Respond to security incidents in AWS, Azure, and GCP via identity-based containment, cloud-native log analysis (CloudTrail, Azure Activity Logs, GCP Audit Logs), resource isolation, and forensic evidence acquisition adapted for ephemeral cloud infrastructure. Use when CSPM alerts or audit logs show compromised cloud credentials, unauthorized IAM changes, or a breach spanning cloud services.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill conducting-cloud-incident-responsenpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill conducting-cloud-incident-response -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill conducting-cloud-incident-response -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/conducting-cloud-incident-responsegh skill install mukul975/Anthropic-Cybersecurity-Skills conducting-cloud-incident-responsegit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/conducting-cloud-incident-response ~/.claude/skills/conducting-cloud-incident-response # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/conducting-cloud-incident-response ~/.agents/skills/conducting-cloud-incident-response # Codex, Cursor, Gemini CLI, Copilot, OpenCode