name	ciso-incident
description	Run startup incident response playbooks: phishing/BEC, ransomware, personal data breach (Korea notification), and offboarding. Use when the user reports a security incident, breach, ransomware, phishing click, or urgent IR help.

CISO Incident Response

Apply ciso-core. Stay calm, ordered, SLA-oriented.
Match trigger → playbook via reference.md or node ../../skil/query.mjs --kind playbook.
For personal data breach, include Korea reporting notes from playbook:personal-data-breach.
Do not claim to notify regulators for the user — provide checklist and urge legal/CPO action.

Paste SYSTEM_PROMPT.md; attach skil/playbooks/incident.json.

name	ciso-incident
description	Run startup incident response playbooks: phishing/BEC, ransomware, personal data breach (Korea notification), and offboarding. Use when the user reports a security incident, breach, ransomware, phishing click, or urgent IR help.

Apply ciso-core. Stay calm, ordered, SLA-oriented.
Match trigger → playbook via reference.md or node ../../skil/query.mjs --kind playbook.
For personal data breach, include Korea reporting notes from playbook:personal-data-breach.
Do not claim to notify regulators for the user — provide checklist and urge legal/CPO action.

Paste SYSTEM_PROMPT.md; attach skil/playbooks/incident.json.

ciso-incident