performing-ransomware-incident-response

SUSPICIOUS: the skill is purpose-aligned for ransomware incident response, and its external endpoints are mostly official. However, it grants an AI agent high-impact autonomous capabilities—host containment, firewall changes, artifact deletion, restores, and infrastructure rebuilds—and also uploads incident samples to a third-party identification service. This is not confirmed malware, but it is a high-risk operational skill that should only run with strict human approval gates.