# Dnr Respond

Incident response workup for a lead in hand, an alert, an IOC, or a /dnr-hunt finding.

- Repository: https://github.com/anthropics/defending-code-reference-harness (7690 stars)
- Category: Engineering
- License: see repository
- Last updated: 2026-08-06
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add anthropics/defending-code-reference-harness --skill dnr-respond -g -a claude-code -y`
Codex: `npx skills add anthropics/defending-code-reference-harness --skill dnr-respond -g -a codex -y`
Cursor: `npx skills add anthropics/defending-code-reference-harness --skill dnr-respond -g -a cursor -y`
Gemini CLI: `npx skills add anthropics/defending-code-reference-harness --skill dnr-respond -g -a gemini-cli -y`

## Description

Incident response workup for a lead in hand, an alert, an IOC, or a /dnr-hunt finding. Scopes the lead across the logs, verdicts whether the attack succeeded, quantifies blast radius, confirms root cause in source with a local PoC, and writes a proposed (never executed) containment/remediation/recovery plan. Use when asked to "respond to this alert", "work this incident", "how bad is this", or "run dnr-respond". /dnr-hunt is the no-alert entry to the same track.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# dnr-respond

Lead-in-hand incident response: take one concrete starting point and answer
the four questions an incident commander needs, in order, **what happened,
did it succeed, how far did it go, and what do we do about it.** The output
is a verdict, a quantified blast radius, a root cause proven in source, and
a response plan that is *proposed, never executed*.

Invoke with `/dnr-respond <lead> [--logs dir] [--repo path] [--fresh]`.

**The lead (`$1`) can be:**
- an incident id from the hunt's `INCIDENTS.json` (e.g. `INC-2`), the
  `/dnr-hunt` handoff
- an alert pasted from an alert queue (JSON line or prose)
- an IOC: an IP, an account name, a route, a session identifier
- free text ("a customer says their address was quoted in a phishing email")

**Other arguments:**
- `--logs` = logs directory or dnr target directory (same resolution as
  `/dnr-hunt`; defaults to `targets/dnrcanary` if it exists, else cwd).
- `--repo` = application source (defaults to the target's `app/`).
- `--fresh` = ignore any checkpoint in the run dir's `.dnr-respond-state/`
  and mint a new run dir.

## Hard rules (shared with /dnr-hunt, the track's contract)

The rest: https://github.com/anthropics/defending-code-reference-harness/blob/HEAD/.claude/skills/dnr-respond/SKILL.md