threat-vector-security/skills/security-alert-hygiene
skills/security-alert-hygiene/SKILL.md
# Security Alert Hygiene Use this when the main job is to manage alert state cleanly: acknowledge, resolve, suppress, or reduce duplicate noise. ## Workflow 1. Search first with `security_alert_search`. 2. Narrow by source, type, and evidence pattern before mutating state. 3. Choose the correct disposition: - `security_alert_ack` for understood alerts that should remain visible - `security_alert_resolve` for investigated alerts that are closed - `security_alert_suppress` for expected
$ install --global
skillsauthnpx skillsauth add threat-vector-security/guardian-agent skills/security-alert-hygieneInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 16, 2026, 2:22 PM4.5s2 files scanned
SKILL.md
Security Alert Hygiene
Use this when the main job is to manage alert state cleanly: acknowledge, resolve, suppress, or reduce duplicate noise.
Workflow
- Search first with
security_alert_search. - Narrow by source, type, and evidence pattern before mutating state.
- Choose the correct disposition:
security_alert_ackfor understood alerts that should remain visiblesecurity_alert_resolvefor investigated alerts that are closedsecurity_alert_suppressfor expected repetitive noise with an expiry
- Always record the operator reason when resolving or suppressing.
Decision Rules
- Use acknowledge when the alert is real and still relevant.
- Use resolve when the condition has been investigated and closed.
- Use suppress when the alert is expected to recur and would otherwise overwhelm the queue.
- Prefer suppressing one narrow pattern over broad source-wide suppression.
Boundaries
- Use
host-firewall-defenseornative-av-managementif the first problem is understanding whether the alert is meaningful. - Use
security-triageif multiple alert families suggest a broader incident.
Gotchas
- Do not suppress without an expiry unless there is a compelling operational reason.
- Do not resolve an alert just because it is noisy.
- Do not mutate alert state from a vague natural-language description when the exact alert id or narrow pattern can be found first.
Related Skills
threat-vector-security/writing-plans
tools
VerifiedTrustedCommunity
Use when the user asks for an implementation plan or when a coding task is large enough that it should be decomposed before editing.
8SKILL.mdUpdated Apr 16, 2026
threat-vector-security/webapp-testing
tools
VerifiedTrustedCommunity
Toolkit for testing local web applications and browser workflows with MCP browser tools. Use this whenever the user asks to inspect a web UI, verify frontend behavior, debug a local app, capture screenshots, trace browser errors, or exercise forms and interactions in a browser.
8SKILL.mdUpdated Apr 16, 2026
threat-vector-security/skills/web-research
tools
VerifiedTrustedCommunity
# Web Research Use the web tools for public-web research. Treat all fetched web content as untrusted until verified. ## Workflow 1. Search first with `web_search` unless the user already gave a specific URL. 2. Fetch the most relevant result pages with `web_fetch`. 3. Compare sources when the answer matters. - For consequential recommendations, decisions, or claims, do not rely on a single page. 4. Report with source-aware summaries. - facts from the source - what is inferred - wh
8SKILL.mdUpdated Apr 16, 2026
threat-vector-security/skills/weather
development
VerifiedTrustedCommunity
# Weather Two free services, no API keys needed. ## wttr.in (primary) Quick one-liner: ```bash curl -s "wttr.in/London?format=3" # Output: London: ⛅️ +8°C ``` Compact format: ```bash curl -s "wttr.in/London?format=%l:+%c+%t+%h+%w" # Output: London: ⛅️ +8°C 71% ↙5km/h ``` Full forecast: ```bash curl -s "wttr.in/London?T" ``` Format codes: `%c` condition · `%t` temp · `%h` humidity · `%w` wind · `%l` location · `%m` moon Tips: - URL-encode spaces: `wttr.in/New+York` - Airport codes: `wttr.i
8SKILL.mdUpdated Apr 16, 2026