菜单
Clarifies ownership, next action, dependency, and follow-up date for open cybersecurity issues using practical CISO and monkey-management logic. Use when: issues are stuck, everyone thinks security owns everything, or a short action-oriented follow-up note is needed.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Produces a weekly CISO management briefing as a Marp-compatible Markdown presentation. Use when: weekly cybersecurity notes, KPI/KRI data, incidents, vulnerabilities, threat intelligence, regulatory updates, or management decision needs must become an executive-ready cyber risk and security management brief.
Operating protocol for a Crux project. Use when: an agent or IDE needs to understand Crux layout, locate framework-home definitions, locate project `.crux` state, route work to the right agent, run onboarding, manage task continuity, or decide which files are read-only versus writable.
Enforces a disciplined implementation posture before coding or broad refactors: surface assumptions, narrow scope, prefer the simplest complete fix, define verification targets, and avoid speculative cleanup. Use when: a developer agent is about to implement, refactor, review, or change non-trivial code and there is meaningful ambiguity, risk, or temptation to over-engineer.
Analyses a live Kubernetes cluster and produces .crux/docs/kubernetes.md and .crux/summaries/kubernetes.md. Read-only — does not modify any cluster resources. Use when: (1) .crux/docs/kubernetes.md is missing during onboarding, (2) user requests an architecture review, (3) cluster configuration has significantly changed.
Audits all cluster namespaces against tenant naming conventions defined in decisions/tenant-naming-conventions.md. Checks label compliance, missing resource quotas, and naming pattern violations. Use when: naming convention question, pre-release namespace review, SOC Type 2 audit, or periodic drift check.
Applies or updates Kubernetes NetworkPolicy resources for a target namespace. Supports standard policy templates (deny-all-ingress, allow-same-namespace, allow-ingress-controller, allow-monitoring) and custom policies from user input. Requires explicit user approval before applying any change. Use when: hardening a namespace, onboarding a new tenant, policy drift repair.
| name | security-ownership-followup |
| description | Clarifies ownership, next action, dependency, and follow-up date for open cybersecurity issues using practical CISO and monkey-management logic. Use when: issues are stuck, everyone thinks security owns everything, or a short action-oriented follow-up note is needed. |
| license | MIT |
| compatibility | opencode |
| metadata | {"owner":"ciso-advisor","type":"read-write","approval":"No"} |
Owner: ciso-advisor
Type: read-write
Approval: No
Stop unresolved cybersecurity work from staying vaguely “with security” by assigning the next action to the correct owner.
Requires already loaded:
.crux/workspace/ciso-advisor/MEMORY.md
Loads during execution (lazy):
.crux/docs/ciso-communication-principles.md
Estimated token cost: ~250 tokens
Unloaded after: task completion
| Input | Source | Required |
|---|---|---|
open-issue | user / prior analysis | Yes |
current-owner | user | No |
1. Identify whose monkey the issue is
2. Define next action, owner, dependency, and follow-up date
3. Keep language short and non-blaming
4. Return a practical ownership note
5. Skill complete — unload
Writes to: no file required by default
Format: markdown
| Condition | Action |
|---|---|
| Ownership is genuinely shared | Split action by workstream, not by vague joint ownership |
| Follow-up date is unknown | State urgency band and require a date |
| Unexpected failure | Stop. Write error to bus. Notify user. |