← All skills
security-operations
82 / 100 · Low risk
Fine to try. Some of what it can do is expected: a security skill usually runs scanners and checks websites.
By williamzujkowski/standards (GitHub) · security · 19 stars · scanned at commit f90f81f
Security Operations Center (SOC) practices, incident response, SIEM management, and threat hunting following NIST 800-61
Works with any agent that supports SKILL.md skills.
What this skill can do
Sends data to these websites: otx.alienvault.com, api.abuseipdb.com, www.virustotal.com, urlhaus-api.abuse.ch, api.crowdstrike.com, api.securitycenter.microsoft.com, api.any.run, api.cloudflare.com, www.ipdeny.com, company.com and 2 more
This is disclosed by the author in the skill's SKILL.md or README. Expected for a security skill.
Found in 16 places.
Show 13 more
- skills/security/security-operations/REFERENCE.md, line 208
curl -s "https://www.virustotal.com/api/v3/ip_addresses/$IP" \ - skills/security/security-operations/REFERENCE.md, line 215
curl -s "https://www.virustotal.com/api/v3/files/$HASH" \ - skills/security/security-operations/REFERENCE.md, line 228
curl -s "https://urlhaus-api.abuse.ch/v1/host/" \ - skills/security/security-operations/REFERENCE.md, line 339
Invoke-RestMethod -Uri "https://api.crowdstrike.com/devices/entities/devices-actions/v2?action_name=contain" ` - skills/security/security-operations/REFERENCE.md, line 344
Invoke-WebRequest -Uri "https://api.securitycenter.microsoft.com/api/machines/$machineId/isolate" ` - skills/security/security-operations/templates/incident-response-playbook.md, line 78
curl -X POST https://www.virustotal.com/api/v3/files \ - skills/security/security-operations/templates/incident-response-playbook.md, line 83
curl -X POST https://api.any.run/v1/analysis \ - skills/security/security-operations/templates/incident-response-playbook.md, line 268
curl "https://www.virustotal.com/api/v3/files/$HASH" -H "x-apikey: $VT_API_KEY" | jq '.data.attributes.last_analysis_stats' - skills/security/security-operations/templates/incident-response-playbook.md, line 669
curl -X PATCH "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/settings/security_level" \ - skills/security/security-operations/templates/incident-response-playbook.md, line 697
curl http://www.ipdeny.com/ipblocks/data/countries/cn.zone -o /tmp/cn.zone - skills/security/security-operations/templates/incident-response-playbook.md, line 725
curl -o /dev/null -s -w "Time: %{time_total}s\n" https://company.com - skills/security/security-operations/templates/incident-response-playbook.md, line 746
curl -s "https://www.abuseipdb.com/check/$ip/json?key=$ABUSE_IPDB_KEY" | jq . - skills/security/security-operations/templates/incident-response-playbook.md, line 852
curl -X POST https://badgesystem.company.com/api/revoke \
Changes files outside its own folder
The author does not mention this.
Found in 14 places.
Show 11 more
- skills/security/security-operations/scripts/forensics-collection.sh, line 237
cp /etc/group "${USER_DIR}/group" - skills/security/security-operations/scripts/forensics-collection.sh, line 273
cp /etc/crontab "${PERSIST_DIR}/etc-crontab" 2>/dev/null || true - skills/security/security-operations/scripts/forensics-collection.sh, line 274
cp -r /etc/cron.d "${PERSIST_DIR}/cron.d" 2>/dev/null || true - skills/security/security-operations/scripts/forensics-collection.sh, line 275
cp -r /etc/cron.daily "${PERSIST_DIR}/cron.daily" 2>/dev/null || true - skills/security/security-operations/scripts/forensics-collection.sh, line 276
cp -r /etc/cron.hourly "${PERSIST_DIR}/cron.hourly" 2>/dev/null || true - skills/security/security-operations/scripts/forensics-collection.sh, line 280
cp -r /etc/systemd/system "${PERSIST_DIR}/systemd-system" 2>/dev/null || true - skills/security/security-operations/scripts/forensics-collection.sh, line 286
cp /etc/rc.local "${PERSIST_DIR}/rc.local" 2>/dev/null || true - skills/security/security-operations/scripts/forensics-collection.sh, line 287
cp /etc/profile "${PERSIST_DIR}/profile" 2>/dev/null || true - skills/security/security-operations/templates/incident-response-playbook.md, line 49
echo "example-phishing.com REJECT Phishing domain" >> /etc/postfix/sender_access - skills/security/security-operations/templates/incident-response-playbook.md, line 313
sudo rm -f /etc/systemd/system/malicious.service - skills/security/security-operations/templates/incident-response-playbook.md, line 315
sudo rm -f /usr/local/bin/malware.sh
Runs commands on your computer
The author does not mention this. Expected for a security skill.
Found in 2 places.
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'security-operations' ] || [ -L ~/.agents/skills/'security-operations' ]; then echo 'A skill folder named security-operations already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/williamzujkowski/standards' "$d" && git -C "$d" checkout --quiet 'f90f81f6e725bcce9044429f3fb6f6ae11a17d26' -- 'skills/security/security-operations' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/security/security-operations' ~/.agents/skills/'security-operations' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'security-operations' ~/.claude/skills/'security-operations' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for williamzujkowski/standards shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/williamzujkowski/standards/)
Score history
| Date | Version | Score |
|---|
| 2026-11-07 | f90f81f | 82 |