‹ 首页

confirm-action

@dandye · 收录于 5 天前 · 上游提交 3 个月前

Ask the user to confirm before taking a significant action. Use before containment, remediation, or other impactful operations to ensure analyst approval. Presents options and waits for response.

场景安全响应权限审批操作确认

适合你，如果需要在执行高危操作前获得人工批准

/ 下载安装
https://github.com/dandye/ai-runbooks/tree/main/skills/confirm-action ↗
/ 通过 npx 安装 校验哈希
npx oh-my-skill add dandye/ai-runbooks/confirm-action
/ 通过 bash 安装
curl -fsSL https://oh-my-skill.com/install.sh | bash -s -- dandye/ai-runbooks/confirm-action
/ 已经装过?验证本机副本,不用重装
npx oh-my-skill verify dandye/ai-runbooks/confirm-action
安装目标可用 --agent / --scope 或 --to 明确指定;省略时只会在唯一已存在的 agent 目录上自动选择,零命中或多命中会停止并提示。content_hash 缺失或不一致均拒装。
119GitHub stars
~407上下文体积 · 单文件
索引托管

怎么用

商店整理自技能原文 · 版本 086cbf6 · 表述以原文为准
它做什么

在采取重要操作（如隔离端点、禁用账户、封禁IP等）前，Claude会先向你提问确认，并提供预设选项，等待你的回复后再继续。

什么时候触发

当Claude要执行封锁、隔离、删除等有影响的操作时触发。对于只读操作（如添加注释、查询）则跳过确认。

装好后可以这样说
Claude会询问是否确认隔离。
Claude会提供禁用、重置密码等选项。
Claude会询问关闭选项。
技能原文 SKILL.md作者撰写 · Apache-2.0 · 086cbf6

Confirm Action Skill

Ask the user a confirmation question before proceeding with a significant action.

Inputs
  • QUESTION_TEXT - The specific question to ask (e.g., "Isolate endpoint WORKSTATION-01?", "Proceed with account disable for jsmith?")
  • (Optional) RESPONSE_OPTIONS - Predefined options for the user:
  • Default: ["Yes", "No"]
  • Custom examples: ["Disable Account", "Reset Password", "Monitor Only"]
Workflow
Step 1: Present Question

Display the question to the user with available options.

Step 2: Wait for Response

Collect the user's selection or custom input.

Step 3: Return Response

Provide the response back to the calling workflow for decision branching.

Outputs

| Output | Description | |--------|-------------| | USER_RESPONSE | The user's answer to the confirmation question |

When to Use

Always confirm before:

  • Isolating/quarantining endpoints
  • Disabling user accounts
  • Blocking IPs/domains at firewall
  • Terminating processes
  • Deleting files
  • Escalating to incident response
  • Closing cases as false positive (for high-severity alerts)

May skip confirmation for:

  • Adding comments to cases
  • Running enrichment queries
  • Generating reports
  • Read-only operations
Example Confirmations

Containment:

Question: "Isolate endpoint WORKSTATION-01 from the network?"
Options: ["Yes - Isolate", "No - Continue Monitoring", "Escalate First"]

Account Action:

Question: "User jsmith shows signs of compromise. What action?"
Options: ["Disable Account", "Force Password Reset", "Monitor Only", "Escalate to IR"]

Case Closure:

Question: "Close case 1234 as False Positive?"
Options: ["Yes - Close FP", "No - Keep Open", "Escalate to Tier 2"]
按 Apache-2.0 许可原样转载,未经改动 · 在 GitHub 查看 →

评论

登录即可评论;带「已验证安装」的,是发布者名下有本店的安装或持有记录。
…