How to use the Cloud Incident Response agent skill

What the skill makes the agent do

An agent skill is a folder of instructions (a SKILL.md file, plus any reference files and scripts) that Claude loads when your request matches the skill's description. This one is written for cloud incidents such as compromised credentials, unauthorized IAM changes, or a breach that spans cloud services.

When active, the agent follows a six-step workflow: detect and confirm the incident, contain the compromised identity, preserve evidence, investigate cloud-specific attack patterns, eradicate and recover, and harden the environment afterwards. Containment is treated mainly as an identity operation, and evidence is collected before ephemeral resources are terminated or logs rotate.

• Lists provider-specific indicators to look for in CloudTrail, Azure Activity Logs and GCP Audit Logs
• Gives AWS CLI and Azure PowerShell containment commands for keys, sessions, roles and instances
• Lists evidence to export for each provider, such as CloudTrail events, disk snapshots and VPC or NSG flow logs
• Includes a Python helper, scripts/agent.py, that can run AWS CLI commands to disable an access key, attach a deny-all policy and isolate an instance

Install the skill from the ZIP or the Claude apps

Download the skill ZIP from this page and unzip it. For a personal install, place the folder in ~/.claude/skills/. For a single project, place it in that project's .claude/skills/ folder. The skill folder should contain SKILL.md, scripts/agent.py and references/api-reference.md.

If you use the Claude apps, you can instead upload the skill under Settings → Capabilities → Skills.

Trigger the skill with a natural request

You do not need a special command. Describe the situation in plain language and mention the cloud provider. The skill is designed to load when your request involves CSPM alerts, suspicious audit log entries, compromised cloud credentials, unauthorized IAM changes or a cloud-hosted breach.

Include the facts you have, such as the account, the user or role name, the suspicious event and the time window. The agent works better with specifics.

• "Our CSPM flagged a new access key on the svc-reporting IAM user in AWS. Help me triage it and contain it."
• "Azure Activity Log shows a new Owner role assignment on subscription prod-east. Walk me through the IR steps."
• "Someone created a service account key in our GCP project last night. What should I check in Cloud Audit Logs?"
• "Build a list of evidence to preserve from a compromised EC2 instance before we terminate it."

Know what it needs before you start

The skill itself assumes you have cloud-native logging enabled and privileged credentials. Only use the commands if you can act on the provider accounts involved. The helper script needs Python 3 and the AWS CLI for AWS actions. Azure commands use Azure PowerShell with the AzureAD and Az modules. The api-reference lists requests (>=2.28) as a Python dependency and AWS CLI (>=2.0).

• Python 3 for scripts/agent.py
• AWS CLI for AWS commands
• Azure PowerShell (AzureAD and Az modules) for Azure commands
• Cloud logging: CloudTrail, Azure Activity and Sign-in Logs, GCP Cloud Audit Logs
• Privileged cloud credentials to act on the incident

Safety notes on scripts and network access

This skill runs scripts and uses the network. The helper script calls the AWS CLI, and the commands change IAM permissions and network isolation. They can lock out legitimate users or break services if you run them without checking identifiers and scope. Review every identifier (user name, access key ID, instance ID, security group) before you run anything, and ideally test in a non-production account first.

The skill's own scope note says that purely on-premises incidents should use standard IR procedures instead.

• Check each identifier against your inventory before running a command
• Confirm the forensic security group and isolation rules first
• Preserve evidence before you terminate or delete anything
• Do not run unreviewed commands during a live production incident

Tips for getting useful results

Ask the agent to work through one provider at a time and to show you each command before running it. Give it the time window of the suspicious activity so it can focus its log review. Ask for an evidence checklist before any destructive step.

Because the playbook covers ephemeral infrastructure, ask early about snapshots and log exports, since data can disappear when resources are terminated.

• Name the provider and account or subscription involved
• Provide a time window for log searches
• Ask for the evidence list before containment removes access
• Ask for a post-incident hardening checklist once the incident is closed