Incident response workup for a lead in hand — an alert, an IOC, or a /dnr-hunt finding. Scopes the lead across the logs, verdicts whether the attack succeeded, quantifies blast radius, confirms root cause in source with a local PoC, and writes a proposed (never executed) containment/remediation/recovery plan.
Install
npx skills add anthropics/defending-code-reference-harness --skill dnr-respondnpx skills add anthropics/defending-code-reference-harness --skill dnr-respond -a claude-code -gnpx skills add anthropics/defending-code-reference-harness --skill dnr-respond -a codex -ggemini skills install https://github.com/anthropics/defending-code-reference-harness.git --path .claude/skills/dnr-respondgh skill install anthropics/defending-code-reference-harness dnr-respondgit clone --depth 1 https://github.com/anthropics/defending-code-reference-harness /tmp/anthropics__defending-code-reference-harness
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/anthropics__defending-code-reference-harness/.claude/skills/dnr-respond ~/.claude/skills/dnr-respond # Claude Code
cp -R /tmp/anthropics__defending-code-reference-harness/.claude/skills/dnr-respond ~/.agents/skills/dnr-respond # Codex, Cursor, Gemini CLI, Copilot, OpenCode