SOC子引擎，基于agent-skills技术通过AI赋能SOC平台，对SOC告警进行研判、调查、响应。
SaferSkills independently audited SOC-Copilot (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
1、从用户输入的路径获取该目录下的所有告警日志，通过经验'{reference/triage/triage.md}'对告警进行研判分析。若匹配到了已有规则'{scripts/triage_rules/}'则直接跳到下面调查环境，若未匹配到规则，则研判完成后按照模板'{assets/triage_rule.yml}'生成对应的研判规则（规则要尽可能地泛化），生成后询问用户是否手工编辑修改或反馈模型修改，最终用户审核后固化到'{scripts/triage_rules}'。 2、询问用户是否需要进一步分析或溯源，若需要，则调用'{reference/investigation/investigation.md}'对告警进行调查分析。调查溯源完毕后，生成对应的python调查脚本，生成后询问用户是否手工编辑修改或反馈模型修改，最终用户审核后固化到'{scripts/investigation}' 3、询问用户是否进行响应处置，若需要，则调用'{reference/incident_response/incident_response.md}'对失陷主机进行响应处置。响应处置完毕后，生成对应的bash/powershell响应脚本，生成后询问用户是否手工编辑修改或反馈模型修改，最终用户审核后固化到'{scripts/incident_response}'。 4、如果该告警日志的研判结论为定向攻击，则根据模板'{assets/analysis_report.md}'输出分析报告保存到'{reports/}'路径。
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.