[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFS29R6BXFBMCAB5YBYPPS":3,"skill-same:01M6AFS29R6BXFBMCAB5YBYPPS":227},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":43,"linkOnly":44,"markdownContent":45,"markdownBody":46,"frontMatter":47,"refName":64,"commitSha":65,"skillDirectory":66,"forksCount":67,"repositoryHtmlUrl":68,"repositoryHomepageUrl":69,"ownerHtmlUrl":70,"ownerBlogUrl":71,"ownerDescription":72,"updatedAt":73,"install":74,"resources":87},"01M6AFS29R6BXFBMCAB5YBYPPS","performing-endpoint-vulnerability-remediation",null,"Performs vulnerability remediation on endpoints by prioritizing CVEs based on risk scoring, deploying patches, applying configuration changes, and validating fixes. Use when remediating findings from vulnerability scans, responding to critical CVE advisories, or maintaining endpoint compliance with patch management SLAs. Activates for requests involving vulnerability remediation, CVE patching, endpoint vulnerability management, or security fix deployment.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-endpoint-vulnerability-remediation\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42],"performing endpoint vulnerability remediation","endpoint","remediation","vulnerability-management","patching","t1547","risk","t1059","t1055","cvss","security","endpoint-security","compliance","vulnerability management","cve","deployment","pr","risk scoring","cybersecurity","2026-11-10 10:12:30",false,"---\nname: performing-endpoint-vulnerability-remediation\ndescription: 'Performs vulnerability remediation on endpoints by prioritizing CVEs\n  based on risk scoring, deploying patches, applying configuration changes, and validating\n  fixes. Use when remediating findings from vulnerability scans, responding to critical\n  CVE advisories, or maintaining endpoint compliance with patch management SLAs. Activates\n  for requests involving vulnerability remediation, CVE patching, endpoint vulnerability\n  management, or security fix deployment.\n\n  '\ndomain: cybersecurity\nsubdomain: endpoint-security\ntags:\n- endpoint\n- vulnerability-management\n- patching\n- CVE\n- remediation\n- CVSS\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- PR.PS-02\n- DE.CM-01\n- PR.IR-01\nmitre_attack:\n- T1055\n- T1547\n- T1059\n- T1036\n---\n# Performing Endpoint Vulnerability Remediation\n\n## When to Use\n\nUse this skill when:\n- Remediating vulnerabilities identified by scanners (Nessus, Qualys, Rapid7)\n- Responding to zero-day CVE advisories requiring immediate patching\n- Maintaining compliance with patch management SLAs (critical within 14 days, high within 30 days)\n- Building a prioritized remediation plan from vulnerability scan results\n\n**Do not use** this skill for vulnerability scanning itself (use scanning tools) or for application-layer vulnerability remediation (use DevSecOps processes).\n\n## Prerequisites\n\n- Vulnerability scan results (Nessus, Qualys, or Rapid7 export in CSV\u002FXML format)\n- Patch management platform (WSUS, SCCM, Intune, or third-party like Automox)\n- Administrative access to target endpoints or deployment infrastructure\n- Change management process for production endpoint patching\n- Testing environment for patch validation before production rollout\n\n## Workflow\n\n### Step 1: Import and Prioritize Vulnerability Findings\n\n```\nPriority scoring combines:\n1. CVSS Base Score (0-10)\n2. EPSS (Exploit Prediction Scoring System) - probability of exploitation\n3. CISA KEV (Known Exploited Vulnerabilities) catalog membership\n4. Asset criticality (business impact of affected endpoint)\n5. Network exposure (internet-facing vs. internal)\n\nPriority Matrix:\n  P1 (Critical - 14 days SLA):\n    - CVSS >= 9.0 OR\n    - Listed in CISA KEV OR\n    - Active exploitation in the wild + CVSS >= 7.0\n\n  P2 (High - 30 days SLA):\n    - CVSS 7.0-8.9 AND\n    - EPSS > 0.5 (50% probability of exploitation)\n\n  P3 (Medium - 60 days SLA):\n    - CVSS 4.0-6.9 OR\n    - CVSS 7.0-8.9 with EPSS \u003C 0.1\n\n  P4 (Low - 90 days SLA):\n    - CVSS \u003C 4.0 AND\n    - No known exploit\n```\n\n### Step 2: Identify Remediation Actions\n\nFor each vulnerability, determine the appropriate remediation:\n\n```\nRemediation Types:\n1. Patch: Apply vendor security update (most common)\n2. Configuration change: Modify settings to mitigate (registry, GPO)\n3. Upgrade: Update to newer software version\n4. Workaround: Apply temporary mitigation when patch unavailable\n5. Compensating control: Network segmentation, WAF rule, EDR rule\n6. Accept risk: Document accepted risk with CISO sign-off\n```\n\n### Step 3: Deploy Patches via WSUS\u002FSCCM\n\n```powershell\n# WSUS: Approve patches for deployment\n# 1. Open WSUS Console\n# 2. Navigate to Updates → Security Updates\n# 3. Approve selected KBs for target computer groups\n\n# SCCM: Create Software Update Group\n# 1. Software Library → Software Updates → All Software Updates\n# 2. Select required KBs → Create Software Update Group\n# 3. Deploy to target collection with maintenance window\n\n# Intune: Create Windows Update Ring\n# Devices → Windows → Update rings\n# Configure: Quality updates deferral = 0 days (for critical)\n# Feature updates deferral = per policy\n\n# PowerShell: Force Windows Update check\nInstall-Module PSWindowsUpdate -Force\nGet-WindowsUpdate -KBArticleID \"KB5034441\" -Install -AcceptAll -AutoReboot\n\n# Verify patch installation\nGet-HotFix -Id \"KB5034441\"\nsysteminfo | findstr \"KB5034441\"\n```\n\n### Step 4: Apply Configuration-Based Remediations\n\n```powershell\n# Example: Disable SMBv1 (CVE-2017-0144 - EternalBlue)\nSet-SmbServerConfiguration -EnableSMB1Protocol $false -Force\nDisable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart\n\n# Example: Disable Print Spooler on non-print servers (CVE-2021-34527 - PrintNightmare)\nStop-Service -Name Spooler -Force\nSet-Service -Name Spooler -StartupType Disabled\n\n# Example: Disable LLMNR (credential theft mitigation)\n# Via GPO: Computer Configuration → Admin Templates → Network → DNS Client\n# Turn off multicast name resolution: Enabled\nNew-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\DNSClient\" `\n  -Name EnableMulticast -Value 0 -PropertyType DWORD -Force\n\n# Example: Restrict NTLM authentication\n# Via GPO: Security Settings → Local Policies → Security Options\n# Network security: Restrict NTLM: Audit\u002FDeny\n```\n\n### Step 5: Handle Zero-Day Vulnerabilities (No Patch Available)\n\n```\nWhen vendor patch is not yet available:\n\n1. Check vendor advisory for workarounds\n   - Microsoft: https:\u002F\u002Fmsrc.microsoft.com\u002Fupdate-guide\n   - Adobe: https:\u002F\u002Fhelpx.adobe.com\u002Fsecurity.html\n   - Linux: Distribution security trackers\n\n2. Apply temporary mitigations:\n   - Disable vulnerable feature\u002Fservice\n   - Deploy EDR detection rule for exploitation attempt\n   - Apply network-level blocking (WAF\u002Ffirewall rules)\n   - Restrict access to vulnerable application\n\n3. Monitor for patch release:\n   - Subscribe to vendor security mailing list\n   - Monitor CISA KEV additions\n   - Set calendar reminder for next Patch Tuesday\n\n4. Document workaround with expiration date\n```\n\n### Step 6: Validate Remediation\n\n```powershell\n# Re-scan remediated endpoints to confirm vulnerability closure\n# Option 1: Targeted vulnerability scan\nnessuscli scan --target 192.168.1.0\u002F24 --plugin-id 12345\n\n# Option 2: PowerShell verification\n# Check specific KB is installed\n$kb = Get-HotFix -Id \"KB5034441\" -ErrorAction SilentlyContinue\nif ($kb) {\n    Write-Host \"PASS: KB5034441 installed on $(hostname)\" -ForegroundColor Green\n} else {\n    Write-Host \"FAIL: KB5034441 missing on $(hostname)\" -ForegroundColor Red\n}\n\n# Check service is disabled\n$svc = Get-Service -Name Spooler\nif ($svc.StartType -eq 'Disabled') {\n    Write-Host \"PASS: Print Spooler disabled\" -ForegroundColor Green\n}\n\n# Check registry configuration\n$val = Get-ItemProperty -Path \"HKLM:\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters\" `\n  -Name SMB1 -ErrorAction SilentlyContinue\nif ($val.SMB1 -eq 0) {\n    Write-Host \"PASS: SMBv1 disabled\" -ForegroundColor Green\n}\n```\n\n### Step 7: Report and Track\n\nGenerate remediation status report:\n```\nRemediation Metrics:\n  - Total vulnerabilities: X\n  - Remediated: Y (Z%)\n  - Pending (within SLA): A\n  - Overdue (past SLA): B\n  - Accepted risk: C\n  - Mean time to remediate (MTTR): D days\n  - SLA compliance rate: E%\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **CVSS** | Common Vulnerability Scoring System; 0-10 severity scale for vulnerabilities |\n| **EPSS** | Exploit Prediction Scoring System; probability (0-1) that a CVE will be exploited in the wild within 30 days |\n| **CISA KEV** | CISA Known Exploited Vulnerabilities catalog; federal mandate to patch these CVEs within specified timeframes |\n| **SLA** | Service Level Agreement for remediation timelines based on vulnerability severity |\n| **MTTR** | Mean Time To Remediate; average days from vulnerability discovery to confirmed fix |\n| **Compensating Control** | Alternative security measure when direct remediation is not feasible |\n\n## Tools & Systems\n\n- **Nessus\u002FTenable.io**: Vulnerability scanning and remediation tracking\n- **Qualys VMDR**: Vulnerability management, detection, and response platform\n- **Rapid7 InsightVM**: Vulnerability assessment with live dashboards\n- **WSUS\u002FSCCM\u002FIntune**: Microsoft patch deployment infrastructure\n- **Automox**: Cloud-native patch management for Windows, macOS, Linux\n- **CISA KEV Catalog**: https:\u002F\u002Fwww.cisa.gov\u002Fknown-exploited-vulnerabilities-catalog\n\n## Common Pitfalls\n\n- **Patching without testing**: Apply patches to a test group first. Some patches cause application compatibility issues or BSOD.\n- **Ignoring EPSS scores**: A CVSS 9.8 vulnerability with EPSS 0.01 may be less urgent than a CVSS 7.5 with EPSS 0.95 (actively exploited).\n- **Not validating remediation**: Deploying a patch does not guarantee installation. Always re-scan to confirm closure.\n- **Excluding critical servers from patching**: Servers that \"cannot be rebooted\" accumulate critical vulnerabilities. Schedule maintenance windows.\n- **Treating all CVEs equally**: Risk-based prioritization (CVSS + EPSS + asset criticality + exposure) is more effective than patching all criticals first.\n","# Performing Endpoint Vulnerability Remediation\n\n## When to Use\n\nUse this skill when:\n- Remediating vulnerabilities identified by scanners (Nessus, Qualys, Rapid7)\n- Responding to zero-day CVE advisories requiring immediate patching\n- Maintaining compliance with patch management SLAs (critical within 14 days, high within 30 days)\n- Building a prioritized remediation plan from vulnerability scan results\n\n**Do not use** this skill for vulnerability scanning itself (use scanning tools) or for application-layer vulnerability remediation (use DevSecOps processes).\n\n## Prerequisites\n\n- Vulnerability scan results (Nessus, Qualys, or Rapid7 export in CSV\u002FXML format)\n- Patch management platform (WSUS, SCCM, Intune, or third-party like Automox)\n- Administrative access to target endpoints or deployment infrastructure\n- Change management process for production endpoint patching\n- Testing environment for patch validation before production rollout\n\n## Workflow\n\n### Step 1: Import and Prioritize Vulnerability Findings\n\n```\nPriority scoring combines:\n1. CVSS Base Score (0-10)\n2. EPSS (Exploit Prediction Scoring System) - probability of exploitation\n3. CISA KEV (Known Exploited Vulnerabilities) catalog membership\n4. Asset criticality (business impact of affected endpoint)\n5. Network exposure (internet-facing vs. internal)\n\nPriority Matrix:\n  P1 (Critical - 14 days SLA):\n    - CVSS >= 9.0 OR\n    - Listed in CISA KEV OR\n    - Active exploitation in the wild + CVSS >= 7.0\n\n  P2 (High - 30 days SLA):\n    - CVSS 7.0-8.9 AND\n    - EPSS > 0.5 (50% probability of exploitation)\n\n  P3 (Medium - 60 days SLA):\n    - CVSS 4.0-6.9 OR\n    - CVSS 7.0-8.9 with EPSS \u003C 0.1\n\n  P4 (Low - 90 days SLA):\n    - CVSS \u003C 4.0 AND\n    - No known exploit\n```\n\n### Step 2: Identify Remediation Actions\n\nFor each vulnerability, determine the appropriate remediation:\n\n```\nRemediation Types:\n1. Patch: Apply vendor security update (most common)\n2. Configuration change: Modify settings to mitigate (registry, GPO)\n3. Upgrade: Update to newer software version\n4. Workaround: Apply temporary mitigation when patch unavailable\n5. Compensating control: Network segmentation, WAF rule, EDR rule\n6. Accept risk: Document accepted risk with CISO sign-off\n```\n\n### Step 3: Deploy Patches via WSUS\u002FSCCM\n\n```powershell\n# WSUS: Approve patches for deployment\n# 1. Open WSUS Console\n# 2. Navigate to Updates → Security Updates\n# 3. Approve selected KBs for target computer groups\n\n# SCCM: Create Software Update Group\n# 1. Software Library → Software Updates → All Software Updates\n# 2. Select required KBs → Create Software Update Group\n# 3. Deploy to target collection with maintenance window\n\n# Intune: Create Windows Update Ring\n# Devices → Windows → Update rings\n# Configure: Quality updates deferral = 0 days (for critical)\n# Feature updates deferral = per policy\n\n# PowerShell: Force Windows Update check\nInstall-Module PSWindowsUpdate -Force\nGet-WindowsUpdate -KBArticleID \"KB5034441\" -Install -AcceptAll -AutoReboot\n\n# Verify patch installation\nGet-HotFix -Id \"KB5034441\"\nsysteminfo | findstr \"KB5034441\"\n```\n\n### Step 4: Apply Configuration-Based Remediations\n\n```powershell\n# Example: Disable SMBv1 (CVE-2017-0144 - EternalBlue)\nSet-SmbServerConfiguration -EnableSMB1Protocol $false -Force\nDisable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart\n\n# Example: Disable Print Spooler on non-print servers (CVE-2021-34527 - PrintNightmare)\nStop-Service -Name Spooler -Force\nSet-Service -Name Spooler -StartupType Disabled\n\n# Example: Disable LLMNR (credential theft mitigation)\n# Via GPO: Computer Configuration → Admin Templates → Network → DNS Client\n# Turn off multicast name resolution: Enabled\nNew-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\DNSClient\" `\n  -Name EnableMulticast -Value 0 -PropertyType DWORD -Force\n\n# Example: Restrict NTLM authentication\n# Via GPO: Security Settings → Local Policies → Security Options\n# Network security: Restrict NTLM: Audit\u002FDeny\n```\n\n### Step 5: Handle Zero-Day Vulnerabilities (No Patch Available)\n\n```\nWhen vendor patch is not yet available:\n\n1. Check vendor advisory for workarounds\n   - Microsoft: https:\u002F\u002Fmsrc.microsoft.com\u002Fupdate-guide\n   - Adobe: https:\u002F\u002Fhelpx.adobe.com\u002Fsecurity.html\n   - Linux: Distribution security trackers\n\n2. Apply temporary mitigations:\n   - Disable vulnerable feature\u002Fservice\n   - Deploy EDR detection rule for exploitation attempt\n   - Apply network-level blocking (WAF\u002Ffirewall rules)\n   - Restrict access to vulnerable application\n\n3. Monitor for patch release:\n   - Subscribe to vendor security mailing list\n   - Monitor CISA KEV additions\n   - Set calendar reminder for next Patch Tuesday\n\n4. Document workaround with expiration date\n```\n\n### Step 6: Validate Remediation\n\n```powershell\n# Re-scan remediated endpoints to confirm vulnerability closure\n# Option 1: Targeted vulnerability scan\nnessuscli scan --target 192.168.1.0\u002F24 --plugin-id 12345\n\n# Option 2: PowerShell verification\n# Check specific KB is installed\n$kb = Get-HotFix -Id \"KB5034441\" -ErrorAction SilentlyContinue\nif ($kb) {\n    Write-Host \"PASS: KB5034441 installed on $(hostname)\" -ForegroundColor Green\n} else {\n    Write-Host \"FAIL: KB5034441 missing on $(hostname)\" -ForegroundColor Red\n}\n\n# Check service is disabled\n$svc = Get-Service -Name Spooler\nif ($svc.StartType -eq 'Disabled') {\n    Write-Host \"PASS: Print Spooler disabled\" -ForegroundColor Green\n}\n\n# Check registry configuration\n$val = Get-ItemProperty -Path \"HKLM:\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters\" `\n  -Name SMB1 -ErrorAction SilentlyContinue\nif ($val.SMB1 -eq 0) {\n    Write-Host \"PASS: SMBv1 disabled\" -ForegroundColor Green\n}\n```\n\n### Step 7: Report and Track\n\nGenerate remediation status report:\n```\nRemediation Metrics:\n  - Total vulnerabilities: X\n  - Remediated: Y (Z%)\n  - Pending (within SLA): A\n  - Overdue (past SLA): B\n  - Accepted risk: C\n  - Mean time to remediate (MTTR): D days\n  - SLA compliance rate: E%\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **CVSS** | Common Vulnerability Scoring System; 0-10 severity scale for vulnerabilities |\n| **EPSS** | Exploit Prediction Scoring System; probability (0-1) that a CVE will be exploited in the wild within 30 days |\n| **CISA KEV** | CISA Known Exploited Vulnerabilities catalog; federal mandate to patch these CVEs within specified timeframes |\n| **SLA** | Service Level Agreement for remediation timelines based on vulnerability severity |\n| **MTTR** | Mean Time To Remediate; average days from vulnerability discovery to confirmed fix |\n| **Compensating Control** | Alternative security measure when direct remediation is not feasible |\n\n## Tools & Systems\n\n- **Nessus\u002FTenable.io**: Vulnerability scanning and remediation tracking\n- **Qualys VMDR**: Vulnerability management, detection, and response platform\n- **Rapid7 InsightVM**: Vulnerability assessment with live dashboards\n- **WSUS\u002FSCCM\u002FIntune**: Microsoft patch deployment infrastructure\n- **Automox**: Cloud-native patch management for Windows, macOS, Linux\n- **CISA KEV Catalog**: https:\u002F\u002Fwww.cisa.gov\u002Fknown-exploited-vulnerabilities-catalog\n\n## Common Pitfalls\n\n- **Patching without testing**: Apply patches to a test group first. Some patches cause application compatibility issues or BSOD.\n- **Ignoring EPSS scores**: A CVSS 9.8 vulnerability with EPSS 0.01 may be less urgent than a CVSS 7.5 with EPSS 0.95 (actively exploited).\n- **Not validating remediation**: Deploying a patch does not guarantee installation. Always re-scan to confirm closure.\n- **Excluding critical servers from patching**: Servers that \"cannot be rebooted\" accumulate critical vulnerabilities. Schedule maintenance windows.\n- **Treating all CVEs equally**: Risk-based prioritization (CVSS + EPSS + asset criticality + exposure) is more effective than patching all criticals first.\n",{"name":5,"tags":48,"author":51,"domain":42,"license":15,"version":52,"nist_csf":53,"subdomain":35,"description":58,"mitre_attack":59},[25,27,28,49,26,50],"CVE","CVSS","mahipal","1.0.0",[54,55,56,57],"PR.PS-01","PR.PS-02","DE.CM-01","PR.IR-01","Performs vulnerability remediation on endpoints by prioritizing CVEs based on risk scoring, deploying patches, applying configuration changes, and validating fixes. Use when remediating findings from vulnerability scans, responding to critical CVE advisories, or maintaining endpoint compliance with patch management SLAs. Activates for requests involving vulnerability remediation, CVE patching, endpoint vulnerability management, or security fix deployment.\n",[60,61,62,63],"T1055","T1547","T1059","T1036","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-endpoint-vulnerability-remediation",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":75,"prompt":85,"zipAvailable":86},[76,79,82],{"tool":77,"command":78},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-endpoint-vulnerability-remediation",{"tool":80,"command":81},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-endpoint-vulnerability-remediation",{"tool":83,"command":84},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-endpoint-vulnerability-remediation","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-endpoint-vulnerability-remediation\u002FSKILL.md",true,[88,94,100,104,108,112,116,120,124,128,132,136,140,144,149,153,157,161,165,169,175,179,183,187,191,195,199,203,207,211,215,219,223],{"path":89,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":92,"sourceHtmlUrl":93},"assets\u002Ftemplate.md","ASSET","资产文件",1979,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-endpoint-vulnerability-remediation\u002Fassets\u002Ftemplate.md",{"path":95,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"exports\u002Fbookshelf-mobile\u002Fdesign-spec.json","REFERENCE","参考文档",19517,"https:\u002F\u002Fgithub.com\u002Finernoro\u002Fprd_agent\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fdesign-replication\u002Fexports\u002Fbookshelf-mobile\u002Fdesign-spec.json",{"path":101,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":102,"sourceHtmlUrl":103},"exports\u002Fbookshelf-mobile\u002Fdesign-spec.md",5125,"https:\u002F\u002Fgithub.com\u002Finernoro\u002Fprd_agent\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fdesign-replication\u002Fexports\u002Fbookshelf-mobile\u002Fdesign-spec.md",{"path":105,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":106,"sourceHtmlUrl":107},"exports\u002Fllmgw-collections\u002Fdesign-spec.json",2172,"https:\u002F\u002Fgithub.com\u002Finernoro\u002Fprd_agent\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fdesign-replication\u002Fexports\u002Fllmgw-collections\u002Fdesign-spec.json",{"path":109,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":110,"sourceHtmlUrl":111},"exports\u002Fllmgw-collections\u002Fdesign-spec.md",772,"https:\u002F\u002Fgithub.com\u002Finernoro\u002Fprd_agent\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fdesign-replication\u002Fexports\u002Fllmgw-collections\u002Fdesign-spec.md",{"path":113,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":114,"sourceHtmlUrl":115},"exports\u002Fvisual-model-settings-b\u002Fdesign-spec.json",16619,"https:\u002F\u002Fgithub.com\u002Finernoro\u002Fprd_agent\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fdesign-replication\u002Fexports\u002Fvisual-model-settings-b\u002Fdesign-spec.json",{"path":117,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":118,"sourceHtmlUrl":119},"exports\u002Fvisual-model-settings-b\u002Fdesign-spec.md",884,"https:\u002F\u002Fgithub.com\u002Finernoro\u002Fprd_agent\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fdesign-replication\u002Fexports\u002Fvisual-model-settings-b\u002Fdesign-spec.md",{"path":121,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":122,"sourceHtmlUrl":123},"exports\u002Fweb-hosting-v2\u002Fdesign-spec.json",63589,"https:\u002F\u002Fgithub.com\u002Finernoro\u002Fprd_agent\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fdesign-replication\u002Fexports\u002Fweb-hosting-v2\u002Fdesign-spec.json",{"path":125,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":126,"sourceHtmlUrl":127},"exports\u002Fweb-hosting-v2\u002Fdesign-spec.md",14868,"https:\u002F\u002Fgithub.com\u002Finernoro\u002Fprd_agent\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fdesign-replication\u002Fexports\u002Fweb-hosting-v2\u002Fdesign-spec.md",{"path":129,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":130,"sourceHtmlUrl":131},"fixtures\u002Fweb-hosting-v2\u002F11-reader\u002FGET__api_web-pages_shares_view_P8lZp0ruPhcM_ask_quota__siteId=23fdc27703334b95bfd88c56c2edcd35.json",371,"https:\u002F\u002Fgithub.com\u002Finernoro\u002Fprd_agent\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fdesign-replication\u002Ffixtures\u002Fweb-hosting-v2\u002F11-reader\u002FGET__api_web-pages_shares_view_P8lZp0ruPhcM_ask_quota__siteId=23fdc27703334b95bfd88c56c2edcd35.json",{"path":133,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":134,"sourceHtmlUrl":135},"fixtures\u002Fweb-hosting-v2\u002F11-reader\u002FGET__api_web-pages_shares_view_P8lZp0ruPhcM_comments.json",981,"https:\u002F\u002Fgithub.com\u002Finernoro\u002Fprd_agent\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fdesign-replication\u002Ffixtures\u002Fweb-hosting-v2\u002F11-reader\u002FGET__api_web-pages_shares_view_P8lZp0ruPhcM_comments.json",{"path":137,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":138,"sourceHtmlUrl":139},"fixtures\u002Fweb-hosting-v2\u002F11-reader\u002FGET__api_web-pages_shares_view_P8lZp0ruPhcM_content__siteId=23fdc27703334b95bfd88c56c2edcd35.json",1852,"https:\u002F\u002Fgithub.com\u002Finernoro\u002Fprd_agent\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fdesign-replication\u002Ffixtures\u002Fweb-hosting-v2\u002F11-reader\u002FGET__api_web-pages_shares_view_P8lZp0ruPhcM_content__siteId=23fdc27703334b95bfd88c56c2edcd35.json",{"path":141,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":142,"sourceHtmlUrl":143},"fixtures\u002Fweb-hosting-v2\u002F11-reader\u002FGET__api_web-pages_shares_view_P8lZp0ruPhcM.json",1343,"https:\u002F\u002Fgithub.com\u002Finernoro\u002Fprd_agent\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fdesign-replication\u002Ffixtures\u002Fweb-hosting-v2\u002F11-reader\u002FGET__api_web-pages_shares_view_P8lZp0ruPhcM.json",{"path":145,"resourceType":145,"resourceTypeDesc":146,"sizeBytes":147,"sourceHtmlUrl":148},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-endpoint-vulnerability-remediation\u002FLICENSE",{"path":150,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":151,"sourceHtmlUrl":152},"reference\u002Fadversarial-review.md",4418,"https:\u002F\u002Fgithub.com\u002Finernoro\u002Fprd_agent\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fdesign-replication\u002Freference\u002Fadversarial-review.md",{"path":154,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":155,"sourceHtmlUrl":156},"reference\u002Fdeviation-ledger.md",1289,"https:\u002F\u002Fgithub.com\u002Finernoro\u002Fprd_agent\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fdesign-replication\u002Freference\u002Fdeviation-ledger.md",{"path":158,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":159,"sourceHtmlUrl":160},"references\u002Fapi-reference.md",4457,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-endpoint-vulnerability-remediation\u002Freferences\u002Fapi-reference.md",{"path":162,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":163,"sourceHtmlUrl":164},"references\u002Fstandards.md",2619,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-endpoint-vulnerability-remediation\u002Freferences\u002Fstandards.md",{"path":166,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":167,"sourceHtmlUrl":168},"references\u002Fworkflows.md",3547,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-endpoint-vulnerability-remediation\u002Freferences\u002Fworkflows.md",{"path":170,"resourceType":171,"resourceTypeDesc":172,"sizeBytes":173,"sourceHtmlUrl":174},"scripts\u002Fagent.py","SCRIPT","脚本",4702,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-endpoint-vulnerability-remediation\u002Fscripts\u002Fagent.py",{"path":176,"resourceType":171,"resourceTypeDesc":172,"sizeBytes":177,"sourceHtmlUrl":178},"scripts\u002Faudit.mjs",6964,"https:\u002F\u002Fgithub.com\u002Finernoro\u002Fprd_agent\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fdesign-replication\u002Fscripts\u002Faudit.mjs",{"path":180,"resourceType":171,"resourceTypeDesc":172,"sizeBytes":181,"sourceHtmlUrl":182},"scripts\u002Fbrowser.mjs",2533,"https:\u002F\u002Fgithub.com\u002Finernoro\u002Fprd_agent\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fdesign-replication\u002Fscripts\u002Fbrowser.mjs",{"path":184,"resourceType":171,"resourceTypeDesc":172,"sizeBytes":185,"sourceHtmlUrl":186},"scripts\u002Fextract-design.mjs",9763,"https:\u002F\u002Fgithub.com\u002Finernoro\u002Fprd_agent\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fdesign-replication\u002Fscripts\u002Fextract-design.mjs",{"path":188,"resourceType":171,"resourceTypeDesc":172,"sizeBytes":189,"sourceHtmlUrl":190},"scripts\u002Fextract-spec.mjs",16835,"https:\u002F\u002Fgithub.com\u002Finernoro\u002Fprd_agent\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fdesign-replication\u002Fscripts\u002Fextract-spec.mjs",{"path":192,"resourceType":171,"resourceTypeDesc":172,"sizeBytes":193,"sourceHtmlUrl":194},"scripts\u002Ffixture-drift.mjs",5389,"https:\u002F\u002Fgithub.com\u002Finernoro\u002Fprd_agent\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fdesign-replication\u002Fscripts\u002Ffixture-drift.mjs",{"path":196,"resourceType":171,"resourceTypeDesc":172,"sizeBytes":197,"sourceHtmlUrl":198},"scripts\u002Ffixtures.mjs",6812,"https:\u002F\u002Fgithub.com\u002Finernoro\u002Fprd_agent\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fdesign-replication\u002Fscripts\u002Ffixtures.mjs",{"path":200,"resourceType":171,"resourceTypeDesc":172,"sizeBytes":201,"sourceHtmlUrl":202},"scripts\u002Fpair.mjs",3050,"https:\u002F\u002Fgithub.com\u002Finernoro\u002Fprd_agent\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fdesign-replication\u002Fscripts\u002Fpair.mjs",{"path":204,"resourceType":171,"resourceTypeDesc":172,"sizeBytes":205,"sourceHtmlUrl":206},"scripts\u002Fprocess.py",7967,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-endpoint-vulnerability-remediation\u002Fscripts\u002Fprocess.py",{"path":208,"resourceType":171,"resourceTypeDesc":172,"sizeBytes":209,"sourceHtmlUrl":210},"scripts\u002Frender.mjs",8500,"https:\u002F\u002Fgithub.com\u002Finernoro\u002Fprd_agent\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fdesign-replication\u002Fscripts\u002Frender.mjs",{"path":212,"resourceType":171,"resourceTypeDesc":172,"sizeBytes":213,"sourceHtmlUrl":214},"scripts\u002Fsetup.sh",2026,"https:\u002F\u002Fgithub.com\u002Finernoro\u002Fprd_agent\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fdesign-replication\u002Fscripts\u002Fsetup.sh",{"path":216,"resourceType":171,"resourceTypeDesc":172,"sizeBytes":217,"sourceHtmlUrl":218},"scripts\u002Fspec-diff.mjs",3862,"https:\u002F\u002Fgithub.com\u002Finernoro\u002Fprd_agent\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fdesign-replication\u002Fscripts\u002Fspec-diff.mjs",{"path":220,"resourceType":171,"resourceTypeDesc":172,"sizeBytes":221,"sourceHtmlUrl":222},"scripts\u002Fspec-export.mjs",8230,"https:\u002F\u002Fgithub.com\u002Finernoro\u002Fprd_agent\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fdesign-replication\u002Fscripts\u002Fspec-export.mjs",{"path":224,"resourceType":171,"resourceTypeDesc":172,"sizeBytes":225,"sourceHtmlUrl":226},"scripts\u002Ftokens-map.mjs",12281,"https:\u002F\u002Fgithub.com\u002Finernoro\u002Fprd_agent\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fdesign-replication\u002Fscripts\u002Ftokens-map.mjs",[228,253,277,304,330,353],{"skillNo":229,"name":230,"nameZh":6,"description":231,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":232,"categories":233,"keywords":235,"publishedAt":43},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[234],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[236,237,238,239,34,42,240,241,40,242,243,244,245,246,247,248,249,250,251,252],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":254,"name":255,"nameZh":6,"description":256,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":257,"categories":258,"keywords":260,"publishedAt":43},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[259],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[261,249,262,263,34,264,42,40,265,266,267,268,269,270,271,272,273,274,275,276],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":278,"name":279,"nameZh":6,"description":280,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":281,"categories":282,"keywords":287,"publishedAt":43},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[283,286],{"categoryNo":284,"categoryName":285,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[271,288,289,290,291,42,292,293,265,36,294,295,296,297,298,299,300,301,302,303],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":305,"name":306,"nameZh":6,"description":307,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":308,"categories":309,"keywords":311,"publishedAt":43},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[310],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[312,313,314,42,315,316,317,318,319,320,321,322,323,324,325,326,268,327,328,329],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":331,"name":332,"nameZh":6,"description":333,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":334,"categories":335,"keywords":337,"publishedAt":43},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[336],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[338,339,340,42,341,342,343,27,344,345,346,347,33,26,30,348,349,350,351,352],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","risk-management","nessus","qualys","openvas","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":354,"name":355,"nameZh":6,"description":356,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":357,"categories":358,"keywords":360,"publishedAt":43},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[359],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[34,361,42,362,363,364,365,366,367,368,369,299,370,300,371,372,373,374,375,376],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]