Security audit
Security checks for vulnerabilities and agentic risk
This is a markdown-only incident runbook template skill with expected operational commands, but users should treat those commands as examples requiring approval before use in production.
Install only if you want incident response runbook templates. Before using any generated or copied command in production, confirm the target service, approval path, backups, rollback plan, and incident commander direction, especially for database termination, VACUUM, delete, failover, Kubernetes rollout, scaling, and feature-flag actions.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
### 2. Quick Health Checks
- [ ] Can you reach the service? `curl -I https://api.company.com/payments/health`
- [ ] Database connectivity? Check connection pool metrics
- [ ] External dependencies? Check Stripe, bank API status
- [ ] Recent changes? Check deploy history
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
### 2. Quick Health Checks
- [ ] Can you reach the service? `curl -I https://api.company.com/payments/health`
- [ ] Database connectivity? Check connection pool metrics
- [ ] External dependencies? Check Stripe, bank API status
- [ ] Recent changes? Check deploy history
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
### 2. Quick Health Checks
- [ ] Can you reach the service? `curl -I https://api.company.com/payments/health`
- [ ] Database connectivity? Check connection pool metrics
- [ ] External dependencies? Check Stripe, bank API status
- [ ] Recent changes? Check deploy history
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
### 2. Quick Health Checks
- [ ] Can you reach the service? `curl -I https://api.company.com/payments/health`
- [ ] Database connectivity? Check connection pool metrics
- [ ] External dependencies? Check Stripe, bank API status
- [ ] Recent changes? Check deploy history
This runbook includes rollback, scaling, query termination, and configuration-changing commands that can materially affect production systems, but it does not clearly warn operators about prerequisites, approval requirements, blast radius, or recovery risks. In an agent skill context, these steps may be surfaced directly to a user and acted on quickly during an incident, increasing the chance of harmful or premature execution.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
psql -h $DB_HOST -U $DB_USER -c "SELECT pg_terminate_backend(pid);"
# Step 4: Check external dependency latency
curl -w "@curl-format.txt" -o /dev/null -s https://api.stripe.com/v1/health
# Step 5: Enable circuit breaker if dependency is slow
kubectl set env deployment/payment-service \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Go to Sentry: https://sentry.io/payments
# Step 3: If specific endpoint, enable feature flag to disable
curl -X POST https://api.company.com/internal/feature-flags \
-d '{"flag": "DISABLE_PROBLEMATIC_FEATURE", "enabled": true}'
# Step 4: If data issue, check recent data changes
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Go to Sentry: https://sentry.io/payments
# Step 3: If specific endpoint, enable feature flag to disable
curl -X POST https://api.company.com/internal/feature-flags \
-d '{"flag": "DISABLE_PROBLEMATIC_FEATURE", "enabled": true}'
# Step 4: If data issue, check recent data changes
The database runbook recommends dangerous actions such as terminating connections, VACUUM FULL, failover consideration, and deleting old data without guardrails about data integrity, lock contention, backup status, replica health, or approval requirements. In a live incident, an operator or agent following these instructions could worsen outages, cause data loss, or create irreversible operational damage.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
### Don'ts
- **Don't assume knowledge** - Write for 3 AM brain
- **Don't skip verification** - Confirm each step worked
- **Don't forget communication** - Keep stakeholders informed
- **Don't work alone** - Escalate early
- **Don't skip postmortems** - Learn from every incident