[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AES89CC519FP3H3WMYC728":3,"skill-same:01M6AES89CC519FP3H3WMYC728":106},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":46,"linkOnly":47,"markdownContent":48,"markdownBody":49,"frontMatter":50,"refName":61,"commitSha":62,"skillDirectory":63,"forksCount":64,"repositoryHtmlUrl":65,"repositoryHomepageUrl":66,"ownerHtmlUrl":67,"ownerBlogUrl":68,"ownerDescription":69,"updatedAt":70,"install":71,"resources":84},"01M6AES89CC519FP3H3WMYC728","generating-and-analyzing-sboms",null,"Generate CycloneDX and SPDX SBOMs from container images and filesystems with Syft, correlate them to CVEs with Grype, and sign\u002Fattest them with Cosign. Use when you need a machine-readable dependency inventory for supply-chain risk, want to scan images or SBOMs for known vulnerabilities, or are embedding SBOM generation and vulnerability gating into CI\u002FCD.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35925,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fgenerating-and-analyzing-sboms\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45],"generating and analyzing sboms","analyzing","SBOM","risk","supply-chain-security","vulnerability-management","grype","syft","supply-chain","SPDX","CycloneDX","devsecops","ci","dependency inventory","generate","container images","vulnerabilities","cybersecurity","security","2026-11-10 10:12:30",false,"---\nname: generating-and-analyzing-sboms\ndescription: Generate CycloneDX and SPDX SBOMs from container images and filesystems with Syft, correlate them to CVEs with Grype, and sign\u002Fattest them with Cosign. Use when you need a machine-readable dependency inventory for supply-chain risk, want to scan images or SBOMs for known vulnerabilities, or are embedding SBOM generation and vulnerability gating into CI\u002FCD.\ndomain: cybersecurity\nsubdomain: supply-chain-security\ntags:\n- supply-chain-security\n- sbom\n- cyclonedx\n- spdx\n- syft\n- grype\n- vulnerability-management\n- devsecops\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- ID.AM-08\nmitre_attack:\n- T1195.001\n---\n# Generating and Analyzing SBOMs\n\n> **Authorized Use Only:** Generate and scan SBOMs only for software and images you own or are authorized to assess. Treat SBOMs as sensitive inventory data — they reveal your dependency attack surface.\n\n## Overview\n\nA Software Bill of Materials (SBOM) is a formal, machine-readable inventory of every component, library, and dependency in a piece of software — the supply-chain equivalent of an ingredients label. SBOMs are central to defending against supply-chain compromise (CISA's SBOM initiative, US Executive Order 14028) because you cannot patch what you cannot see. The two dominant SBOM standards are:\n\n- **CycloneDX** — an OWASP standard optimized for security use cases (vulnerabilities, VEX, dependency relationships).\n- **SPDX** — a Linux Foundation \u002F ISO standard (ISO\u002FIEC 5962) strong on licensing and provenance.\n\nThe reference open-source toolchain is from Anchore:\n\n- **Syft** generates SBOMs (CycloneDX, SPDX, or its native format) from container images and filesystems.\n- **Grype** matches an SBOM (or image) against vulnerability databases to find CVEs.\n- **Cosign** (Sigstore) signs SBOMs and attaches them to images as signed attestations for tamper-evident provenance.\n\nThis skill covers producing standards-compliant SBOMs, correlating them with vulnerability intelligence, and embedding the workflow into CI\u002FCD.\n\n## When to Use\n\n- Establishing and maintaining a component inventory for applications and container images.\n- Continuously detecting known vulnerabilities (including newly disclosed CVEs against existing artifacts).\n- Satisfying procurement\u002Fregulatory SBOM requirements (CISA, EO 14028).\n- Producing signed SBOM attestations for downstream supply-chain trust.\n\n## Prerequisites\n\n- Install Syft and Grype (official install scripts):\n  ```bash\n  curl -sSfL https:\u002F\u002Fraw.githubusercontent.com\u002Fanchore\u002Fsyft\u002Fmain\u002Finstall.sh | sh -s -- -b \u002Fusr\u002Flocal\u002Fbin\n  curl -sSfL https:\u002F\u002Fraw.githubusercontent.com\u002Fanchore\u002Fgrype\u002Fmain\u002Finstall.sh | sh -s -- -b \u002Fusr\u002Flocal\u002Fbin\n  ```\n- Install Cosign for signing\u002Fattestation:\n  ```bash\n  # via Go, or download a release from https:\u002F\u002Fgithub.com\u002Fsigstore\u002Fcosign\u002Freleases\n  go install github.com\u002Fsigstore\u002Fcosign\u002Fv2\u002Fcmd\u002Fcosign@latest\n  ```\n- Access to the target images\u002Fsource and (for signing) a registry plus keys or keyless OIDC.\n\n## Objectives\n\n- Generate CycloneDX and SPDX SBOMs from images and directories.\n- Scan SBOMs and images for vulnerabilities with Grype.\n- Gate CI\u002FCD builds on severity thresholds.\n- Sign and attach SBOM attestations with Cosign and verify them.\n\n## MITRE ATT&CK Mapping\n\n| ID | Official Technique Name | Relevance to this skill |\n|----|------------------------|--------------------------|\n| T1195.001 | Supply Chain Compromise: Compromise Software Dependencies and Development Tools | SBOM generation and vulnerability correlation expose compromised or vulnerable dependencies — the attack surface adversaries abuse under this technique. |\n\nThis is a defensive supply-chain skill; the mapping reflects the adversary technique it is designed to detect and mitigate.\n\n## Workflow\n\n### 1. Generate a CycloneDX SBOM from a container image\n`-o \u003Cformat>` selects output; `cyclonedx-json` is security-oriented.\n```bash\nsyft alpine:latest -o cyclonedx-json=alpine.cdx.json\n```\n\n### 2. Generate an SPDX SBOM from a source directory\nUse the `dir:` source to inventory a checked-out repository; `spdx-json` for the SPDX standard.\n```bash\nsyft dir:. -o spdx-json=app.spdx.json\n```\n\n### 3. Emit multiple formats at once\nProduce both standards in a single pass for different consumers.\n```bash\nsyft myorg\u002Fapp:1.4.2 \\\n  -o cyclonedx-json=app.cdx.json \\\n  -o spdx-json=app.spdx.json \\\n  -o table\n```\n\n### 4. Scan the SBOM for vulnerabilities with Grype\nDecoupling generation from scanning lets you re-scan stored SBOMs as new CVEs land — without rebuilding.\n```bash\n# Scan an existing SBOM\ngrype sbom:app.cdx.json -o table\n\n# JSON report for automation\ngrype sbom:app.cdx.json -o json > app.vulns.json\n```\nYou can also scan an image directly (Grype generates the SBOM internally):\n```bash\ngrype myorg\u002Fapp:1.4.2 -o table\n```\n\n### 5. Gate CI\u002FCD on severity\n`--fail-on` exits non-zero at or above a severity, failing the pipeline.\n```bash\ngrype sbom:app.cdx.json --fail-on high\n```\nFilter out unfixable noise with a `.grype.yaml` policy (`only-fixed: true`) or `--only-fixed`:\n```bash\ngrype sbom:app.cdx.json --only-fixed --fail-on critical\n```\n\n### 6. Sign and attach the SBOM as an attestation\nCosign records the SBOM as a signed, in-toto attestation alongside the image in the registry.\n```bash\n# Key-based signing\ncosign attest --key cosign.key \\\n  --predicate app.spdx.json \\\n  --type spdxjson \\\n  myorg\u002Fapp:1.4.2\n\n# Keyless (Sigstore OIDC \u002F Fulcio + Rekor)\nCOSIGN_EXPERIMENTAL=1 cosign attest \\\n  --predicate app.cdx.json \\\n  --type cyclonedx \\\n  myorg\u002Fapp:1.4.2\n```\n\n### 7. Verify the attestation downstream\nConsumers verify provenance before trusting an image.\n```bash\ncosign verify-attestation --key cosign.pub --type spdxjson myorg\u002Fapp:1.4.2\n```\n\n### 8. Retrieve and re-scan attached SBOMs\nPull the attested SBOM from the registry and re-run Grype as part of continuous monitoring.\n```bash\ncosign download attestation myorg\u002Fapp:1.4.2 \\\n  | jq -r '.payload' | base64 -d | jq '.predicate' > pulled.spdx.json\ngrype sbom:pulled.spdx.json -o table\n```\n\n### 9. Correlate to vulnerability intelligence\nFeed Grype JSON into your vulnerability management workflow: deduplicate by CVE, enrich with EPSS\u002FKEV for prioritization, and track remediation SLAs. Re-scan stored SBOMs on each Grype DB update to catch newly disclosed CVEs in unchanged artifacts.\n\n## Tools and Resources\n\n| Tool | Purpose | Link |\n|------|---------|------|\n| Syft | SBOM generation | https:\u002F\u002Fgithub.com\u002Fanchore\u002Fsyft |\n| Grype | Vulnerability scanning of SBOMs\u002Fimages | https:\u002F\u002Fgithub.com\u002Fanchore\u002Fgrype |\n| Cosign | SBOM signing\u002Fattestation | https:\u002F\u002Fgithub.com\u002Fsigstore\u002Fcosign |\n| CycloneDX | Security-focused SBOM standard | https:\u002F\u002Fcyclonedx.org\u002F |\n| SPDX | ISO SBOM standard | https:\u002F\u002Fspdx.dev\u002F |\n| CISA SBOM | Guidance and minimum elements | https:\u002F\u002Fwww.cisa.gov\u002Fsbom |\n\n## Format Comparison\n\n| Aspect | CycloneDX | SPDX |\n|--------|-----------|------|\n| Steward | OWASP | Linux Foundation \u002F ISO 5962 |\n| Strength | Security, VEX, vulnerabilities | Licensing, provenance |\n| Common syft `-o` values | `cyclonedx-json`, `cyclonedx-xml` | `spdx-json`, `spdx` (tag-value) |\n\n## Validation Criteria\n\n- [ ] CycloneDX SBOM generated from the target image\n- [ ] SPDX SBOM generated from source where required\n- [ ] SBOM scanned with Grype producing a CVE report\n- [ ] CI\u002FCD gated with `--fail-on` at an agreed severity\n- [ ] SBOM signed and attached as an attestation with Cosign\n- [ ] Attestation verified downstream\n- [ ] Stored SBOMs re-scanned on Grype DB updates\n- [ ] Findings correlated\u002Fprioritized (EPSS\u002FKEV) and tracked to remediation\n","# Generating and Analyzing SBOMs\n\n> **Authorized Use Only:** Generate and scan SBOMs only for software and images you own or are authorized to assess. Treat SBOMs as sensitive inventory data — they reveal your dependency attack surface.\n\n## Overview\n\nA Software Bill of Materials (SBOM) is a formal, machine-readable inventory of every component, library, and dependency in a piece of software — the supply-chain equivalent of an ingredients label. SBOMs are central to defending against supply-chain compromise (CISA's SBOM initiative, US Executive Order 14028) because you cannot patch what you cannot see. The two dominant SBOM standards are:\n\n- **CycloneDX** — an OWASP standard optimized for security use cases (vulnerabilities, VEX, dependency relationships).\n- **SPDX** — a Linux Foundation \u002F ISO standard (ISO\u002FIEC 5962) strong on licensing and provenance.\n\nThe reference open-source toolchain is from Anchore:\n\n- **Syft** generates SBOMs (CycloneDX, SPDX, or its native format) from container images and filesystems.\n- **Grype** matches an SBOM (or image) against vulnerability databases to find CVEs.\n- **Cosign** (Sigstore) signs SBOMs and attaches them to images as signed attestations for tamper-evident provenance.\n\nThis skill covers producing standards-compliant SBOMs, correlating them with vulnerability intelligence, and embedding the workflow into CI\u002FCD.\n\n## When to Use\n\n- Establishing and maintaining a component inventory for applications and container images.\n- Continuously detecting known vulnerabilities (including newly disclosed CVEs against existing artifacts).\n- Satisfying procurement\u002Fregulatory SBOM requirements (CISA, EO 14028).\n- Producing signed SBOM attestations for downstream supply-chain trust.\n\n## Prerequisites\n\n- Install Syft and Grype (official install scripts):\n  ```bash\n  curl -sSfL https:\u002F\u002Fraw.githubusercontent.com\u002Fanchore\u002Fsyft\u002Fmain\u002Finstall.sh | sh -s -- -b \u002Fusr\u002Flocal\u002Fbin\n  curl -sSfL https:\u002F\u002Fraw.githubusercontent.com\u002Fanchore\u002Fgrype\u002Fmain\u002Finstall.sh | sh -s -- -b \u002Fusr\u002Flocal\u002Fbin\n  ```\n- Install Cosign for signing\u002Fattestation:\n  ```bash\n  # via Go, or download a release from https:\u002F\u002Fgithub.com\u002Fsigstore\u002Fcosign\u002Freleases\n  go install github.com\u002Fsigstore\u002Fcosign\u002Fv2\u002Fcmd\u002Fcosign@latest\n  ```\n- Access to the target images\u002Fsource and (for signing) a registry plus keys or keyless OIDC.\n\n## Objectives\n\n- Generate CycloneDX and SPDX SBOMs from images and directories.\n- Scan SBOMs and images for vulnerabilities with Grype.\n- Gate CI\u002FCD builds on severity thresholds.\n- Sign and attach SBOM attestations with Cosign and verify them.\n\n## MITRE ATT&CK Mapping\n\n| ID | Official Technique Name | Relevance to this skill |\n|----|------------------------|--------------------------|\n| T1195.001 | Supply Chain Compromise: Compromise Software Dependencies and Development Tools | SBOM generation and vulnerability correlation expose compromised or vulnerable dependencies — the attack surface adversaries abuse under this technique. |\n\nThis is a defensive supply-chain skill; the mapping reflects the adversary technique it is designed to detect and mitigate.\n\n## Workflow\n\n### 1. Generate a CycloneDX SBOM from a container image\n`-o \u003Cformat>` selects output; `cyclonedx-json` is security-oriented.\n```bash\nsyft alpine:latest -o cyclonedx-json=alpine.cdx.json\n```\n\n### 2. Generate an SPDX SBOM from a source directory\nUse the `dir:` source to inventory a checked-out repository; `spdx-json` for the SPDX standard.\n```bash\nsyft dir:. -o spdx-json=app.spdx.json\n```\n\n### 3. Emit multiple formats at once\nProduce both standards in a single pass for different consumers.\n```bash\nsyft myorg\u002Fapp:1.4.2 \\\n  -o cyclonedx-json=app.cdx.json \\\n  -o spdx-json=app.spdx.json \\\n  -o table\n```\n\n### 4. Scan the SBOM for vulnerabilities with Grype\nDecoupling generation from scanning lets you re-scan stored SBOMs as new CVEs land — without rebuilding.\n```bash\n# Scan an existing SBOM\ngrype sbom:app.cdx.json -o table\n\n# JSON report for automation\ngrype sbom:app.cdx.json -o json > app.vulns.json\n```\nYou can also scan an image directly (Grype generates the SBOM internally):\n```bash\ngrype myorg\u002Fapp:1.4.2 -o table\n```\n\n### 5. Gate CI\u002FCD on severity\n`--fail-on` exits non-zero at or above a severity, failing the pipeline.\n```bash\ngrype sbom:app.cdx.json --fail-on high\n```\nFilter out unfixable noise with a `.grype.yaml` policy (`only-fixed: true`) or `--only-fixed`:\n```bash\ngrype sbom:app.cdx.json --only-fixed --fail-on critical\n```\n\n### 6. Sign and attach the SBOM as an attestation\nCosign records the SBOM as a signed, in-toto attestation alongside the image in the registry.\n```bash\n# Key-based signing\ncosign attest --key cosign.key \\\n  --predicate app.spdx.json \\\n  --type spdxjson \\\n  myorg\u002Fapp:1.4.2\n\n# Keyless (Sigstore OIDC \u002F Fulcio + Rekor)\nCOSIGN_EXPERIMENTAL=1 cosign attest \\\n  --predicate app.cdx.json \\\n  --type cyclonedx \\\n  myorg\u002Fapp:1.4.2\n```\n\n### 7. Verify the attestation downstream\nConsumers verify provenance before trusting an image.\n```bash\ncosign verify-attestation --key cosign.pub --type spdxjson myorg\u002Fapp:1.4.2\n```\n\n### 8. Retrieve and re-scan attached SBOMs\nPull the attested SBOM from the registry and re-run Grype as part of continuous monitoring.\n```bash\ncosign download attestation myorg\u002Fapp:1.4.2 \\\n  | jq -r '.payload' | base64 -d | jq '.predicate' > pulled.spdx.json\ngrype sbom:pulled.spdx.json -o table\n```\n\n### 9. Correlate to vulnerability intelligence\nFeed Grype JSON into your vulnerability management workflow: deduplicate by CVE, enrich with EPSS\u002FKEV for prioritization, and track remediation SLAs. Re-scan stored SBOMs on each Grype DB update to catch newly disclosed CVEs in unchanged artifacts.\n\n## Tools and Resources\n\n| Tool | Purpose | Link |\n|------|---------|------|\n| Syft | SBOM generation | https:\u002F\u002Fgithub.com\u002Fanchore\u002Fsyft |\n| Grype | Vulnerability scanning of SBOMs\u002Fimages | https:\u002F\u002Fgithub.com\u002Fanchore\u002Fgrype |\n| Cosign | SBOM signing\u002Fattestation | https:\u002F\u002Fgithub.com\u002Fsigstore\u002Fcosign |\n| CycloneDX | Security-focused SBOM standard | https:\u002F\u002Fcyclonedx.org\u002F |\n| SPDX | ISO SBOM standard | https:\u002F\u002Fspdx.dev\u002F |\n| CISA SBOM | Guidance and minimum elements | https:\u002F\u002Fwww.cisa.gov\u002Fsbom |\n\n## Format Comparison\n\n| Aspect | CycloneDX | SPDX |\n|--------|-----------|------|\n| Steward | OWASP | Linux Foundation \u002F ISO 5962 |\n| Strength | Security, VEX, vulnerabilities | Licensing, provenance |\n| Common syft `-o` values | `cyclonedx-json`, `cyclonedx-xml` | `spdx-json`, `spdx` (tag-value) |\n\n## Validation Criteria\n\n- [ ] CycloneDX SBOM generated from the target image\n- [ ] SPDX SBOM generated from source where required\n- [ ] SBOM scanned with Grype producing a CVE report\n- [ ] CI\u002FCD gated with `--fail-on` at an agreed severity\n- [ ] SBOM signed and attached as an attestation with Cosign\n- [ ] Attestation verified downstream\n- [ ] Stored SBOMs re-scanned on Grype DB updates\n- [ ] Findings correlated\u002Fprioritized (EPSS\u002FKEV) and tracked to remediation\n",{"name":5,"tags":51,"author":55,"domain":44,"license":15,"version":56,"nist_csf":57,"subdomain":31,"description":7,"mitre_attack":59},[31,52,53,54,34,33,32,38],"sbom","cyclonedx","spdx","mahipal","1.0",[58],"ID.AM-08",[60],"T1195.001","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fgenerating-and-analyzing-sboms",4384,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":72,"prompt":82,"zipAvailable":83},[73,76,79],{"tool":74,"command":75},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill generating-and-analyzing-sboms",{"tool":77,"command":78},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill generating-and-analyzing-sboms",{"tool":80,"command":81},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill generating-and-analyzing-sboms","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fgenerating-and-analyzing-sboms\u002FSKILL.md",true,[85,90,96,100],{"path":86,"resourceType":86,"resourceTypeDesc":87,"sizeBytes":88,"sourceHtmlUrl":89},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fgenerating-and-analyzing-sboms\u002FLICENSE",{"path":91,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":94,"sourceHtmlUrl":95},"references\u002Fapi-reference.md","REFERENCE","参考文档",2393,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fgenerating-and-analyzing-sboms\u002Freferences\u002Fapi-reference.md",{"path":97,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":98,"sourceHtmlUrl":99},"references\u002Fstandards.md",1430,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fgenerating-and-analyzing-sboms\u002Freferences\u002Fstandards.md",{"path":101,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":104,"sourceHtmlUrl":105},"scripts\u002Fagent.py","SCRIPT","脚本",5466,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fgenerating-and-analyzing-sboms\u002Fscripts\u002Fagent.py",[107,130,154,182,208,232],{"skillNo":108,"name":109,"nameZh":6,"description":110,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":111,"categories":112,"keywords":114,"publishedAt":46},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[113],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[115,116,117,118,45,44,119,120,121,122,123,39,35,124,31,125,126,127,128,129],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","pr","code","artifacts","pipeline","t1195","attestation","code-signing","cosign","keyless",{"skillNo":131,"name":132,"nameZh":6,"description":133,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":134,"categories":135,"keywords":137,"publishedAt":46},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[136],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[138,126,139,140,45,141,44,121,142,143,144,145,146,147,148,149,150,151,152,153],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":155,"name":156,"nameZh":6,"description":157,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":158,"categories":159,"keywords":164,"publishedAt":46},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[160,163],{"categoryNo":161,"categoryName":162,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[148,165,166,167,168,44,169,170,142,171,172,173,174,175,176,177,178,179,180,181],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":183,"name":184,"nameZh":6,"description":185,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":186,"categories":187,"keywords":189,"publishedAt":46},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[188],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[190,191,192,44,193,194,195,196,197,198,199,200,201,202,203,204,145,205,206,207],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":209,"name":210,"nameZh":6,"description":211,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":212,"categories":213,"keywords":215,"publishedAt":46},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[214],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[43,216,217,44,218,219,220,32,221,222,223,224,225,226,30,227,228,229,230,231],"framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","risk-management","nessus","qualys","openvas","cvss","remediation","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":233,"name":234,"nameZh":6,"description":235,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":236,"categories":237,"keywords":239,"publishedAt":46},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[238],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[45,240,44,241,242,243,244,245,246,247,248,177,249,178,250,251,252,253,254,255],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]