[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFP0XD22DM8FZ63XWW42Y2":3,"skill-same:01M6AFP0XD22DM8FZ63XWW42Y2":144},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":69,"commitSha":70,"skillDirectory":71,"forksCount":72,"repositoryHtmlUrl":73,"repositoryHomepageUrl":74,"ownerHtmlUrl":75,"ownerBlogUrl":76,"ownerDescription":77,"updatedAt":78,"install":79,"resources":92},"01M6AFP0XD22DM8FZ63XWW42Y2","performing-cloud-asset-inventory-with-cartography",null,"Run Cartography to sync AWS, GCP, or Azure resources into a Neo4j graph database, mapping relationships such as IAM permission chains, network paths, and cross-account trust. Use when building a cloud asset inventory, querying the graph to identify attack paths, or generating security reports across multi-cloud infrastructure.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35925,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-cloud-asset-inventory-with-cartography\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"performing cloud asset inventory with cartography","inventory","cloud","cloud-security","cartography","attack-path","cncf","t1078","iam","gcp","network","security","graph database","graph","database","run","infrastructure","pr","sync","cybersecurity","2026-11-10 10:12:30",false,"---\nname: performing-cloud-asset-inventory-with-cartography\ndescription: Run Cartography to sync AWS, GCP, or Azure resources into a Neo4j graph database,\n  mapping relationships such as IAM permission chains, network paths, and cross-account trust.\n  Use when building a cloud asset inventory, querying the graph to identify attack paths, or\n  generating security reports across multi-cloud infrastructure.\ndomain: cybersecurity\nsubdomain: cloud-security\ntags:\n- cartography\n- neo4j\n- cloud-security\n- asset-inventory\n- attack-path\n- graph-database\n- cncf\n- lyft\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.IR-01\n- ID.AM-08\n- GV.SC-06\n- DE.CM-01\nmitre_attack:\n- T1078.004\n- T1530\n- T1537\n- T1580\n---\n\n# Performing Cloud Asset Inventory with Cartography\n\n## Overview\n\nCartography is a CNCF sandbox project (originally created at Lyft) that consolidates infrastructure assets and their relationships into a Neo4j graph database. It queries cloud APIs to discover resources, maps relationships between them, and enables security teams to identify attack paths, generate asset reports, and find areas for security improvement. The graph model reveals hidden connections such as IAM permission chains, network paths, and cross-account trust relationships.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing cloud asset inventory with cartography\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Python 3.8+\n- Neo4j 4.x or 5.x database\n- Cloud provider credentials (AWS, GCP, Azure)\n- Docker (optional, for Neo4j deployment)\n- Minimum 4GB RAM for Neo4j, more for large environments\n\n## Installation\n\n```bash\n# Install Cartography\npip install cartography\n\n# Verify installation\ncartography --help\n```\n\n### Deploy Neo4j with Docker\n\n```bash\ndocker run -d \\\n  --name neo4j \\\n  -p 7474:7474 -p 7687:7687 \\\n  -e NEO4J_AUTH=neo4j\u002Fchangethispassword \\\n  -e NEO4J_PLUGINS='[\"apoc\"]' \\\n  -v neo4j_data:\u002Fdata \\\n  neo4j:5-community\n```\n\n## Running Cartography\n\n### Basic AWS Sync\n\n```bash\n# Sync AWS account data to Neo4j\ncartography \\\n  --neo4j-uri bolt:\u002F\u002Flocalhost:7687 \\\n  --neo4j-user neo4j \\\n  --neo4j-password-env-var NEO4J_PASSWORD\n```\n\n### Sync specific AWS modules\n\n```bash\ncartography \\\n  --neo4j-uri bolt:\u002F\u002Flocalhost:7687 \\\n  --neo4j-user neo4j \\\n  --neo4j-password-env-var NEO4J_PASSWORD \\\n  --aws-sync-all-profiles\n```\n\n### GCP Sync\n\n```bash\ncartography \\\n  --neo4j-uri bolt:\u002F\u002Flocalhost:7687 \\\n  --neo4j-user neo4j \\\n  --neo4j-password-env-var NEO4J_PASSWORD \\\n  --gcp-requested-syncs compute iam storage\n```\n\n## Security-Focused Cypher Queries\n\n### Find all S3 buckets with public access\n\n```cypher\nMATCH (b:S3Bucket)\nWHERE b.anonymous_access = true\n   OR b.anonymous_actions IS NOT NULL\nRETURN b.name, b.anonymous_actions, b.region, b.arn\nORDER BY b.name\n```\n\n### Identify IAM users with admin policies\n\n```cypher\nMATCH (user:AWSUser)-[:POLICY]->(policy:AWSPolicy)\nWHERE policy.name = 'AdministratorAccess'\n   OR policy.arn CONTAINS 'AdministratorAccess'\nRETURN user.name, user.arn, policy.name, user.password_last_used\n```\n\n### Find EC2 instances exposed to internet\n\n```cypher\nMATCH (instance:EC2Instance)-[:MEMBER_OF_EC2_SECURITY_GROUP]->(sg:EC2SecurityGroup)\n      -[:MEMBER_OF_EC2_SECURITY_GROUP_RULE]->(rule:IpRule)\nWHERE rule.fromport \u003C= 22 AND rule.toport >= 22\n  AND rule.protocol IN ['tcp', '-1']\n  AND '0.0.0.0\u002F0' IN rule.ipranges\nRETURN instance.instanceid, instance.publicipaddress, sg.groupid, sg.name\n```\n\n### Discover cross-account trust relationships\n\n```cypher\nMATCH (role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(principal:AWSPrincipal)\nWHERE principal.arn CONTAINS ':root'\n  AND NOT principal.arn CONTAINS role.accountid\nRETURN role.arn, role.name, principal.arn AS trusted_account\nORDER BY role.name\n```\n\n### Find attack path from public EC2 to sensitive S3\n\n```cypher\nMATCH path = (instance:EC2Instance)-[:STS_ASSUME_ROLE_ALLOWS|MEMBER_OF_EC2_SECURITY_GROUP|\n  POLICY|INSTANCE_PROFILE*1..5]->(bucket:S3Bucket)\nWHERE instance.publicipaddress IS NOT NULL\n  AND bucket.name CONTAINS 'sensitive'\nRETURN path\nLIMIT 25\n```\n\n### Identify unused IAM roles\n\n```cypher\nMATCH (role:AWSRole)\nWHERE role.last_used IS NULL\n   OR role.last_used \u003C datetime().epochMillis - (90 * 24 * 60 * 60 * 1000)\nRETURN role.name, role.arn, role.last_used\nORDER BY role.last_used\n```\n\n### Find Lambda functions with overprivileged roles\n\n```cypher\nMATCH (func:AWSLambda)-[:STS_ASSUME_ROLE_ALLOWS]->(role:AWSRole)-[:POLICY]->(policy:AWSPolicy)\nWHERE policy.name = 'AdministratorAccess'\nRETURN func.name, func.arn, role.name, policy.name\n```\n\n### Network path analysis\n\n```cypher\nMATCH (vpc:AWSVpc)-[:RESOURCE]->(subnet:EC2Subnet)-[:MEMBER_OF_SUBNET]->(instance:EC2Instance)\nWHERE instance.publicipaddress IS NOT NULL\nRETURN vpc.id, subnet.subnetid, subnet.cidr_block, instance.instanceid,\n       instance.publicipaddress, instance.state\n```\n\n## Scheduling Regular Syncs\n\n### Cron-based sync\n\n```bash\n# Add to crontab - sync every 6 hours\n0 *\u002F6 * * * \u002Fusr\u002Flocal\u002Fbin\u002Fcartography \\\n  --neo4j-uri bolt:\u002F\u002Flocalhost:7687 \\\n  --neo4j-user neo4j \\\n  --neo4j-password-env-var NEO4J_PASSWORD \\\n  >> \u002Fvar\u002Flog\u002Fcartography\u002Fsync.log 2>&1\n```\n\n### Docker Compose deployment\n\n```yaml\nversion: '3.8'\nservices:\n  neo4j:\n    image: neo4j:5-community\n    ports:\n      - \"7474:7474\"\n      - \"7687:7687\"\n    environment:\n      NEO4J_AUTH: neo4j\u002Fsecurepwd123\n      NEO4J_PLUGINS: '[\"apoc\"]'\n      NEO4J_dbms_memory_heap_max__size: 4G\n    volumes:\n      - neo4j_data:\u002Fdata\n\n  cartography:\n    image: ghcr.io\u002Fcartography-cncf\u002Fcartography:latest\n    depends_on:\n      - neo4j\n    environment:\n      NEO4J_PASSWORD: securepwd123\n      AWS_DEFAULT_REGION: us-east-1\n    command: >\n      --neo4j-uri bolt:\u002F\u002Fneo4j:7687\n      --neo4j-user neo4j\n      --neo4j-password-env-var NEO4J_PASSWORD\n\nvolumes:\n  neo4j_data:\n```\n\n## Data Model Overview\n\n### Key Node Types\n- `AWSAccount`, `GCPProject`, `AzureSubscription`\n- `EC2Instance`, `S3Bucket`, `RDSInstance`, `AWSLambda`\n- `AWSUser`, `AWSRole`, `AWSGroup`, `AWSPolicy`\n- `EC2SecurityGroup`, `EC2Subnet`, `AWSVpc`\n- `GCPInstance`, `GCSBucket`, `GCPRole`\n\n### Key Relationship Types\n- `RESOURCE`: Account owns resource\n- `POLICY`: Principal has policy attached\n- `STS_ASSUME_ROLE_ALLOWS`: Principal can assume role\n- `MEMBER_OF_EC2_SECURITY_GROUP`: Instance belongs to SG\n- `TRUSTS_AWS_PRINCIPAL`: Cross-account trust\n\n## References\n\n- Cartography GitHub: https:\u002F\u002Fgithub.com\u002Fcartography-cncf\u002Fcartography\n- Cartography Documentation: https:\u002F\u002Fcartography.dev\n- CNCF Sandbox Project\n- Neo4j Cypher Query Language Reference\n","# Performing Cloud Asset Inventory with Cartography\n\n## Overview\n\nCartography is a CNCF sandbox project (originally created at Lyft) that consolidates infrastructure assets and their relationships into a Neo4j graph database. It queries cloud APIs to discover resources, maps relationships between them, and enables security teams to identify attack paths, generate asset reports, and find areas for security improvement. The graph model reveals hidden connections such as IAM permission chains, network paths, and cross-account trust relationships.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing cloud asset inventory with cartography\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Python 3.8+\n- Neo4j 4.x or 5.x database\n- Cloud provider credentials (AWS, GCP, Azure)\n- Docker (optional, for Neo4j deployment)\n- Minimum 4GB RAM for Neo4j, more for large environments\n\n## Installation\n\n```bash\n# Install Cartography\npip install cartography\n\n# Verify installation\ncartography --help\n```\n\n### Deploy Neo4j with Docker\n\n```bash\ndocker run -d \\\n  --name neo4j \\\n  -p 7474:7474 -p 7687:7687 \\\n  -e NEO4J_AUTH=neo4j\u002Fchangethispassword \\\n  -e NEO4J_PLUGINS='[\"apoc\"]' \\\n  -v neo4j_data:\u002Fdata \\\n  neo4j:5-community\n```\n\n## Running Cartography\n\n### Basic AWS Sync\n\n```bash\n# Sync AWS account data to Neo4j\ncartography \\\n  --neo4j-uri bolt:\u002F\u002Flocalhost:7687 \\\n  --neo4j-user neo4j \\\n  --neo4j-password-env-var NEO4J_PASSWORD\n```\n\n### Sync specific AWS modules\n\n```bash\ncartography \\\n  --neo4j-uri bolt:\u002F\u002Flocalhost:7687 \\\n  --neo4j-user neo4j \\\n  --neo4j-password-env-var NEO4J_PASSWORD \\\n  --aws-sync-all-profiles\n```\n\n### GCP Sync\n\n```bash\ncartography \\\n  --neo4j-uri bolt:\u002F\u002Flocalhost:7687 \\\n  --neo4j-user neo4j \\\n  --neo4j-password-env-var NEO4J_PASSWORD \\\n  --gcp-requested-syncs compute iam storage\n```\n\n## Security-Focused Cypher Queries\n\n### Find all S3 buckets with public access\n\n```cypher\nMATCH (b:S3Bucket)\nWHERE b.anonymous_access = true\n   OR b.anonymous_actions IS NOT NULL\nRETURN b.name, b.anonymous_actions, b.region, b.arn\nORDER BY b.name\n```\n\n### Identify IAM users with admin policies\n\n```cypher\nMATCH (user:AWSUser)-[:POLICY]->(policy:AWSPolicy)\nWHERE policy.name = 'AdministratorAccess'\n   OR policy.arn CONTAINS 'AdministratorAccess'\nRETURN user.name, user.arn, policy.name, user.password_last_used\n```\n\n### Find EC2 instances exposed to internet\n\n```cypher\nMATCH (instance:EC2Instance)-[:MEMBER_OF_EC2_SECURITY_GROUP]->(sg:EC2SecurityGroup)\n      -[:MEMBER_OF_EC2_SECURITY_GROUP_RULE]->(rule:IpRule)\nWHERE rule.fromport \u003C= 22 AND rule.toport >= 22\n  AND rule.protocol IN ['tcp', '-1']\n  AND '0.0.0.0\u002F0' IN rule.ipranges\nRETURN instance.instanceid, instance.publicipaddress, sg.groupid, sg.name\n```\n\n### Discover cross-account trust relationships\n\n```cypher\nMATCH (role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(principal:AWSPrincipal)\nWHERE principal.arn CONTAINS ':root'\n  AND NOT principal.arn CONTAINS role.accountid\nRETURN role.arn, role.name, principal.arn AS trusted_account\nORDER BY role.name\n```\n\n### Find attack path from public EC2 to sensitive S3\n\n```cypher\nMATCH path = (instance:EC2Instance)-[:STS_ASSUME_ROLE_ALLOWS|MEMBER_OF_EC2_SECURITY_GROUP|\n  POLICY|INSTANCE_PROFILE*1..5]->(bucket:S3Bucket)\nWHERE instance.publicipaddress IS NOT NULL\n  AND bucket.name CONTAINS 'sensitive'\nRETURN path\nLIMIT 25\n```\n\n### Identify unused IAM roles\n\n```cypher\nMATCH (role:AWSRole)\nWHERE role.last_used IS NULL\n   OR role.last_used \u003C datetime().epochMillis - (90 * 24 * 60 * 60 * 1000)\nRETURN role.name, role.arn, role.last_used\nORDER BY role.last_used\n```\n\n### Find Lambda functions with overprivileged roles\n\n```cypher\nMATCH (func:AWSLambda)-[:STS_ASSUME_ROLE_ALLOWS]->(role:AWSRole)-[:POLICY]->(policy:AWSPolicy)\nWHERE policy.name = 'AdministratorAccess'\nRETURN func.name, func.arn, role.name, policy.name\n```\n\n### Network path analysis\n\n```cypher\nMATCH (vpc:AWSVpc)-[:RESOURCE]->(subnet:EC2Subnet)-[:MEMBER_OF_SUBNET]->(instance:EC2Instance)\nWHERE instance.publicipaddress IS NOT NULL\nRETURN vpc.id, subnet.subnetid, subnet.cidr_block, instance.instanceid,\n       instance.publicipaddress, instance.state\n```\n\n## Scheduling Regular Syncs\n\n### Cron-based sync\n\n```bash\n# Add to crontab - sync every 6 hours\n0 *\u002F6 * * * \u002Fusr\u002Flocal\u002Fbin\u002Fcartography \\\n  --neo4j-uri bolt:\u002F\u002Flocalhost:7687 \\\n  --neo4j-user neo4j \\\n  --neo4j-password-env-var NEO4J_PASSWORD \\\n  >> \u002Fvar\u002Flog\u002Fcartography\u002Fsync.log 2>&1\n```\n\n### Docker Compose deployment\n\n```yaml\nversion: '3.8'\nservices:\n  neo4j:\n    image: neo4j:5-community\n    ports:\n      - \"7474:7474\"\n      - \"7687:7687\"\n    environment:\n      NEO4J_AUTH: neo4j\u002Fsecurepwd123\n      NEO4J_PLUGINS: '[\"apoc\"]'\n      NEO4J_dbms_memory_heap_max__size: 4G\n    volumes:\n      - neo4j_data:\u002Fdata\n\n  cartography:\n    image: ghcr.io\u002Fcartography-cncf\u002Fcartography:latest\n    depends_on:\n      - neo4j\n    environment:\n      NEO4J_PASSWORD: securepwd123\n      AWS_DEFAULT_REGION: us-east-1\n    command: >\n      --neo4j-uri bolt:\u002F\u002Fneo4j:7687\n      --neo4j-user neo4j\n      --neo4j-password-env-var NEO4J_PASSWORD\n\nvolumes:\n  neo4j_data:\n```\n\n## Data Model Overview\n\n### Key Node Types\n- `AWSAccount`, `GCPProject`, `AzureSubscription`\n- `EC2Instance`, `S3Bucket`, `RDSInstance`, `AWSLambda`\n- `AWSUser`, `AWSRole`, `AWSGroup`, `AWSPolicy`\n- `EC2SecurityGroup`, `EC2Subnet`, `AWSVpc`\n- `GCPInstance`, `GCSBucket`, `GCPRole`\n\n### Key Relationship Types\n- `RESOURCE`: Account owns resource\n- `POLICY`: Principal has policy attached\n- `STS_ASSUME_ROLE_ALLOWS`: Principal can assume role\n- `MEMBER_OF_EC2_SECURITY_GROUP`: Instance belongs to SG\n- `TRUSTS_AWS_PRINCIPAL`: Cross-account trust\n\n## References\n\n- Cartography GitHub: https:\u002F\u002Fgithub.com\u002Fcartography-cncf\u002Fcartography\n- Cartography Documentation: https:\u002F\u002Fcartography.dev\n- CNCF Sandbox Project\n- Neo4j Cypher Query Language Reference\n",{"name":5,"tags":52,"author":57,"domain":46,"license":15,"version":58,"nist_csf":59,"subdomain":30,"description":7,"mitre_attack":64},[31,53,30,54,32,55,33,56],"neo4j","asset-inventory","graph-database","lyft","mahipal","1.0",[60,61,62,63],"PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01",[65,66,67,68],"T1078.004","T1530","T1537","T1580","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-cloud-asset-inventory-with-cartography",4384,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":80,"prompt":90,"zipAvailable":91},[81,84,87],{"tool":82,"command":83},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-cloud-asset-inventory-with-cartography",{"tool":85,"command":86},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-cloud-asset-inventory-with-cartography",{"tool":88,"command":89},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-cloud-asset-inventory-with-cartography","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-cloud-asset-inventory-with-cartography\u002FSKILL.md",true,[93,99,104,108,114,118,122,128,132,136,140],{"path":94,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":97,"sourceHtmlUrl":98},"assets\u002Ftemplate.md","ASSET","资产文件",617,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-cloud-asset-inventory-with-cartography\u002Fassets\u002Ftemplate.md",{"path":100,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":102,"sourceHtmlUrl":103},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-cloud-asset-inventory-with-cartography\u002FLICENSE",{"path":105,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":106,"sourceHtmlUrl":107},"LICENSE.txt",11345,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Futilities\u002Fweb-artifacts-builder\u002FLICENSE.txt",{"path":109,"resourceType":110,"resourceTypeDesc":111,"sizeBytes":112,"sourceHtmlUrl":113},"references\u002Fapi-reference.md","REFERENCE","参考文档",5064,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-cloud-asset-inventory-with-cartography\u002Freferences\u002Fapi-reference.md",{"path":115,"resourceType":110,"resourceTypeDesc":111,"sizeBytes":116,"sourceHtmlUrl":117},"references\u002Fstandards.md",527,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-cloud-asset-inventory-with-cartography\u002Freferences\u002Fstandards.md",{"path":119,"resourceType":110,"resourceTypeDesc":111,"sizeBytes":120,"sourceHtmlUrl":121},"references\u002Fworkflows.md",820,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-cloud-asset-inventory-with-cartography\u002Freferences\u002Fworkflows.md",{"path":123,"resourceType":124,"resourceTypeDesc":125,"sizeBytes":126,"sourceHtmlUrl":127},"scripts\u002Fagent.py","SCRIPT","脚本",8531,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-cloud-asset-inventory-with-cartography\u002Fscripts\u002Fagent.py",{"path":129,"resourceType":124,"resourceTypeDesc":125,"sizeBytes":130,"sourceHtmlUrl":131},"scripts\u002Fbundle-artifact.sh",1517,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Futilities\u002Fweb-artifacts-builder\u002Fscripts\u002Fbundle-artifact.sh",{"path":133,"resourceType":124,"resourceTypeDesc":125,"sizeBytes":134,"sourceHtmlUrl":135},"scripts\u002Finit-artifact.sh",9924,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Futilities\u002Fweb-artifacts-builder\u002Fscripts\u002Finit-artifact.sh",{"path":137,"resourceType":124,"resourceTypeDesc":125,"sizeBytes":138,"sourceHtmlUrl":139},"scripts\u002Fprocess.py",6298,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-cloud-asset-inventory-with-cartography\u002Fscripts\u002Fprocess.py",{"path":141,"resourceType":124,"resourceTypeDesc":125,"sizeBytes":142,"sourceHtmlUrl":143},"scripts\u002Fshadcn-components.tar.gz",19967,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Futilities\u002Fweb-artifacts-builder\u002Fscripts\u002Fshadcn-components.tar.gz",[145,172,196,222,248,275],{"skillNo":146,"name":147,"nameZh":6,"description":148,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":149,"categories":150,"keywords":154,"publishedAt":47},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[151],{"categoryNo":152,"categoryName":153,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[155,156,157,158,38,46,159,160,44,161,162,163,164,165,166,167,168,169,170,171],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":173,"name":174,"nameZh":6,"description":175,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":176,"categories":177,"keywords":179,"publishedAt":47},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[178],{"categoryNo":152,"categoryName":153,"taxonomyType":21,"taxonomyTypeDesc":22},[180,168,181,182,38,183,46,44,184,185,186,187,188,189,190,191,192,193,194,195],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":197,"name":198,"nameZh":6,"description":199,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":200,"categories":201,"keywords":206,"publishedAt":47},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[202,205],{"categoryNo":203,"categoryName":204,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":152,"categoryName":153,"taxonomyType":21,"taxonomyTypeDesc":22},[190,207,208,209,210,46,43,211,184,212,213,214,215,216,217,34,218,219,220,221],"backup","recovery","validating backup integrity for recovery","testing","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":223,"name":224,"nameZh":6,"description":225,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":226,"categories":227,"keywords":229,"publishedAt":47},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[228],{"categoryNo":152,"categoryName":153,"taxonomyType":21,"taxonomyTypeDesc":22},[230,231,232,46,233,234,235,236,237,238,239,240,241,242,243,244,187,245,246,247],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":249,"name":250,"nameZh":6,"description":251,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":252,"categories":253,"keywords":255,"publishedAt":47},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[254],{"categoryNo":152,"categoryName":153,"taxonomyType":21,"taxonomyTypeDesc":22},[256,257,258,46,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":276,"name":277,"nameZh":6,"description":278,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":279,"categories":280,"keywords":282,"publishedAt":47},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[281],{"categoryNo":152,"categoryName":153,"taxonomyType":21,"taxonomyTypeDesc":22},[38,283,46,284,285,286,287,288,289,290,291,34,292,218,293,294,295,296,297,298],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]