abnormal
From the author
The full Abnormal Security REST API as an agent-ready CLI - with a local threat store, ranked SOC triage, and one-shot reporting no SOAR pack offers. Trigger phrases: `triage abnormal threats`, `remediate a phishing campaign in abnormal`, `abnormal email threat report`, `check account takeover risk for an employee`, `vendor email compromise check`, `use abnormal security`, `run abnormal-cli`.
Install
npx skills add Servosity/msp-skills --skill abnormal -a claude-code
Installs to .claude/skills/abnormal/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
Want your agent to suggest skills while you type? See how to use skills from your IDE.
Safety checks on SKILL.md
- Ships scripts we have not reviewedLow
Why 76
aiqbench computes the trust score from public signals. It is not a security audit, so read a skill before you install it.
Similar skills
Closest to this one by what they do and when they are used.
- security-alert-triageelastic/agent-skillsTriage Elastic Security alerts — gather context, classify threats, create cases, and acknowledge. Use when triaging alerts, performing SOC analysis, or investigating detections.OfficialSecurity★ 600
- corkServosity/msp-skillsEvery Cork API operation as one CLI and MCP server, plus cross-client risk attribution, exploitability-first vulnerability triage, overdue-compliance detection, and stale-connector health checks that a stateless API mirror cannot answer in a single call. Trigger phrases: `which Cork clients got worse this week`, `why did this client's Cork score drop`, `what should we patch first in Cork`, `are we exposed to this CVE`, `which Cork integrations are stale`, `which clients have no cyber warranty`, `use cork`, `run cork`.Security★ 63
- afiServosity/msp-skillsThe first CLI for Afi SaaS backup - full public-API coverage plus the fleet-wide coverage, staleness, and offboarding answers the rate-limited API can't serve live. Trigger phrases: `check afi backup coverage`, `which mailboxes aren't backed up in afi`, `afi fleet health`, `offboard a user from afi backup`, `afi backup stale check`, `use afi`, `run afi-cli`.Engineering★ 63
- threatlockerServosity/msp-skillsEvery ThreatLocker Portal API feature, plus the write operations the read-only tools lack and a cross-tenant offline store no other ThreatLocker tool has. Trigger phrases: `triage threatlocker approvals`, `approve this hash across all tenants`, `export the threatlocker audit log`, `which threatlocker agents are offline`, `why is threatlocker returning 401`, `use threatlocker`, `run threatlocker`.Writing★ 63
- connectsecureServosity/msp-skillsUse when the user asks to rank ConnectSecure (formerly CyberCNS) vulnerabilities across every client, find which clients and assets a CVE hits, prep a client QBR risk pack, find assets with stale or unauthenticated scans or silent agents, audit expired or self-approved vulnerability suppressions, review Active Directory password hygiene across clients, or run any ConnectSecure V4 API operation. Trigger phrases: `which clients have critical vulnerabilities`, `connectsecure exposure across all clients`, `are we affected by this CVE`, `prep the QBR risk numbers`, `find stale or unauthenticated scans`, `audit vulnerability suppressions`, `check AD password hygiene across clients`, `use connectsecure`, `run connectsecure`.Security★ 63
- triaging-security-alerts-in-splunk26zl/cybersec-toolkitTriages security alerts in Splunk Enterprise Security by classifying severity, investigating notable events, correlating related telemetry, and making escalation or closure decisions using SPL queries and the Incident Review dashboard. Use when SOC analysts face queued alerts from correlation searches, need to prioritize investigation order, or must document triage decisions for handoff to Tier 2/3 analysts.Security★ 82
Ratings & reviews
—
no reviews
Tried this skill? Rate it to help others. Sign in
Discussion
Join the discussion. Sign in