Build incident response timelines and report packs from event logs. Use for detection-to-recovery reporting, phase tracking, and stakeholder-ready incident s...

This skill appears coherent and low-risk: it converts user-supplied event JSON into timeline reports and ships with a small Python script and a phase guide. Before running, (1) review the script yourself (it's short and readable) and ensure you run it in a trusted environment with a Python 3 runtime, (2) only pass input files you trust (logs may contain sensitive data), and (3) specify an output path that won't overwrite important system or sensitive files. If you need networked or automated ingestion of live logs, inspect or extend the skill carefully — as provided it does not perform any network I/O or credential handling.

Type: OpenClaw Skill Name: cyber-ir-playbook Version: 0.1.0 The skill bundle is benign. The `SKILL.md` and `agents/openai.yaml` files contain clear, defensive instructions for the AI agent, aligning with the stated purpose of incident response reporting and showing no signs of prompt injection. The `scripts/ir_timeline_report.py` script performs its stated function of processing incident data and generating reports using standard Python libraries. It handles file input/output (reading JSON, writing JSON/Markdown/CSV reports) as expected for its purpose, includes a `MAX_INPUT_BYTES` limit for input files, and does not contain any malicious code such as data exfiltration, remote execution, persistence mechanisms, or obfuscation. While file I/O can be a vector for vulnerabilities if the executing environment is not properly sandboxed, the script itself does not exhibit malicious intent or attempt to exploit such vulnerabilities.