How to use the Malware Incident Communication Templates agent skill

What does the skill make the agent do?

Once installed, the agent can produce ready-to-fill communication templates for a malware incident. The skill maps severity levels P1 to P4 to notification timelines and audiences. For example, P1 (ransomware, wiper or widespread infection affecting business operations) is listed with notification within 15 minutes and an audience of CISO, CEO, Legal and Board (if applicable).

The skill includes four templates: an initial internal incident notification, an executive briefing, a technical advisory for IT teams with an indicators-of-compromise section, and a regulatory notification letter. It also provides a tracking template for logging notifications and updates, and reference material on standards such as GDPR Article 33 and 34, HIPAA, PCI DSS and SEC cybersecurity disclosure rules.

How do you install the skill?

Download the ZIP file from this page and unzip it. Put the resulting skill folder in one of two places: your personal skills folder at ~/.claude/skills/, or a project's .claude/skills/ folder if you want the skill available only inside that project.

If you use the Claude apps instead, open Settings, go to Capabilities, and upload the skill under Skills.

• Personal: ~/.claude/skills/
• Project: .claude/skills/ inside your project folder
• Claude apps: Settings → Capabilities → Skills (upload)

Check the requirements before you start

The skill needs Python 3.8 or newer with its required dependencies installed, as listed in the SKILL.md prerequisites. The prerequisites also say you should have familiarity with incident response concepts, access to a test or lab environment for safe execution, and authorization for any testing activities.

The skill runs scripts (scripts/agent.py and scripts/process.py). It does not use the network.

• Python 3.8+ with required dependencies
• Runs scripts: yes
• Uses network: no

How do you trigger the skill with a natural request?

You do not need a special command. Describe the task in plain language and mention the malware incident and what you need. The skill's description says it is for drafting or standardizing incident communications and notification workflows for a malware outbreak, so requests that match that wording are the most likely to use it.

Include the details the templates ask for: the malware type, the severity, the systems affected and who needs to hear about it. The more context you give, the less placeholder text you will have to fill in.

• Draft an initial internal notification for a P2 malware incident affecting our finance department.
• Write an executive briefing for the CISO on a suspected wiper attack, in business terms.
• Create a technical advisory for IT with an IOC section for this trojan sample.
• Draft a regulatory notification letter outline for a ransomware incident that exposed customer personal data.

What can the Python script do?

The skill includes a small Python script that generates templates for a given case. The script only generates text. It does not send emails or alerts, so nothing goes out automatically. The tracking template (assets/template.md) is a set of tables for case information, a notification tracker, an update log, regulatory notifications and customer communication checklists that you fill in yourself.

Safety notes and limits

The templates are generic. They do not replace legal or regulatory advice, and they do not replace the regulator's required format. For a live incident that needs legal or regulatory input, involve counsel first.

The skill has no automatic notifications, so someone must review and send every message. Templates contain placeholders in square brackets, such as [DATE/TIME UTC] and [HASH]; these must be filled with verified facts before anything is sent.

• Do not treat generated text as legal advice.
• Review every placeholder before sending.
• Practice with the templates in a test environment before an incident.

Tips for getting better output

Ask for one artifact at a time, such as the executive briefing, and then ask for the matching update. Tell the agent the severity level so it applies the correct notification timeline and audience. If you are preparing a playbook before an incident, ask the agent to fill in the tracking template structure with your role names.

• State the severity (P1 to P4) in your request.
• Name the malware type: ransomware, wiper, trojan, worm or infostealer.
• Ask for a playbook draft before an incident, not only during one.