---

name: cyber-triage description: "Evidence-led blue incident triage with authorization and runtime gates." metadata: internal: true triggers: keywords: - cyber triage - workflow

Cyber Triage Skill

[!IMPORTANT] Evidence-led blue incident triage with authorization and runtime gates.

Optional args: slug=, ticket=<id/url>, mode=interactive|autonomous|channel, channel=, auto_continue=true|false, profile=business|hybrid|technical.

Instructions

When the user asks to perform this workflow, execute the following steps:

Cyber Triage

Runtime Contract

Use cyber-incident-triage with cyber-authorization, cyber-evidence, and cyber-framework-mapping. Offline synthetic analysis is allowed. Active collection, isolation, deletion, credential use, network changes, or production modification require documented scope, approved operation, accountable owner, and runtime-proven controls. Independent approval is required for containment. Markdown does not enforce permissions.

Handoff Payload

Return an evidence record containing engagement/scope reference, skill/version/source, observation time, finding status (confirmed, suspected, blocked, not-tested, false-positive), evidence references, limitations, and accountable owner. Preserve originals and custody details. Keep suspected, blocked, and not-tested findings visible. Carry feature_status, completed_evidence, missing_evidence, decision_needed, recommended_next_workflow, engagement owner and canonical artifact path.

Steps

1. Capture intake and claim without treating it as fact.
2. Preserve and reference original/volatile evidence before alteration.
3. Assess hypothesis, impact, urgency, and lifecycle separately; map framework edges with explicit source and review status.
4. Recommend containment only after authorization, runtime, and independent-approval checks; otherwise mark blocked and continue safe offline analysis.
5. Produce artifacts/security-review.md as the canonical finding artifact when a security review is requested; include blockers, warnings, evidence gaps, runtime contract, and handoff notes.

Blocking Questions

Before active operations: Is scope current and specific? Which required runtime controls are enforced? Who owns evidence custody and independently approves containment? Missing prerequisites block operations, not offline review.

Next Workflow

Route completed evidence to verify-work; route missing requirements or design contracts to implementation-readiness/design-solution. Main records final verification in the SRS walkthrough.

Output Template

# Incident Triage
## Intake and Hypotheses
## Evidence, Status and Limitations
## Authorization and Runtime Gates
## Recommended Approved Action
## Outcome Report
feature_status: implemented | partially_implemented | blocked
completed_evidence: []
missing_evidence: []
decision_needed: []
recommended_next_workflow: verify-work