Menu
Handle security incidents, production incident response, and write blameless post-mortem documentation
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Run chaos security engineering tests — AI agent attempts to hack the Sprint output and reports findings to the team
Validate Java and TypeScript code against banking naming conventions, style rules, quality standards, and secure coding practices
Perform OWASP Top 10 security assessments, vulnerability scanning, and PCI-DSS compliance checks
Design test strategies including security testing, write test plans, and identify test scenarios for banking features with DevSecOps integration
Perform STRIDE threat modeling during Sprint Planning for new features and APIs
Run UX review checklist for banking user flows, validate WCAG accessibility compliance, assess security UX patterns, and review customer interface design
| name | incident-response |
| description | Handle security incidents, production incident response, and write blameless post-mortem documentation |
Invoke during production or security incidents, post-mortem writing, or incident planning.
# Incident Post-Mortem: [Title]
**Date:** [YYYY-MM-DD] | **Severity:** SEV[1-4]
**Duration:** [X hours Y minutes]
**Security Impact:** [Data breach? PII exposed? Unauthorized access?]
## Timeline (SGT)
| Time | Event |
|------|-------|
| HH:MM | Alert fired |
| HH:MM | Incident declared, war room opened |
| HH:MM | Service isolated / mitigation applied |
| HH:MM | Service restored |
## Root Cause
[Technical explanation]
## Security Regression Test Added
- [Test description ensuring this cannot recur]
## Action Items
| # | Action | Owner | Due | Status |
|---|--------|-------|-----|--------|
| 1 | [Action] | [Name] | [Date] | Open |