Works with the AI tools you already use
Claude Code
Cursor
Codex CLI
GitHub Copilot
Gemini CLI+20 moreClaude CodeCursorCodex CLIGitHub CopilotGemini CLI
OpenClaw
Manus
Grok+17 agentsRansomware Response Coordinator
Professional-grade orchestration for ransomware triage, containment, recovery planning, and executive reporting.
$20
ransomware-response-coordinator
Example session with this skill installed
We have a confirmed ransomware incident affecting 40 endpoints and three file servers. The ransom note appeared six hours ago. We have offline backups but have not yet validated their integrity. The incident commander is engaged. Produce a containment action tracker, evidence preservation checklist, and an initial executive update.
- Read your context and instructions
- Compiled the ransomware-response-coordinator
The skill produces a confirmed incident summary with status, confidence level, and evidence base, an immediate containment priority list covering isolation, account control, lateral movement reduction, and backup protection, an evidence preservation checklist, a backup and recovery status section with clean restore validation points, and an executive update draft noting confirmed facts, unknowns, business impact, and next decision points. Legal, regulatory, and insurance escalation flags are clearly marked for specialist handling.
Connects securely to your tools. The creator never sees your data.
What you get
About this skill
What it does
The Ransomware Response Coordinator is a specialized incident response (IR) framework designed to guide cybersecurity professionals through the critical stages of a ransomware crisis. It orchestrates the transition from initial detection to forensic preservation, containment, and recovery planning by synthesizing evidence like ransom notes, logs, and asset context.
Why use this skill
Unlike generic AI prompts that provide surface-level advice, this skill enforces strict defensive protocols and enterprise-grade IR methodologies. It ensures that security teams don't miss critical steps like checking backup immutability or preserving forensic evidence before containment. It handles the "fog of war" by separating confirmed facts from assumptions, helping leads provide clear updates to legal, insurance, and executive stakeholders.
Supported Workflows
- Triage: Validating indicators of compromise (IOCs) and mass encryption events.
- Containment: Prioritizing lateral movement reduction and identity isolation.
- Recovery: Developing decision matrices for clean restores vs. system rebuilds.
- Reporting: Generating executive summaries, forensic trackers, and post-incident hardening plans.
The skill is product-agnostic and adapts to your specific stack, whether you use Splunk, CrowdStrike, Veeam, or SentinelOne.
How to install
Works the same in every agent - Claude, Cursor, Codex, Copilot and 20+ more.
- 1
Download the ZIP
Free skills download straight away. Paid skills unlock right after purchase.
- 2
Unzip into your skills folder
Every agent reads skills from one folder on your machine. Drop the unzipped folder in there.
- 3
Ask your agent to use it
Restart the agent if it was already running. It picks the skill up automatically - no config needed.
Skills folder by agent
Click the path to copy it. Create the folder if it does not exist yet.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill passes our trust checks below.
Security scanned
Passed our 8-point scan before listing
Fresh listing
Recently published to Agensi
30-day refund
Not a fit? Get your money back
Trust & safety
Security scanned
Verified clean 4 months ago
- Passed all security checks, Safe to install