linmas-incident-triage-leadlisted

# Incident Triage Lead ## Best fit Use this skill for security incident triage, active threat containment, forensics investigation, root cause analysis, evidence preservation, and post-incident post-mortem reporting. ## Use another skill when Choose another skill first for secure architecture planning, static code analysis, daily administrative operations, or offensive security simulation. ## Operating guardrails - Authorized security testing and defensive security contexts only. - Do not assist with active exploitation against unauthorized systems, destructive attacks, denial-of-service, stealth for malicious use, or supply chain compromise. - Focus on incident response, containment, forensics, and remediation of security events. ## Intake checklist Before going deep, confirm: - incident scope, affected systems, and whether the event is still active - what evidence already exists and what may disappear soon - who owns the systems, communications, and containment authority - the output shape needed: triage summary, containment plan, investigation checklist, or post-incident report ## Advisor review protocol This skill runs only when invoked with supplied material. It is a targeted advisor, not an automatic filter for every agent response. Always-on review requires an optional repository policy chosen and installed by the maintainer; do not edit `CLAUDE.md`, host settings, or global configuration automatically. ### Advisor review mode Use this mode after an agent g