菜单
Installs the rl-spectra-intel CLI from the bundled wheel included with this plugin. Trigger when the user wants to set up rl-spectra-intel, when rl-spectra-intel is not found on PATH, or when rl-soc reports that the CLI is missing.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Configures the rl-spectra-intel CLI with ReversingLabs credentials. Trigger only when the analyst explicitly asks to set up or update credentials, provide an API username and password, or configure a custom host. Never invoke this skill automatically in response to CLI errors — authentication failures in analysis agents must be reported to the analyst, not silently fixed.
SOC adjudication phase. Reads FP validation findings and investigation findings, spawns the rl-adjudicate agent to weigh all evidence and produce a final CONFIRMED TP / CONFIRMED FP / UNCERTAIN verdict with confidence and a full per-signal audit trail. Gates transition to remediation. Writes rl-adjudication-verdict.md. Trigger after investigation is complete, or as part of the rl-soc pipeline.
False positive validation phase. Reads rl-triage-handoff.md and evaluates multiple FP signals to determine whether the detection is likely a false positive. A CONCLUSIVE FP recommendation short-circuits the pipeline, skipping investigation and remediation. Writes rl-fp-validate-findings.md. Trigger when triage is complete and FP validation is needed, or as part of the full rl-soc pipeline.
SOC investigation phase. Reads rl-triage-handoff.md and performs deep enrichment by spawning three parallel sub-agents: IOC enrichment, sample pivots, and YARA hunting with sandbox polling. Writes rl-investigate-findings.md. Trigger when triage and FP validation are complete and a full investigation is needed, or as part of the rl-soc pipeline.
SOC remediation phase. Reads triage, investigation, and adjudication findings and produces a prioritized containment and eradication playbook. Writes rl-remediate-playbook.md. Only runs when adjudication verdict is CONFIRMED TP or UNCERTAIN. Trigger after adjudication, or as part of the rl-soc pipeline.
SOC reporting phase. Reads all prior phase handoff files and synthesizes them into a narrative Markdown incident report and a machine-readable JSON IOC file. Trigger after all analysis phases are complete, or as part of the rl-soc pipeline.
| name | rl-soc-install |
| description | Installs the rl-spectra-intel CLI from the bundled wheel included with this plugin. Trigger when the user wants to set up rl-spectra-intel, when rl-spectra-intel is not found on PATH, or when rl-soc reports that the CLI is missing. |
Installs the rl-spectra-intel CLI into a dedicated Python virtual environment
at ~/.rl-spectra-intel-venv. The wrapper script and credential injection are
handled by rl-soc-connect after installation.
~/.rl-spectra-intel-venv/bin/rl-spectra-intel --version
find ~/.claude/plugins/cache/rl-spectra-ai-soc ~/.claude/plugins/marketplaces/rl-spectra-ai-soc/plugins -name "rl_spectra_intel-*.whl" 2>/dev/null | head -1
~/.rl-spectra-intel-venv/bin/pip install --upgrade <wheel_path>
~/.rl-spectra-intel-venv/bin/rl-spectra-intel --version
python3 --version
Parse the version from the output (e.g. Python 3.10.2). The CLI requires Python 3.10 or later.
python3 is not found: stop and tell the user:
rl-spectra-intelrequires Python 3.10 or later. Found:<version or "not found">. Please upgrade Python before continuing.
These two steps MUST be executed in order using the EXACT commands below.
Do NOT use pip, pip3, pipx, --user, or --break-system-packages.
Do NOT skip Step 3. Do NOT ask the user which approach to use.
Step 3 — create the venv:
python3 -m venv ~/.rl-spectra-intel-venv
If exit code is non-zero: report the error and stop.
Step 4 — locate the bundled wheel and install:
Search for the bundled wheel in the plugin cache:
find ~/.claude/plugins/cache/rl-spectra-ai-soc ~/.claude/plugins/marketplaces/rl-spectra-ai-soc/plugins -name "rl_spectra_intel-*.whl" 2>/dev/null | head -1
~/.rl-spectra-intel-venv/bin/pip install <wheel_path>
If exit code is non-zero: show the full output to the user. The wheel file may be missing or corrupt — the user should reinstall the plugin.
~/.rl-spectra-intel-venv/bin/rl-spectra-intel --version
Tell the user:
rl-spectra-intel~/.rl-spectra-intel-venvrl-soc-connect skill)