How to use the Ransomware Playbook Builder (CISA) agent skill

What does this skill make the agent do?

Once installed, the agent can produce a structured ransomware incident response playbook covering preparation, detection, containment, eradication, recovery and post-incident review. The checklists are aligned to the CISA StopRansomware Guide and the NIST Cybersecurity Framework.

The skill also includes a Python script, scripts/agent.py, that holds a preparation checklist and can produce a gap analysis of an organization's readiness. The agent is instructed to defer to legal counsel on ransom payment and breach notification decisions.

• Playbook phases: preparation, detection and analysis, containment, eradication and recovery, post-incident activity
• Readiness assessment against CISA StopRansomware items
• Tabletop exercise validation of response steps

How do you install the skill?

An agent skill is a folder containing a SKILL.md file that tells the agent when and how to work. Install it in one of two ways.

Option 1: Download the ZIP from this page and unzip it into your personal skills folder ~/.claude/skills/, or into a project's .claude/skills/ folder for use in that project only.

Option 2: In the Claude apps, upload the ZIP under Settings → Capabilities → Skills.

• Personal: ~/.claude/skills/
• Project only: .claude/skills/ inside the project folder
• Claude apps: Settings → Capabilities → Skills

What do you need before you start?

The skill lists a few prerequisites. Python 3.8 or later is required to run scripts/agent.py. For tailored output, you also need your organization's asset inventory and backup documentation.

You should be familiar with the CISA StopRansomware Guide and the NIST Cybersecurity Framework functions (Identify, Protect, Detect, Respond, Recover). The skill also expects inventories of critical assets, backup infrastructure and communication channels, plus defined incident response roles.

• Python 3.8+ to run scripts/agent.py
• Asset inventory and backup documentation for tailored output
• Basic understanding of the CISA StopRansomware Guide and NIST CSF

How do you trigger the skill with a natural request?

You do not need a special command. Describe the task in plain language that matches the skill's stated uses: creating or updating a ransomware playbook, running a CISA-aligned readiness assessment, or validating response steps during a tabletop exercise.

Include your organization's context, such as which systems, backups and communication channels exist, so the output is tailored rather than generic.

• Example: Draft a ransomware response playbook for our company aligned with the CISA StopRansomware Guide and NIST CSF.
• Example: Run a CISA-aligned ransomware readiness assessment for our environment and list the gaps.
• Example: Prepare tabletop exercise steps to test our ransomware response plan.

What kinds of output should you expect?

The playbook includes a preparation checklist covering offline tested backups, an incident response plan, MFA on remote and privileged accounts, EDR, RDP restrictions, asset inventory, patching of internet-facing systems, email filtering, and quarterly restore testing with documented RTO and RPO.

Response sections cover detection indicators, immediate containment, recovery priorities (P1 to P4), and a post-incident report template. Review every item against your own environment before adopting it.

• Preparation checklist (12 items)
• Detection indicators and initial analysis steps
• Containment steps, with the first 1-4 hours prioritized
• Recovery priority matrix and post-incident report template

What are the safety notes?

The skill runs scripts: yes. It does not use the network. Read scripts/agent.py before running it, and run it in an environment you control.

The checklists are generic. They are not a replacement for experienced responders during a live incident, and they are not legal advice on ransom payments, breach notification or regulatory duties. The skill is not authoritative legal or regulatory compliance sign-off; consult counsel.

• Runs scripts: yes (scripts/agent.py, Python 3.8+)
• Uses network: no
• Not for live incident response
• Not a substitute for legal counsel

What tips will help you get better results?

Give the agent real inventory and backup details rather than asking for a generic plan. Use the output as a draft for your team to test in a tabletop exercise, then update it at least annually or after an incident, as the skill itself recommends.

Keep the CISA StopRansomware Guide open alongside the output to check items against the source. The reference file lists the official guide and CISA and FBI IC3 reporting links.

• Supply your asset inventory and backup documentation
• Validate the playbook in a tabletop exercise with all stakeholders
• Cross-check items against the CISA StopRansomware Guide
• Review the playbook at least annually or after any incident