threatroute66
UserEL — A tribute to Edmond Locard. Multi-agent DFIR orchestrator for SANS SIFT (Find Evil 2026).
Categories
Indexed Skills (2)
el-ai-brief
Fulfil an EL executive-brief request that the `el` CLI emitted via the Claude Code path. Use this whenever a case directory under `/opt/EL/cases/` contains a `reports/_ai_brief_request.json` file, OR when the user invokes `/el-ai-brief` directly (with no arg = process every case that has a pending request; with an arg = process only that case-id). EL auto-writes the request file when it detects it's running inside a Claude Code session (CLAUDECODE=1) or when the operator passed `--defer-ai-brief` outside Claude Code. Either way the brief is generated by Claude — this skill just transports it to disk and re-renders the executive HTML+PDF so the six-section brief lands in the final report.
el-red-review
Fulfil an EL red-review (adversarial challenger) request that the `el` CLI emitted via the Claude Code path. Use this whenever a case directory under `/opt/EL/cases/` contains a `reports/_red_review_request.json` file, OR when the user invokes `/el-red-review` directly (no arg = process every case with a pending request; with an arg = process only that case-id). EL auto-writes the request when it runs the adversarial-review stage with no ANTHROPIC_API_KEY but detects it is inside a Claude Code session (CLAUDECODE=1) or the operator set EL_RED_REVIEW_DEFER=1. The LLM challenger is generated by Claude (you) — this skill transports the verdicts to disk; the merge into the ledger lands on the next `el report`.
Bio shown is the top-scored skill's repo description as a fallback — real GitHub bios land in a future update.