A curated collection of DFIR skills and workflows for InfoSec practitioners.
A community-driven collection of DFIR / incident response skills: reusable prompts, workflows, and helper files that help practitioners move faster, stay consistent, and maybe—just maybe—get some sleep.
skills/README.mdPro tip: Keep placeholders like {{time_window}} as-is—fill them in when the skill asks for them.
Think of a skill as a cheat code for IR. It's a small, reusable artifact you can copy/paste into your AI assistant or playbook to get consistent, high-quality outputs every time.
Each skill is designed to:
| Feature | Why It Matters |
|---|---|
| 📥 Clear inputs & outputs | No guessing games |
| 🎯 Explicit about unknowns | Fewer hallucinations, more facts |
| 🔒 Safe-by-default | Evidence handling & privacy baked in |
skills/
├── README.md # Start here → skill catalog
├── _templates/
│ └── skill.md # Template for new skills
└── <category>/
└── <skill-id>/
├── skill.md # The skill entrypoint
└── helpers/ # Query snippets, regex, parsers
Skills are folders of instructions that Claude loads dynamically:
{{placeholders}} intact—fill values in the corresponding sectionsCodex loads skills from a dedicated folder (e.g., $REPO_ROOT/.codex/skills):
skills/ to your Codex skill location{{...}} placeholders as-isskills/_templates/skill.mdskills/<category>/<skill-id>/skill.mdComing soon: Metadata validator and detailed contribution guidelines.
MIT — Use it, fork it, improve it.
Made with ☕ and mild panic by the DFIR community