Incident Response Runbook Writer
セキュリティインシデント発生から最初の24時間のためのコミュニケーション・ランブック。誰が、何を話し、何を控えるべきか。
サイト管理者とコミュニティマネージャーのための危機コミュニケーション・ランブック。チャネル・タイミング・文言を、インシデント発生で即興対応を迫られる前に整える。
3ステップでインストール
登録不要。CLIツールも不要です。お使いのAIを選んで、1行コピーして貼るだけです。
ご自分で入れたい場合は、スキルを購入（$4.99）し、購入完了画面からZIPをダウンロードして、上のディレクトリに展開し、AIのセッションを再起動してください。結果は同じです。すでに購入済みの場合は、AIアシスタントにダウンロードしてもらうこともできます。
パックの内容
SKILL.md（手順書）1点とスターターテンプレート1点が入っています。プレビューはこちらです：
Incident Response Runbook Writer
The idea in one paragraph
The first 24 hours of a security incident decide whether your users trust you for the next 24 months. This skill turns a blank page into a written incident communication runbook: who speaks, through which channels, on what schedule, and exactly which words to use - and which to avoid - before you know the full scope of what happened.
What it is built on
- On 2026-10-29, the Organization for Transformative Works took the Archive of Our Own offline, first describing the outage as maintenance; on 2026-10-30 it clarified the shutdown was a security incident and said its response was still in the early stages with the scope undetermined.
- OTW later told users that usernames, email addresses, IP addresses, and hashed passwords may have been exposed, adding that it did not believe the user database had been stolen but could not rule it out, and advised users to change their passwords.
- The one-day gap between "maintenance" and "security incident" became the story for many readers - a lesson in naming the unknown honestly from the start.
Workflow
- Name the incident owner (input: your team roster -> output: one decision-maker). Assign a single person who approves every public statement. List their backup and the escalation path if the owner is unreachable.
- Map your channels (input: your platform list -> output: a ranked channel list). Rank the places your users actually check: status page, email, in-app banner, social accounts. Decide which channel carries the first notice and which carries updates.
- Draft the first statement (input: known facts only -> output: a fill-in-the-blanks template). Write a statement that says what happened, what you know, what you do not know yet, what users should do now, and when the next update will come. Never guess at scope, cause, or attacker identity.
- Set the update cadence (input: incident severity -> output: a schedule). Commit to a rhythm - every 6 hours, every 12 hours, daily - and keep it even when there is nothing new. Silence reads as concealment.
- Plan the sensitive disclosures (input: worst-case data exposure -> output: a disclosure checklist). For each class of user data, pre-write the rule: under what confirmed condition do you disclose, who approves the wording, and what protective action (password reset, session revocation) you recommend.
- Close the loop (input: incident resolution -> output: a post-incident summary). After recovery, publish what happened, what you changed, and what you still cannot answer. This is the document that rebuilds trust.
テンプレートのプレビュー
Incident Response Runbook Writer - Worksheet
1. Incident owner
- Decision-maker: ______________________ Phone: ______________________
- Backup: ______________________ Phone: ______________________
2. Channel ranking
3. First statement template
We are aware of ______________________ (what happened). What we know: ________________________________________ What we do NOT know yet: ________________________________________ What you should do now: ________________________________________ Next update at: ____ : ____ (timezone: ______)
4. Update cadence
- Severity levels and their rhythms: ________________________________________
スキルパック本体（SKILL.md とテンプレート）は英語で書かれています。
