القائمة
Use when requesting human operator confirmation before disruptive remediation actions.
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/dandye/adk_runbooks --skill confirm-actionيبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
Use when evaluating threat detection opportunities (TDOs), generating synthetic UDM events, evaluating Chronicle rule coverage, and drafting YARA-L 2.0 rules.
Use when hunting for advanced persistent threat (APT) actor activity, tools, and infrastructure.
Use when hunting for lateral movement via PsExec, WMI, remote scheduled tasks, or WinRM.
عرض SKILL.md
| name | confirm-action |
| description | Use when requesting human operator confirmation before disruptive remediation actions. |
| category | common |
| version | 1.0.0 |
| type | Skill |
| title | Skill: Common Step: Confirm Action with User |
| generated | {"by":"human:dandye","at":"2025-05-19T20:11:00.000Z"} |
Ask the user a follow-up question to confirm whether a specific action should be taken before proceeding.
This sub-runbook executes the You may ask follow up question tool with a provided question and optional response options. It returns the user's response to the calling runbook.
${QUESTION_TEXT}: The specific question to ask the user (e.g., "Isolate endpoint ENDPOINT_ID?", "Proceed with containment for IOC_VALUE?").${RESPONSE_OPTIONS}: A list of predefined options for the user to choose from (e.g., ["Yes", "No"], ["Disable Account", "Reset Password", "Monitor Only"]).${USER_RESPONSE}: The response provided by the user to the question.${QUESTION_TEXT} and optionally ${RESPONSE_OPTIONS} from the calling runbook.question=${QUESTION_TEXT} and options=${RESPONSE_OPTIONS} (if provided).${USER_RESPONSE} and return it to the calling runbook.sequenceDiagram
participant CallingRunbook
participant ConfirmAction as confirm_action.md (This Runbook)
participant User
CallingRunbook->>ConfirmAction: Execute Confirmation\nInput: QUESTION_TEXT, RESPONSE_OPTIONS (opt)
%% Step 2: Ask Question
ConfirmAction->>User: Confirm: QUESTION_TEXT (Options: RESPONSE_OPTIONS)
User-->>ConfirmAction: User Response (USER_RESPONSE)
%% Step 3: Return Response
ConfirmAction-->>CallingRunbook: Return Response:\nUSER_RESPONSE
The You may ask follow up question action has been executed. The user's response (${USER_RESPONSE}) is available.