Works with the AI tools you already use
Claude Code
Cursor
Codex CLI
GitHub Copilot
Gemini CLI+20 moreClaude CodeCursorCodex CLIGitHub CopilotGemini CLI
OpenClaw
Manus
Grok+17 agentsSecurity Operations Tabletop Exercise Facilitator
Design, facilitate, and document professional security incident response tabletop exercises and after-action reports.
$15
security-operations-tabletop-exercise-facilitator
Example session with this skill installed
Design a three-hour ransomware security operations tabletop exercise for Tier 1 analysts, Tier 2 analysts, the SOC manager, IT operations, legal, communications, and executive stakeholders. Keep tooling generic and produce a facilitator guide, timed inject schedule, evaluation scorecard, and after-action report template.
- Read your context and instructions
- Compiled the security-operations-tabletop-exercise-facilitator
The skill produces an exercise planning brief confirming objectives, participants, and duration, a timed inject schedule with six escalating injects covering detection, triage, containment, executive briefing, communications, and recovery decisions, a facilitator guide with role-based discussion prompts and observer notes for each inject, an evaluation scorecard assessing process quality, decision making, escalation, communication, and documentation, and an after-action report structure separating strengths, gaps, risks, root causes, actions, owners, and validation points. All tooling references are marked as generic placeholders.
Connects securely to your tools. The creator never sees your data.
What you get
About this skill
High-Fidelity Security Tabletop Facilitation
This skill automates the complex process of designing, running, and documenting professional security operations tabletop exercises (TTX). Instead of spending days drafting scenarios and injects, developers and security leads can generate comprehensive exercise packages tailored to their specific stack and playbooks.
What it does
- Architects realistic multi-stage incident scenarios (Ransomware, BEC, Supply Chain, etc.).
- Generates timed "injects" with specific evidence artifacts (log snippets, alerts, tickets).
- Validates existing IR playbooks and cross-functional escalation workflows.
- Produces professional After Action Reports (AAR) with strength/gap analysis and remediation trackers.
Why use this skill
Prompting a generic AI often results in shallow, linear stories. This skill follows a rigorous evaluation framework, forcing participants to make hard decisions at each stage. It integrates context from your SIEM, EDR, and SOAR tools to create realistic technical hurdles while managing the non-technical aspects like legal, PR, and executive briefings. It ensures your IR drills are audit-ready and demonstrate measurable resilience improvement.
Supported Deliverables
- Exercise Plan: Strategy, scope, and objectives.
- Facilitator Guide: Detailed prompts, expected answers, and observer notes.
- Inject Schedule: A timeline of technical and business developments.
- Scorecard & AAR: Structured evaluation of team performance and gap identification.
How to install
Works the same in every agent - Claude, Cursor, Codex, Copilot and 20+ more.
- 1
Download the ZIP
Free skills download straight away. Paid skills unlock right after purchase.
- 2
Unzip into your skills folder
Every agent reads skills from one folder on your machine. Drop the unzipped folder in there.
- 3
Ask your agent to use it
Restart the agent if it was already running. It picks the skill up automatically - no config needed.
Skills folder by agent
Click the path to copy it. Create the folder if it does not exist yet.
Reviews
Trust & safety
Security scanned
Verified clean 4 months ago
- Passed all security checks, Safe to install