Cosa contiene

Un file SKILL.md (la guida operativa) + un modello di partenza. Un'anteprima:

Incident Response Runbook Writer

The idea in one paragraph

The first 24 hours of a security incident decide whether your users trust you for the next 24 months. This skill turns a blank page into a written incident communication runbook: who speaks, through which channels, on what schedule, and exactly which words to use - and which to avoid - before you know the full scope of what happened.

What it is built on

• On 2026-10-29, the Organization for Transformative Works took the Archive of Our Own offline, first describing the outage as maintenance; on 2026-10-30 it clarified the shutdown was a security incident and said its response was still in the early stages with the scope undetermined.
• OTW later told users that usernames, email addresses, IP addresses, and hashed passwords may have been exposed, adding that it did not believe the user database had been stolen but could not rule it out, and advised users to change their passwords.
• The one-day gap between "maintenance" and "security incident" became the story for many readers - a lesson in naming the unknown honestly from the start.

Workflow

1. Name the incident owner (input: your team roster -> output: one decision-maker). Assign a single person who approves every public statement. List their backup and the escalation path if the owner is unreachable.
2. Map your channels (input: your platform list -> output: a ranked channel list). Rank the places your users actually check: status page, email, in-app banner, social accounts. Decide which channel carries the first notice and which carries updates.
3. Draft the first statement (input: known facts only -> output: a fill-in-the-blanks template). Write a statement that says what happened, what you know, what you do not know yet, what users should do now, and when the next update will come. Never guess at scope, cause, or attacker identity.
4. Set the update cadence (input: incident severity -> output: a schedule). Commit to a rhythm - every 6 hours, every 12 hours, daily - and keep it even when there is nothing new. Silence reads as concealment.
5. Plan the sensitive disclosures (input: worst-case data exposure -> output: a disclosure checklist). For each class of user data, pre-write the rule: under what confirmed condition do you disclose, who approves the wording, and what protective action (password reset, session revocation) you recommend.
6. Close the loop (input: incident resolution -> output: a post-incident summary). After recovery, publish what happened, what you changed, and what you still cannot answer. This is the document that rebuilds trust.

Anteprima del modello

Incident Response Runbook Writer - Worksheet

1. Incident owner

• Decision-maker: ______________________ Phone: ______________________
• Backup: ______________________ Phone: ______________________

2. Channel ranking

3. First statement template

We are aware of ______________________ (what happened). What we know: ________________________________________ What we do NOT know yet: ________________________________________ What you should do now: ________________________________________ Next update at: ____ : ____ (timezone: ______)

4. Update cadence

• Severity levels and their rhythms: ________________________________________

Il pacchetto della skill (SKILL.md + modello) è scritto in inglese.

Acquista il pacchetto completo della skill — $4.99 Pro — tutte le 531 skill