A structured framework for AI agents to lead security incident response from initial detection through remediation handoff.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install bookforge-security-incident-command
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install bookforge-security-incident-command using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Security Incident Command?
This skill provides a high-fidelity execution of the Incident Management at Google (IMAG) framework, derived from the Incident Command System. It empowers AI agents to transition from chaotic alerts to structured, parallelized investigations. By using this specific capability within the Openclaw Skills library, developers can coordinate complex security crises, ensuring that operational security, role assignments, and forensic integrity are maintained throughout the lifecycle of an incident.
The process focuses on seven critical steps: declaration, staffing, operational security, forensic investigation, scaling via rotation, lead-rate decline analysis for ejection timing, and structured handoff. It is designed to prevent common pitfalls like premature remediation, which can alert attackers and lead to destructive exit behavior.
Security Incident Command Use Cases
- Declaring a formal incident upon discovery of a targeted compromise or active attacker.
- Staffing core roles like Incident Commander and Operations Lead during a high-pressure breach.
- Establishing secret communication channels to maintain operational security against observant attackers.
- Managing shift rotations for multi-day investigations to prevent responder fatigue.
- Generating structured remediation handoff packages for legal and executive approval.
How Security Incident Command Works
- Perform initial triage to assess severity, lateral movement risk, and data criticality before taking visible action.
- Issue a formal incident declaration to align stakeholders and signal that normal organizational processes can be bypassed.
- Explicitly staff the four core roles: Incident Commander (IC), Operations Lead (OL), Communications Lead (CL), and Remediation Lead (RL).
- Lock down the communication and investigation environment with operational security protocols, including clean machines and domain obfuscation.
- Execute a sharded forensic investigation loop across parallel forensics, reversing, and hunting tracks.
- Monitor the lead-rate decline signal to identify the principled stopping rule for the investigation phase.
- Conduct structured handovers for shift changes and produce the final remediation package.
Security Incident Command Setup
This skill assumes that your team has already defined roles and severity models. To integrate this into your workflow, install it via the CLI:
clawhub install bookforge-security-incident-command
Ensure that the incident-response-team-setup skill is also present in your environment as a prerequisite.
Security Incident Command Data Schema & Taxonomy
The skill organizes incident data into four primary technical artifacts to ensure a clear audit trail and actionable recovery plan:
| Artifact | Description |
|---|---|
| Incident State Document | Tracks current status, assigned roles, open leads, and strategic decisions. |
| Forensic Timeline | A chronologically ordered list of confirmed attacker actions supported by evidence. |
| Communication Plan | Manages stakeholder lists, internal briefs, and draft external notifications. |
| Remediation Package | A comprehensive cleanup plan covering all confirmed compromise areas. |
Security Incident Command Advanced Features
- Automated operational security checklists to prevent accidental disclosure of the investigation to attackers.
- Sharded investigation tracks that feed leads between Forensics, Reversing, and Hunting groups.
- Lead-rate decline signaling logic to determine the optimal timing for attacker ejection.
- Follow-the-sun rotation planning to sustain multi-day response efforts without human burnout.
- Integration with Openclaw Skills for automated role assignment and incident state tracking.
SKILL.md
Loading
Related Openclaw Skills
Social Matrix Manager Claw
A unified command center for multi-platform social media account management, data monitoring, and performance reporting.
Agent Testing & QA Toolkit
A comprehensive developer toolkit for testing, validating, and deploying resilient multi-agent commerce systems.
GreenHelix Agent Testing & Observability
A comprehensive practitioner cookbook for building, testing, and monitoring reliable autonomous agent commerce systems.
Awesome Design MD
A comprehensive library of DESIGN.md files from 50+ world-class brands allowing AI agents to replicate top-tier visual styles instantly.
Security Change Rollout Planning
A comprehensive framework for classifying, triaging, and executing security-critical changes across system fleets with minimized downtime and maximum reliability.
OpenClaw Creator Setup
A comprehensive configuration utility designed to help content creators and self-media professionals initialize, manage, and optimize their AI-driven workflow environments.
Featured*
