[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AEKDFW4PBYE9NWD4BFBHGZ":3,"skill-same:01M6AEKDFW4PBYE9NWD4BFBHGZ":101},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":56,"commitSha":57,"skillDirectory":58,"forksCount":59,"repositoryHtmlUrl":60,"repositoryHomepageUrl":61,"ownerHtmlUrl":62,"ownerBlogUrl":63,"ownerDescription":64,"updatedAt":65,"install":66,"resources":79},"01M6AEKDFW4PBYE9NWD4BFBHGZ","enumerating-cloud-with-cloudfox",null,"Run CloudFox's read-only Describe\u002FList\u002FGet enumeration (all-checks, role-trusts, secrets, endpoints, and permissions commands) to map AWS and Azure attack paths and surface exploitable misconfigurations. Use immediately after obtaining a cloud credential to build situational awareness, find exposed resources and secrets, or map sts:AssumeRole trust relationships for lateral-movement\u002Fprivilege-escalation planning.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35884,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fenumerating-cloud-with-cloudfox\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"enumerating cloud with cloudfox","cloud","aws","cloud-pentest","cloudfox","enumeration","lateral-movement","offensive-security","escalation","situational-awareness","attack-paths","security","awareness","cloud-security","privilege-escalation","permissions","planning","run","azure","cybersecurity","2026-11-10 10:12:30",false,"---\nname: enumerating-cloud-with-cloudfox\ndescription: Run CloudFox's read-only Describe\u002FList\u002FGet enumeration (all-checks,\n  role-trusts, secrets, endpoints, and permissions commands) to map AWS and Azure attack\n  paths and surface exploitable misconfigurations. Use immediately after obtaining a cloud\n  credential to build situational awareness, find exposed resources and secrets, or map\n  sts:AssumeRole trust relationships for lateral-movement\u002Fprivilege-escalation planning.\ndomain: cybersecurity\nsubdomain: cloud-security\ntags:\n- cloudfox\n- aws\n- azure\n- cloud-pentest\n- attack-paths\n- situational-awareness\n- enumeration\n- offensive-security\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- ID.AM-03\nmitre_attack:\n- T1526\n---\n# Enumerating Cloud with CloudFox\n\n> **Legal Notice:** This skill is for authorized cloud penetration testing and assessment only. CloudFox makes read\u002Fdescribe API calls against the cloud account whose credentials you supply. Run it ONLY against accounts you own or are authorized to test under a signed scope. Although CloudFox is read-only by design, the enumeration it performs is reconnaissance against a live environment and must be in scope.\n\n## Overview\n\nCloudFox is an open-source command-line tool from Bishop Fox that helps penetration testers and red teamers gain *situational awareness* in unfamiliar cloud environments. Where tools like ScoutSuite focus on a defender-style configuration audit, CloudFox is built from the attacker's perspective: it answers questions like \"what are the most attackable secrets, endpoints, and instances in this account, and what can the identity I just compromised actually reach?\" It is read-only — it only performs `Describe`\u002F`List`\u002F`Get` style calls — and writes its findings to per-command CSV\u002FTXT\u002Floot files plus a combined report directory, so output can be triaged offline.\n\nCloudFox covers AWS most deeply (30+ commands) and supports Azure. The workhorse is `cloudfox aws all-checks`, which runs the full battery of enumeration commands with sensible defaults: inventory, internet-reachable `endpoints`, EC2 `instances` (with IPs and instance-profile roles), `iam-simulator` and `permissions` for IAM analysis, `principals`, `secrets` from Secrets Manager\u002FSSM, `buckets`, `role-trusts` (which identities can assume which roles — a core attack-path primitive), `access-keys`, `route53`, `ecr`, `lambda`, and more. CloudFox also emits ready-to-run command suggestions (e.g. `aws s3 ls` lines, `aws ssm start-session` lines) in its \"loot\" files so an operator can pivot immediately.\n\nThis skill covers installing CloudFox, authenticating to AWS and Azure, running targeted and full enumeration, interpreting the high-value outputs (role-trusts, secrets, endpoints), and feeding the results into attack-path planning. Source: github.com\u002FBishopFox\u002Fcloudfox.\n\n## When to Use\n\n- Establishing situational awareness immediately after compromising a cloud credential\n- Quickly identifying internet-exposed endpoints, instances, and exposed secrets\n- Mapping `sts:AssumeRole` trust relationships to plan lateral movement \u002F privesc\n- Triaging an unfamiliar AWS or Azure account during an authorized assessment\n- Producing attacker-centric inventory artifacts that complement a defensive audit\n\n## Prerequisites\n\n- CloudFox installed:\n  ```bash\n  # Homebrew\n  brew install cloudfox\n  # Go (1.21+)\n  go install github.com\u002FBishopFox\u002Fcloudfox@latest\n  # or download a release binary from GitHub and chmod +x\n  ```\n- Valid cloud credentials in scope:\n  ```bash\n  # AWS — configure a named profile and verify\n  aws configure --profile assess\n  aws sts get-caller-identity --profile assess\n\n  # Azure\n  az login\n  az account show\n  ```\n- A signed authorization \u002F Rules of Engagement defining the in-scope accounts\n- `awscli` (AWS) and\u002For `azure-cli` (Azure) installed for credential setup and follow-up\n\n## Objectives\n\n- Install CloudFox and confirm cloud credentials\n- Run full and targeted enumeration across AWS and Azure\n- Identify internet-reachable endpoints, instances, and exposed secrets\n- Enumerate IAM principals, permissions, and role-trust attack paths\n- Triage CloudFox loot files for immediate pivot commands\n- Export findings to a structured output directory for reporting\n\n## MITRE ATT&CK Mapping\n\n| ID | Name | Use in this skill |\n|----|------|-------------------|\n| T1526 | Cloud Service Discovery | CloudFox enumerates the available cloud services and resources in an account |\n| T1580 | Cloud Infrastructure Discovery | `inventory`, `instances`, `buckets` map the infrastructure footprint |\n| T1087.004 | Account Discovery: Cloud Account | `principals`, `access-keys` enumerate cloud identities |\n| T1069.003 | Permission Groups Discovery: Cloud Groups | `permissions`, `iam-simulator`, `role-trusts` reveal entitlements |\n| T1538 | Cloud Service Dashboard | Aggregated situational-awareness reporting across services |\n\n## Workflow\n\n### 1. Confirm the identity and run all AWS checks\n```bash\naws sts get-caller-identity --profile assess\ncloudfox aws --profile assess all-checks -o .\u002Floot\n```\n\n### 2. Inventory the account footprint\n```bash\ncloudfox aws --profile assess inventory\n```\n\n### 3. Find internet-reachable endpoints and exposed instances\n```bash\ncloudfox aws --profile assess endpoints\ncloudfox aws --profile assess instances\n```\n\n### 4. Enumerate IAM principals, permissions, and role-trust attack paths\n`role-trusts` is the key lateral-movement primitive — it shows who can assume what.\n```bash\ncloudfox aws --profile assess principals\ncloudfox aws --profile assess permissions\ncloudfox aws --profile assess role-trusts\ncloudfox aws --profile assess access-keys\n```\n\n### 5. Hunt for exposed secrets\n```bash\ncloudfox aws --profile assess secrets\n```\n\n### 6. Enumerate storage, registries, and serverless\n```bash\ncloudfox aws --profile assess buckets\ncloudfox aws --profile assess ecr\ncloudfox aws --profile assess lambda\ncloudfox aws --profile assess route53\n```\n\n### 7. Use IAM simulator to confirm what a principal can do\n```bash\ncloudfox aws --profile assess iam-simulator\n```\n\n### 8. Enumerate Azure\nCloudFox Azure works against the subscriptions the `az` session can see.\n```bash\ncloudfox azure inventory --outdir .\u002Fazure-loot\ncloudfox azure rbac\ncloudfox azure storage\ncloudfox azure vms\n```\n\n### 9. Triage the loot\nCloudFox writes per-command CSV\u002FTXT plus a `loot` directory of pivot commands.\n```bash\nls -R .\u002Floot\u002Fcloudfox-output\u002F\n# Loot files contain ready-to-run follow-ups, e.g. aws s3 ls \u002F ssm start-session lines\n```\nSee `scripts\u002Fagent.py` to run a curated set of commands and summarize output files.\n\n## Tools and Resources\n\n| Resource | Purpose | Link |\n|----------|---------|------|\n| CloudFox GitHub | Source, releases, full command list | https:\u002F\u002Fgithub.com\u002FBishopFox\u002Fcloudfox |\n| CloudFox docs\u002Fwiki | Per-command output explanations | https:\u002F\u002Fgithub.com\u002FBishopFox\u002Fcloudfox\u002Fwiki |\n| Bishop Fox CloudFox blog | Design and usage walkthrough | https:\u002F\u002Fbishopfox.com\u002Fblog\u002Fintroducing-cloudfox |\n| AWS CLI reference | Follow-up exploitation commands | https:\u002F\u002Fdocs.aws.amazon.com\u002Fcli\u002Flatest\u002Freference\u002F |\n| Pacu | Active exploitation after enumeration | https:\u002F\u002Fgithub.com\u002FRhinoSecurityLabs\u002Fpacu |\n\n## OPSEC and Detection Considerations\n\nCloudFox is read-only, but its enumeration is far from silent. Each command issues\nmany `Describe*`\u002F`List*`\u002F`Get*` API calls in a short burst, which is highly visible\nto defenders:\n\n- **CloudTrail** records every read call. A spike of `iam:ListUsers`, `iam:ListRoles`,\n  `secretsmanager:ListSecrets`, `ec2:DescribeInstances`, and `sts:GetCallerIdentity`\n  from one principal within seconds is a strong enumeration signal.\n- **GuardDuty** finding types such as `Discovery:IAMUser\u002FAnomalousBehavior` and\n  `Discovery:S3\u002FMaliciousIPCaller` can fire on this burst pattern.\n- Defenders should baseline normal API-call rates per principal and alert on\n  enumeration bursts, especially from new IPs\u002FASNs or newly created credentials.\n\nFor an authorized assessment, document the source IP and timestamp of CloudFox runs\nso the blue team can correlate, and prefer running from an in-scope, attributable host.\n\n## Recommended Operator Workflow\n\n1. Run `all-checks` once to populate the full output directory.\n2. Open `role-trusts` first — it reveals the assume-role graph for lateral movement.\n3. Cross-reference `secrets` and `env-vars` for credentials that unlock new principals.\n4. Use `endpoints` + `instances` to map externally reachable attack surface.\n5. Feed confirmed assume-role \u002F privesc candidates into Pacu for active exploitation.\n\n## High-Value Command Reference\n\n| Command | Why it matters |\n|---------|----------------|\n| `all-checks` | Runs the full enumeration battery with defaults |\n| `role-trusts` | Maps assume-role paths — core for lateral movement\u002Fprivesc |\n| `endpoints` | Surfaces internet-reachable attack surface |\n| `secrets` | Exposes credentials in Secrets Manager \u002F SSM |\n| `permissions` | Lists effective IAM permissions per principal |\n| `instances` | EC2 with IPs and attached instance-profile roles |\n| `access-keys` | Active access keys (potential credential targets) |\n\n## Validation Criteria\n\n- [ ] CloudFox installed and runs `cloudfox aws --help`\n- [ ] Cloud credentials confirmed via `sts get-caller-identity` \u002F `az account show`\n- [ ] `all-checks` completed and output directory populated\n- [ ] Internet-reachable endpoints and instances identified\n- [ ] IAM principals, permissions, and role-trusts enumerated\n- [ ] Exposed secrets located and documented\n- [ ] Azure enumeration run (if Azure in scope)\n- [ ] Loot files triaged for pivot opportunities\n- [ ] Findings exported to a structured directory for reporting\n- [ ] Enumeration confirmed to stay within authorized scope\n","# Enumerating Cloud with CloudFox\n\n> **Legal Notice:** This skill is for authorized cloud penetration testing and assessment only. CloudFox makes read\u002Fdescribe API calls against the cloud account whose credentials you supply. Run it ONLY against accounts you own or are authorized to test under a signed scope. Although CloudFox is read-only by design, the enumeration it performs is reconnaissance against a live environment and must be in scope.\n\n## Overview\n\nCloudFox is an open-source command-line tool from Bishop Fox that helps penetration testers and red teamers gain *situational awareness* in unfamiliar cloud environments. Where tools like ScoutSuite focus on a defender-style configuration audit, CloudFox is built from the attacker's perspective: it answers questions like \"what are the most attackable secrets, endpoints, and instances in this account, and what can the identity I just compromised actually reach?\" It is read-only — it only performs `Describe`\u002F`List`\u002F`Get` style calls — and writes its findings to per-command CSV\u002FTXT\u002Floot files plus a combined report directory, so output can be triaged offline.\n\nCloudFox covers AWS most deeply (30+ commands) and supports Azure. The workhorse is `cloudfox aws all-checks`, which runs the full battery of enumeration commands with sensible defaults: inventory, internet-reachable `endpoints`, EC2 `instances` (with IPs and instance-profile roles), `iam-simulator` and `permissions` for IAM analysis, `principals`, `secrets` from Secrets Manager\u002FSSM, `buckets`, `role-trusts` (which identities can assume which roles — a core attack-path primitive), `access-keys`, `route53`, `ecr`, `lambda`, and more. CloudFox also emits ready-to-run command suggestions (e.g. `aws s3 ls` lines, `aws ssm start-session` lines) in its \"loot\" files so an operator can pivot immediately.\n\nThis skill covers installing CloudFox, authenticating to AWS and Azure, running targeted and full enumeration, interpreting the high-value outputs (role-trusts, secrets, endpoints), and feeding the results into attack-path planning. Source: github.com\u002FBishopFox\u002Fcloudfox.\n\n## When to Use\n\n- Establishing situational awareness immediately after compromising a cloud credential\n- Quickly identifying internet-exposed endpoints, instances, and exposed secrets\n- Mapping `sts:AssumeRole` trust relationships to plan lateral movement \u002F privesc\n- Triaging an unfamiliar AWS or Azure account during an authorized assessment\n- Producing attacker-centric inventory artifacts that complement a defensive audit\n\n## Prerequisites\n\n- CloudFox installed:\n  ```bash\n  # Homebrew\n  brew install cloudfox\n  # Go (1.21+)\n  go install github.com\u002FBishopFox\u002Fcloudfox@latest\n  # or download a release binary from GitHub and chmod +x\n  ```\n- Valid cloud credentials in scope:\n  ```bash\n  # AWS — configure a named profile and verify\n  aws configure --profile assess\n  aws sts get-caller-identity --profile assess\n\n  # Azure\n  az login\n  az account show\n  ```\n- A signed authorization \u002F Rules of Engagement defining the in-scope accounts\n- `awscli` (AWS) and\u002For `azure-cli` (Azure) installed for credential setup and follow-up\n\n## Objectives\n\n- Install CloudFox and confirm cloud credentials\n- Run full and targeted enumeration across AWS and Azure\n- Identify internet-reachable endpoints, instances, and exposed secrets\n- Enumerate IAM principals, permissions, and role-trust attack paths\n- Triage CloudFox loot files for immediate pivot commands\n- Export findings to a structured output directory for reporting\n\n## MITRE ATT&CK Mapping\n\n| ID | Name | Use in this skill |\n|----|------|-------------------|\n| T1526 | Cloud Service Discovery | CloudFox enumerates the available cloud services and resources in an account |\n| T1580 | Cloud Infrastructure Discovery | `inventory`, `instances`, `buckets` map the infrastructure footprint |\n| T1087.004 | Account Discovery: Cloud Account | `principals`, `access-keys` enumerate cloud identities |\n| T1069.003 | Permission Groups Discovery: Cloud Groups | `permissions`, `iam-simulator`, `role-trusts` reveal entitlements |\n| T1538 | Cloud Service Dashboard | Aggregated situational-awareness reporting across services |\n\n## Workflow\n\n### 1. Confirm the identity and run all AWS checks\n```bash\naws sts get-caller-identity --profile assess\ncloudfox aws --profile assess all-checks -o .\u002Floot\n```\n\n### 2. Inventory the account footprint\n```bash\ncloudfox aws --profile assess inventory\n```\n\n### 3. Find internet-reachable endpoints and exposed instances\n```bash\ncloudfox aws --profile assess endpoints\ncloudfox aws --profile assess instances\n```\n\n### 4. Enumerate IAM principals, permissions, and role-trust attack paths\n`role-trusts` is the key lateral-movement primitive — it shows who can assume what.\n```bash\ncloudfox aws --profile assess principals\ncloudfox aws --profile assess permissions\ncloudfox aws --profile assess role-trusts\ncloudfox aws --profile assess access-keys\n```\n\n### 5. Hunt for exposed secrets\n```bash\ncloudfox aws --profile assess secrets\n```\n\n### 6. Enumerate storage, registries, and serverless\n```bash\ncloudfox aws --profile assess buckets\ncloudfox aws --profile assess ecr\ncloudfox aws --profile assess lambda\ncloudfox aws --profile assess route53\n```\n\n### 7. Use IAM simulator to confirm what a principal can do\n```bash\ncloudfox aws --profile assess iam-simulator\n```\n\n### 8. Enumerate Azure\nCloudFox Azure works against the subscriptions the `az` session can see.\n```bash\ncloudfox azure inventory --outdir .\u002Fazure-loot\ncloudfox azure rbac\ncloudfox azure storage\ncloudfox azure vms\n```\n\n### 9. Triage the loot\nCloudFox writes per-command CSV\u002FTXT plus a `loot` directory of pivot commands.\n```bash\nls -R .\u002Floot\u002Fcloudfox-output\u002F\n# Loot files contain ready-to-run follow-ups, e.g. aws s3 ls \u002F ssm start-session lines\n```\nSee `scripts\u002Fagent.py` to run a curated set of commands and summarize output files.\n\n## Tools and Resources\n\n| Resource | Purpose | Link |\n|----------|---------|------|\n| CloudFox GitHub | Source, releases, full command list | https:\u002F\u002Fgithub.com\u002FBishopFox\u002Fcloudfox |\n| CloudFox docs\u002Fwiki | Per-command output explanations | https:\u002F\u002Fgithub.com\u002FBishopFox\u002Fcloudfox\u002Fwiki |\n| Bishop Fox CloudFox blog | Design and usage walkthrough | https:\u002F\u002Fbishopfox.com\u002Fblog\u002Fintroducing-cloudfox |\n| AWS CLI reference | Follow-up exploitation commands | https:\u002F\u002Fdocs.aws.amazon.com\u002Fcli\u002Flatest\u002Freference\u002F |\n| Pacu | Active exploitation after enumeration | https:\u002F\u002Fgithub.com\u002FRhinoSecurityLabs\u002Fpacu |\n\n## OPSEC and Detection Considerations\n\nCloudFox is read-only, but its enumeration is far from silent. Each command issues\nmany `Describe*`\u002F`List*`\u002F`Get*` API calls in a short burst, which is highly visible\nto defenders:\n\n- **CloudTrail** records every read call. A spike of `iam:ListUsers`, `iam:ListRoles`,\n  `secretsmanager:ListSecrets`, `ec2:DescribeInstances`, and `sts:GetCallerIdentity`\n  from one principal within seconds is a strong enumeration signal.\n- **GuardDuty** finding types such as `Discovery:IAMUser\u002FAnomalousBehavior` and\n  `Discovery:S3\u002FMaliciousIPCaller` can fire on this burst pattern.\n- Defenders should baseline normal API-call rates per principal and alert on\n  enumeration bursts, especially from new IPs\u002FASNs or newly created credentials.\n\nFor an authorized assessment, document the source IP and timestamp of CloudFox runs\nso the blue team can correlate, and prefer running from an in-scope, attributable host.\n\n## Recommended Operator Workflow\n\n1. Run `all-checks` once to populate the full output directory.\n2. Open `role-trusts` first — it reveals the assume-role graph for lateral movement.\n3. Cross-reference `secrets` and `env-vars` for credentials that unlock new principals.\n4. Use `endpoints` + `instances` to map externally reachable attack surface.\n5. Feed confirmed assume-role \u002F privesc candidates into Pacu for active exploitation.\n\n## High-Value Command Reference\n\n| Command | Why it matters |\n|---------|----------------|\n| `all-checks` | Runs the full enumeration battery with defaults |\n| `role-trusts` | Maps assume-role paths — core for lateral movement\u002Fprivesc |\n| `endpoints` | Surfaces internet-reachable attack surface |\n| `secrets` | Exposes credentials in Secrets Manager \u002F SSM |\n| `permissions` | Lists effective IAM permissions per principal |\n| `instances` | EC2 with IPs and attached instance-profile roles |\n| `access-keys` | Active access keys (potential credential targets) |\n\n## Validation Criteria\n\n- [ ] CloudFox installed and runs `cloudfox aws --help`\n- [ ] Cloud credentials confirmed via `sts get-caller-identity` \u002F `az account show`\n- [ ] `all-checks` completed and output directory populated\n- [ ] Internet-reachable endpoints and instances identified\n- [ ] IAM principals, permissions, and role-trusts enumerated\n- [ ] Exposed secrets located and documented\n- [ ] Azure enumeration run (if Azure in scope)\n- [ ] Loot files triaged for pivot opportunities\n- [ ] Findings exported to a structured directory for reporting\n- [ ] Enumeration confirmed to stay within authorized scope\n",{"name":5,"tags":49,"author":50,"domain":43,"license":15,"version":51,"nist_csf":52,"subdomain":37,"description":7,"mitre_attack":54},[28,26,42,27,34,33,29,31],"mahipal","1.0",[53],"ID.AM-03",[55],"T1526","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fenumerating-cloud-with-cloudfox",4379,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":67,"prompt":77,"zipAvailable":78},[68,71,74],{"tool":69,"command":70},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill enumerating-cloud-with-cloudfox",{"tool":72,"command":73},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill enumerating-cloud-with-cloudfox",{"tool":75,"command":76},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill enumerating-cloud-with-cloudfox","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fenumerating-cloud-with-cloudfox\u002FSKILL.md",true,[80,85,91,95],{"path":81,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":83,"sourceHtmlUrl":84},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fenumerating-cloud-with-cloudfox\u002FLICENSE",{"path":86,"resourceType":87,"resourceTypeDesc":88,"sizeBytes":89,"sourceHtmlUrl":90},"references\u002Fapi-reference.md","REFERENCE","参考文档",1926,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fenumerating-cloud-with-cloudfox\u002Freferences\u002Fapi-reference.md",{"path":92,"resourceType":87,"resourceTypeDesc":88,"sizeBytes":93,"sourceHtmlUrl":94},"references\u002Fstandards.md",1106,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fenumerating-cloud-with-cloudfox\u002Freferences\u002Fstandards.md",{"path":96,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":99,"sourceHtmlUrl":100},"scripts\u002Fagent.py","SCRIPT","脚本",3789,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fenumerating-cloud-with-cloudfox\u002Fscripts\u002Fagent.py",[102,128,152,180,206,232],{"skillNo":103,"name":104,"nameZh":6,"description":105,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":106,"categories":107,"keywords":109,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[108],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[110,111,112,113,35,43,114,115,116,117,118,119,120,121,122,123,124,125,126,127],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":129,"name":130,"nameZh":6,"description":131,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":132,"categories":133,"keywords":135,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[134],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[136,124,137,138,35,139,43,116,140,141,142,143,144,145,146,147,148,149,150,151],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":153,"name":154,"nameZh":6,"description":155,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":156,"categories":157,"keywords":162,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[158,161],{"categoryNo":159,"categoryName":160,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[146,163,164,165,166,43,167,168,140,169,170,171,172,173,174,175,176,177,178,179],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":181,"name":182,"nameZh":6,"description":183,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":184,"categories":185,"keywords":187,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[186],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[188,189,190,43,191,192,193,194,195,196,197,198,199,200,201,202,143,203,204,205],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":207,"name":208,"nameZh":6,"description":209,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":210,"categories":211,"keywords":213,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[212],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[214,215,216,43,217,40,218,219,220,221,222,223,224,225,226,227,228,229,230,231],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":233,"name":234,"nameZh":6,"description":235,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":236,"categories":237,"keywords":239,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[238],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[35,240,43,241,242,243,244,245,246,247,248,175,249,176,250,251,252,253,254,255],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]