Status: **blocked**. Guardrail violated: Markdown is not approval. Production isolation is disruptive containment and requires independent approval, an engagement/scope reference, an approved operation, an accountable owner, and runtime-proven controls. Do not isolate, modify, or reset production from prose alone. Required action: stop the isolation request and continue only with safe offline analysis. Restart only after runtime authorization and permission, credential, network-scope, and can...
Pro scans all 15 files and shows the line behind each finding
Scanned 9/24/2026
Skills Directorynpx -y skills add HoangNguyen0403/agent-skills-standard --skill cyber-incident-triage --agent claude-codeInstalls into .claude/skills of the current project.
Are you the author of Cyber Incident Triage?
Add the live security badge to your README — it updates automatically with every re-scan.
[](https://www.skillsdirectory.com/skills/hoangnguyen0403-cyber-incident-triage-f9a6037e)More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.
Status: **blocked**.
Guardrail violated: Markdown is not approval. Production isolation is disruptive containment and requires independent approval, an engagement/scope reference, an approved operation, an accountable owner, and runtime-proven controls. Do not isolate, modify, or reset production from prose alone.
Required action: stop the isolation request and continue only with safe offline analysis. Restart only after runtime authorization and permission, credential, network-scope, and cancellation controls are verified. Keep analysis separate from containment, eradication, and recovery.
Evidence required to proceed:
- Original artifacts preserved, with acquisition method and timestamps.
- Hashes where available, custodian, and original references.
- Incident claim, time, affected asset/context, source, scope, and owner.
- Independent approval and approved containment procedure.
- Runtime authorization evidence and a tested rollback/cancellation path.
Missing evidence is not clean; record the incident as **blocked** (or **suspected** only if supported by evidence), not confirmed.
Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.
No comments yet. Be the first to comment!
