthesis/`: the synthesis skills know rule grammar; this bundle knows whether the rule grammar applies to *this host*. The curator reads SKILL.md, picks the matching per-category file, then falls through to the synthesis skill that authors the directive.

Loaded when the substrate-report names `shared_hosting_layer != none`. The pitch's named adopter class is hosting providers and MSPs; their fleets are mostly cPanel, Plesk, and DirectAdmin. Compromise *shapes* on those three layers diverge enough that loading the wrong layer file produces correct-shaped reasoning against the wrong layout — a curator emits `bl observe htaccess /home/<user>/public_html/` against a Plesk host where that path does not exist, and the case stalls. This bundle is th...