[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFZSPD2ZJ8VN56QDB3P52S":3,"skill-same:01M6AFZSPD2ZJ8VN56QDB3P52S":123},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":66,"commitSha":67,"skillDirectory":68,"forksCount":69,"repositoryHtmlUrl":70,"repositoryHomepageUrl":71,"ownerHtmlUrl":72,"ownerBlogUrl":73,"ownerDescription":74,"updatedAt":75,"install":76,"resources":89},"01M6AFZSPD2ZJ8VN56QDB3P52S","performing-power-grid-cybersecurity-assessment",null,"Conduct cybersecurity assessments of power grid infrastructure spanning generation, transmission substations, distribution, and EMS control centers, covering NERC CIP compliance verification, IEC 61850 (GOOSE\u002FMMS) substation protocol analysis, and synchrophasor (PMU) network security against threats like Industroyer\u002FCrashOverride. Use for periodic NERC CIP assessments, substation automation or EMS\u002FSCADA security reviews, or regional entity compliance audits; not for non-BES systems or generic OT assessments without power grid specifics.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-power-grid-cybersecurity-assessment\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"cybersecurity","performing power grid cybersecurity assessment","assessment","scada","network security","ICS-security","analysis","nerc-cip","t1059","t1078","iec62443","industrial-control","pr","ics","ot-security","network","compliance","verification","protocol","automation","2026-11-10 10:12:30",false,"---\nname: performing-power-grid-cybersecurity-assessment\ndescription: Conduct cybersecurity assessments of power grid infrastructure spanning generation, transmission substations, distribution, and EMS control centers, covering NERC CIP compliance verification, IEC 61850 (GOOSE\u002FMMS) substation protocol analysis, and synchrophasor (PMU) network security against threats like Industroyer\u002FCrashOverride. Use for periodic NERC CIP assessments, substation automation or EMS\u002FSCADA security reviews, or regional entity compliance audits; not for non-BES systems or generic OT assessments without power grid specifics.\ndomain: cybersecurity\nsubdomain: ot-ics-security\ntags:\n- ot-security\n- ics\n- scada\n- industrial-control\n- iec62443\n- nerc-cip\n- power-grid\n- substation\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.IR-01\n- DE.CM-01\n- ID.AM-05\n- GV.OC-02\nmitre_attack:\n- T1078\n- T1190\n- T1059\n- T0816\n- T0836\n---\n\n# Performing Power Grid Cybersecurity Assessment\n\n## When to Use\n\n- When conducting periodic cybersecurity assessments of power grid facilities per NERC CIP requirements\n- When assessing substation automation systems using IEC 61850 GOOSE and MMS protocols\n- When evaluating the security of an Energy Management System (EMS) or SCADA control center\n- When assessing synchrophasor (PMU) networks and wide-area monitoring systems\n- When preparing for regional entity compliance audits or internal security reviews\n\n**Do not use** for non-BES systems below NERC registration thresholds, for general OT assessment without power grid specifics (see performing-ot-network-security-assessment), or for physical security assessment of generation facilities without cyber scope.\n\n## Prerequisites\n\n- Understanding of electric power grid architecture (generation, transmission, distribution)\n- Familiarity with NERC CIP standards and BES Cyber System categorization\n- Knowledge of power grid protocols (IEC 61850, IEC 60870-5-104, DNP3, ICCP\u002FTASE.2)\n- Passive monitoring tools for substation network traffic analysis\n- Access to EMS\u002FSCADA architecture documentation and network diagrams\n\n## Workflow\n\n### Step 1: Map Power Grid Cyber Architecture\n\nIdentify and document all cyber systems supporting grid operations including EMS, SCADA, substation automation, and communication infrastructure.\n\n```yaml\n# Power Grid Cyber Architecture Assessment\nfacility_type: \"Regional Transmission Organization Control Center\"\n\nems_systems:\n  primary_ems:\n    vendor: \"GE Grid Solutions\"\n    product: \"EMS\u002FSCADA (formerly XA\u002F21)\"\n    functions:\n      - \"State estimation\"\n      - \"Automatic generation control (AGC)\"\n      - \"Security-constrained economic dispatch\"\n      - \"Contingency analysis\"\n    protocols:\n      - \"ICCP\u002FTASE.2 (inter-control center)\"\n      - \"DNP3 (substation RTU polling)\"\n      - \"IEC 60870-5-104 (substation polling)\"\n\n  backup_control_center:\n    location: \"Geographically diverse backup site\"\n    sync_method: \"Real-time database mirroring\"\n    switchover_time: \"\u003C 5 minutes\"\n\nsubstation_automation:\n  count: 145\n  system_types:\n    - vendor: \"ABB\"\n      product: \"RTU560\"\n      protocol: \"DNP3 over TCP\u002FIP\"\n      count: 85\n    - vendor: \"SEL\"\n      product: \"SEL-3530 RTAC\"\n      protocol: \"IEC 61850 MMS + GOOSE\"\n      count: 40\n    - vendor: \"Siemens\"\n      product: \"SICAM A8000\"\n      protocol: \"IEC 60870-5-104\"\n      count: 20\n\n  communications:\n    primary: \"MPLS WAN (carrier-provided)\"\n    backup: \"Licensed microwave radio\"\n    last_mile: \"Fiber optic to substation\"\n\nsynchrophasor_network:\n  pmu_count: 75\n  pdc: \"GE PDC (Phasor Data Concentrator)\"\n  communication: \"IEEE C37.118.2 over dedicated network\"\n  data_rate: \"30-60 samples per second\"\n```\n\n### Step 2: Assess Substation Automation Security\n\nEvaluate IEC 61850-based substation automation for protocol security, access controls, and network segmentation.\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Power Grid Substation Security Assessor.\n\nEvaluates security of IEC 61850-based substation automation\nsystems including GOOSE messaging, MMS client\u002Fserver, and\nnetwork architecture.\n\"\"\"\n\nimport json\nimport sys\nfrom dataclasses import dataclass, field, asdict\nfrom datetime import datetime\n\n\n@dataclass\nclass SubstationFinding:\n    finding_id: str\n    severity: str\n    category: str\n    title: str\n    description: str\n    affected_systems: list\n    nerc_cip_ref: str\n    iec_62351_ref: str\n    remediation: str\n\n\nclass SubstationAssessment:\n    \"\"\"Assesses cybersecurity of substation automation systems.\"\"\"\n\n    def __init__(self, substation_name):\n        self.name = substation_name\n        self.findings = []\n        self.counter = 1\n\n    def assess_iec61850_security(self, config):\n        \"\"\"Assess IEC 61850 protocol security.\"\"\"\n\n        # GOOSE message authentication\n        if not config.get(\"goose_authentication\"):\n            self.findings.append(SubstationFinding(\n                finding_id=f\"SUB-{self.counter:03d}\",\n                severity=\"critical\",\n                category=\"Protocol Security\",\n                title=\"IEC 61850 GOOSE Messages Lack Authentication\",\n                description=(\n                    \"GOOSE messages used for protection signaling between IEDs \"\n                    \"are not authenticated. An attacker on the station bus could \"\n                    \"inject false trip\u002Fclose commands to circuit breakers.\"\n                ),\n                affected_systems=config.get(\"goose_publishers\", []),\n                nerc_cip_ref=\"CIP-005-7 R1.5 - ESP internal communications\",\n                iec_62351_ref=\"IEC 62351-6 - GOOSE\u002FSV authentication\",\n                remediation=(\n                    \"Implement IEC 62351-6 GOOSE authentication using digital \"\n                    \"signatures. Deploy VLAN isolation for GOOSE traffic as interim.\"\n                ),\n            ))\n            self.counter += 1\n\n        # MMS service access control\n        if not config.get(\"mms_authentication\"):\n            self.findings.append(SubstationFinding(\n                finding_id=f\"SUB-{self.counter:03d}\",\n                severity=\"high\",\n                category=\"Protocol Security\",\n                title=\"MMS Client Connections Lack Authentication\",\n                description=(\n                    \"MMS (Manufacturing Message Specification) connections to IEDs \"\n                    \"do not require client authentication. Any device on the station \"\n                    \"bus can read\u002Fwrite IED configuration and operate breakers.\"\n                ),\n                affected_systems=config.get(\"mms_servers\", []),\n                nerc_cip_ref=\"CIP-007-6 R5 - System Access Controls\",\n                iec_62351_ref=\"IEC 62351-4 - MMS security profiles\",\n                remediation=\"Enable TLS for MMS connections per IEC 62351-4.\",\n            ))\n            self.counter += 1\n\n        # Station bus segmentation\n        if not config.get(\"station_bus_segmented\"):\n            self.findings.append(SubstationFinding(\n                finding_id=f\"SUB-{self.counter:03d}\",\n                severity=\"high\",\n                category=\"Network Architecture\",\n                title=\"Flat Station Bus Network Without Segmentation\",\n                description=(\n                    \"Station bus connects all IEDs, HMI, engineering access, \"\n                    \"and WAN gateway on a single VLAN without segmentation.\"\n                ),\n                affected_systems=[\"All station bus devices\"],\n                nerc_cip_ref=\"CIP-005-7 R1 - ESP boundary\",\n                iec_62351_ref=\"IEC 62351-10 - Security architecture\",\n                remediation=(\n                    \"Segment station bus into VLANs: protection IEDs, \"\n                    \"measurement IEDs, station HMI, and WAN gateway.\"\n                ),\n            ))\n            self.counter += 1\n\n    def assess_remote_access(self, config):\n        \"\"\"Assess remote access security for substations.\"\"\"\n        if config.get(\"direct_vendor_access\"):\n            self.findings.append(SubstationFinding(\n                finding_id=f\"SUB-{self.counter:03d}\",\n                severity=\"critical\",\n                category=\"Remote Access\",\n                title=\"Direct Vendor Remote Access to Substation Without MFA\",\n                description=(\n                    \"Vendor support has direct VPN access to substation network \"\n                    \"without traversing an intermediate system or requiring MFA.\"\n                ),\n                affected_systems=[\"Substation WAN gateway\"],\n                nerc_cip_ref=\"CIP-005-7 R2 - Remote Access Management\",\n                iec_62351_ref=\"IEC 62351-8 - Role-based access control\",\n                remediation=(\n                    \"Route vendor access through corporate jump server with MFA. \"\n                    \"Implement session recording per CIP-005-7 R2.4.\"\n                ),\n            ))\n            self.counter += 1\n\n    def generate_report(self):\n        \"\"\"Generate substation assessment report.\"\"\"\n        report = []\n        report.append(\"=\" * 70)\n        report.append(f\"SUBSTATION CYBERSECURITY ASSESSMENT: {self.name}\")\n        report.append(f\"Date: {datetime.now().isoformat()}\")\n        report.append(\"=\" * 70)\n\n        for sev in [\"critical\", \"high\", \"medium\", \"low\"]:\n            findings = [f for f in self.findings if f.severity == sev]\n            if findings:\n                report.append(f\"\\n--- {sev.upper()} ({len(findings)}) ---\")\n                for f in findings:\n                    report.append(f\"  [{f.finding_id}] {f.title}\")\n                    report.append(f\"    {f.description[:100]}...\")\n                    report.append(f\"    NERC CIP: {f.nerc_cip_ref}\")\n                    report.append(f\"    Remediation: {f.remediation[:80]}...\")\n\n        return \"\\n\".join(report)\n\n\nif __name__ == \"__main__\":\n    assessment = SubstationAssessment(\"Substation Alpha - 345kV\")\n\n    assessment.assess_iec61850_security({\n        \"goose_authentication\": False,\n        \"mms_authentication\": False,\n        \"station_bus_segmented\": False,\n        \"goose_publishers\": [\"SEL-411L-01\", \"SEL-411L-02\", \"SEL-487E-01\"],\n        \"mms_servers\": [\"SEL-3530-RTAC\", \"ABB-REF615-01\"],\n    })\n\n    assessment.assess_remote_access({\n        \"direct_vendor_access\": True,\n    })\n\n    print(assessment.generate_report())\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| IEC 61850 | International standard for communication networks and systems in substations, using GOOSE for protection signaling and MMS for SCADA data |\n| GOOSE | Generic Object Oriented Substation Event - multicast protocol for fast peer-to-peer protection signaling between IEDs (\u003C 4ms trip time) |\n| MMS | Manufacturing Message Specification - client\u002Fserver protocol for reading\u002Fwriting IED data and operating circuit breakers |\n| IEC 62351 | Security standard series for power system communication protocols providing authentication and encryption for IEC 61850, DNP3, and IEC 104 |\n| ICCP\u002FTASE.2 | Inter-Control Center Communications Protocol for data exchange between control centers of different utilities |\n| Synchrophasor (PMU) | Phasor Measurement Unit providing time-synchronized voltage\u002Fcurrent measurements at 30-60 samples\u002Fsecond for wide-area monitoring |\n\n## Tools & Systems\n\n- **Dragos Platform**: OT security platform with specific threat intelligence on power grid-targeting groups (ELECTRUM, KAMACITE)\n- **SEL-3620 Ethernet Security Gateway**: Substation security device providing encryption, access control, and intrusion detection\n- **GRIDsure**: Power grid cybersecurity assessment framework by Idaho National Laboratory\n- **Wireshark with IEC 61850 Dissector**: Protocol analysis for GOOSE and MMS traffic in substations\n\n## Output Format\n\n```\nPower Grid Cybersecurity Assessment Report\n=============================================\nFacility: [Name and Type]\nNERC Registration: [Entity ID]\nBES Impact Rating: [High\u002FMedium\u002FLow]\n\nSUBSTATION FINDINGS: [N]\nEMS\u002FSCADA FINDINGS: [N]\nCOMMUNICATION FINDINGS: [N]\n\nNERC CIP COMPLIANCE:\n  CIP-002: [Status]\n  CIP-005: [Status]\n  CIP-007: [Status]\n```\n","# Performing Power Grid Cybersecurity Assessment\n\n## When to Use\n\n- When conducting periodic cybersecurity assessments of power grid facilities per NERC CIP requirements\n- When assessing substation automation systems using IEC 61850 GOOSE and MMS protocols\n- When evaluating the security of an Energy Management System (EMS) or SCADA control center\n- When assessing synchrophasor (PMU) networks and wide-area monitoring systems\n- When preparing for regional entity compliance audits or internal security reviews\n\n**Do not use** for non-BES systems below NERC registration thresholds, for general OT assessment without power grid specifics (see performing-ot-network-security-assessment), or for physical security assessment of generation facilities without cyber scope.\n\n## Prerequisites\n\n- Understanding of electric power grid architecture (generation, transmission, distribution)\n- Familiarity with NERC CIP standards and BES Cyber System categorization\n- Knowledge of power grid protocols (IEC 61850, IEC 60870-5-104, DNP3, ICCP\u002FTASE.2)\n- Passive monitoring tools for substation network traffic analysis\n- Access to EMS\u002FSCADA architecture documentation and network diagrams\n\n## Workflow\n\n### Step 1: Map Power Grid Cyber Architecture\n\nIdentify and document all cyber systems supporting grid operations including EMS, SCADA, substation automation, and communication infrastructure.\n\n```yaml\n# Power Grid Cyber Architecture Assessment\nfacility_type: \"Regional Transmission Organization Control Center\"\n\nems_systems:\n  primary_ems:\n    vendor: \"GE Grid Solutions\"\n    product: \"EMS\u002FSCADA (formerly XA\u002F21)\"\n    functions:\n      - \"State estimation\"\n      - \"Automatic generation control (AGC)\"\n      - \"Security-constrained economic dispatch\"\n      - \"Contingency analysis\"\n    protocols:\n      - \"ICCP\u002FTASE.2 (inter-control center)\"\n      - \"DNP3 (substation RTU polling)\"\n      - \"IEC 60870-5-104 (substation polling)\"\n\n  backup_control_center:\n    location: \"Geographically diverse backup site\"\n    sync_method: \"Real-time database mirroring\"\n    switchover_time: \"\u003C 5 minutes\"\n\nsubstation_automation:\n  count: 145\n  system_types:\n    - vendor: \"ABB\"\n      product: \"RTU560\"\n      protocol: \"DNP3 over TCP\u002FIP\"\n      count: 85\n    - vendor: \"SEL\"\n      product: \"SEL-3530 RTAC\"\n      protocol: \"IEC 61850 MMS + GOOSE\"\n      count: 40\n    - vendor: \"Siemens\"\n      product: \"SICAM A8000\"\n      protocol: \"IEC 60870-5-104\"\n      count: 20\n\n  communications:\n    primary: \"MPLS WAN (carrier-provided)\"\n    backup: \"Licensed microwave radio\"\n    last_mile: \"Fiber optic to substation\"\n\nsynchrophasor_network:\n  pmu_count: 75\n  pdc: \"GE PDC (Phasor Data Concentrator)\"\n  communication: \"IEEE C37.118.2 over dedicated network\"\n  data_rate: \"30-60 samples per second\"\n```\n\n### Step 2: Assess Substation Automation Security\n\nEvaluate IEC 61850-based substation automation for protocol security, access controls, and network segmentation.\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Power Grid Substation Security Assessor.\n\nEvaluates security of IEC 61850-based substation automation\nsystems including GOOSE messaging, MMS client\u002Fserver, and\nnetwork architecture.\n\"\"\"\n\nimport json\nimport sys\nfrom dataclasses import dataclass, field, asdict\nfrom datetime import datetime\n\n\n@dataclass\nclass SubstationFinding:\n    finding_id: str\n    severity: str\n    category: str\n    title: str\n    description: str\n    affected_systems: list\n    nerc_cip_ref: str\n    iec_62351_ref: str\n    remediation: str\n\n\nclass SubstationAssessment:\n    \"\"\"Assesses cybersecurity of substation automation systems.\"\"\"\n\n    def __init__(self, substation_name):\n        self.name = substation_name\n        self.findings = []\n        self.counter = 1\n\n    def assess_iec61850_security(self, config):\n        \"\"\"Assess IEC 61850 protocol security.\"\"\"\n\n        # GOOSE message authentication\n        if not config.get(\"goose_authentication\"):\n            self.findings.append(SubstationFinding(\n                finding_id=f\"SUB-{self.counter:03d}\",\n                severity=\"critical\",\n                category=\"Protocol Security\",\n                title=\"IEC 61850 GOOSE Messages Lack Authentication\",\n                description=(\n                    \"GOOSE messages used for protection signaling between IEDs \"\n                    \"are not authenticated. An attacker on the station bus could \"\n                    \"inject false trip\u002Fclose commands to circuit breakers.\"\n                ),\n                affected_systems=config.get(\"goose_publishers\", []),\n                nerc_cip_ref=\"CIP-005-7 R1.5 - ESP internal communications\",\n                iec_62351_ref=\"IEC 62351-6 - GOOSE\u002FSV authentication\",\n                remediation=(\n                    \"Implement IEC 62351-6 GOOSE authentication using digital \"\n                    \"signatures. Deploy VLAN isolation for GOOSE traffic as interim.\"\n                ),\n            ))\n            self.counter += 1\n\n        # MMS service access control\n        if not config.get(\"mms_authentication\"):\n            self.findings.append(SubstationFinding(\n                finding_id=f\"SUB-{self.counter:03d}\",\n                severity=\"high\",\n                category=\"Protocol Security\",\n                title=\"MMS Client Connections Lack Authentication\",\n                description=(\n                    \"MMS (Manufacturing Message Specification) connections to IEDs \"\n                    \"do not require client authentication. Any device on the station \"\n                    \"bus can read\u002Fwrite IED configuration and operate breakers.\"\n                ),\n                affected_systems=config.get(\"mms_servers\", []),\n                nerc_cip_ref=\"CIP-007-6 R5 - System Access Controls\",\n                iec_62351_ref=\"IEC 62351-4 - MMS security profiles\",\n                remediation=\"Enable TLS for MMS connections per IEC 62351-4.\",\n            ))\n            self.counter += 1\n\n        # Station bus segmentation\n        if not config.get(\"station_bus_segmented\"):\n            self.findings.append(SubstationFinding(\n                finding_id=f\"SUB-{self.counter:03d}\",\n                severity=\"high\",\n                category=\"Network Architecture\",\n                title=\"Flat Station Bus Network Without Segmentation\",\n                description=(\n                    \"Station bus connects all IEDs, HMI, engineering access, \"\n                    \"and WAN gateway on a single VLAN without segmentation.\"\n                ),\n                affected_systems=[\"All station bus devices\"],\n                nerc_cip_ref=\"CIP-005-7 R1 - ESP boundary\",\n                iec_62351_ref=\"IEC 62351-10 - Security architecture\",\n                remediation=(\n                    \"Segment station bus into VLANs: protection IEDs, \"\n                    \"measurement IEDs, station HMI, and WAN gateway.\"\n                ),\n            ))\n            self.counter += 1\n\n    def assess_remote_access(self, config):\n        \"\"\"Assess remote access security for substations.\"\"\"\n        if config.get(\"direct_vendor_access\"):\n            self.findings.append(SubstationFinding(\n                finding_id=f\"SUB-{self.counter:03d}\",\n                severity=\"critical\",\n                category=\"Remote Access\",\n                title=\"Direct Vendor Remote Access to Substation Without MFA\",\n                description=(\n                    \"Vendor support has direct VPN access to substation network \"\n                    \"without traversing an intermediate system or requiring MFA.\"\n                ),\n                affected_systems=[\"Substation WAN gateway\"],\n                nerc_cip_ref=\"CIP-005-7 R2 - Remote Access Management\",\n                iec_62351_ref=\"IEC 62351-8 - Role-based access control\",\n                remediation=(\n                    \"Route vendor access through corporate jump server with MFA. \"\n                    \"Implement session recording per CIP-005-7 R2.4.\"\n                ),\n            ))\n            self.counter += 1\n\n    def generate_report(self):\n        \"\"\"Generate substation assessment report.\"\"\"\n        report = []\n        report.append(\"=\" * 70)\n        report.append(f\"SUBSTATION CYBERSECURITY ASSESSMENT: {self.name}\")\n        report.append(f\"Date: {datetime.now().isoformat()}\")\n        report.append(\"=\" * 70)\n\n        for sev in [\"critical\", \"high\", \"medium\", \"low\"]:\n            findings = [f for f in self.findings if f.severity == sev]\n            if findings:\n                report.append(f\"\\n--- {sev.upper()} ({len(findings)}) ---\")\n                for f in findings:\n                    report.append(f\"  [{f.finding_id}] {f.title}\")\n                    report.append(f\"    {f.description[:100]}...\")\n                    report.append(f\"    NERC CIP: {f.nerc_cip_ref}\")\n                    report.append(f\"    Remediation: {f.remediation[:80]}...\")\n\n        return \"\\n\".join(report)\n\n\nif __name__ == \"__main__\":\n    assessment = SubstationAssessment(\"Substation Alpha - 345kV\")\n\n    assessment.assess_iec61850_security({\n        \"goose_authentication\": False,\n        \"mms_authentication\": False,\n        \"station_bus_segmented\": False,\n        \"goose_publishers\": [\"SEL-411L-01\", \"SEL-411L-02\", \"SEL-487E-01\"],\n        \"mms_servers\": [\"SEL-3530-RTAC\", \"ABB-REF615-01\"],\n    })\n\n    assessment.assess_remote_access({\n        \"direct_vendor_access\": True,\n    })\n\n    print(assessment.generate_report())\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| IEC 61850 | International standard for communication networks and systems in substations, using GOOSE for protection signaling and MMS for SCADA data |\n| GOOSE | Generic Object Oriented Substation Event - multicast protocol for fast peer-to-peer protection signaling between IEDs (\u003C 4ms trip time) |\n| MMS | Manufacturing Message Specification - client\u002Fserver protocol for reading\u002Fwriting IED data and operating circuit breakers |\n| IEC 62351 | Security standard series for power system communication protocols providing authentication and encryption for IEC 61850, DNP3, and IEC 104 |\n| ICCP\u002FTASE.2 | Inter-Control Center Communications Protocol for data exchange between control centers of different utilities |\n| Synchrophasor (PMU) | Phasor Measurement Unit providing time-synchronized voltage\u002Fcurrent measurements at 30-60 samples\u002Fsecond for wide-area monitoring |\n\n## Tools & Systems\n\n- **Dragos Platform**: OT security platform with specific threat intelligence on power grid-targeting groups (ELECTRUM, KAMACITE)\n- **SEL-3620 Ethernet Security Gateway**: Substation security device providing encryption, access control, and intrusion detection\n- **GRIDsure**: Power grid cybersecurity assessment framework by Idaho National Laboratory\n- **Wireshark with IEC 61850 Dissector**: Protocol analysis for GOOSE and MMS traffic in substations\n\n## Output Format\n\n```\nPower Grid Cybersecurity Assessment Report\n=============================================\nFacility: [Name and Type]\nNERC Registration: [Entity ID]\nBES Impact Rating: [High\u002FMedium\u002FLow]\n\nSUBSTATION FINDINGS: [N]\nEMS\u002FSCADA FINDINGS: [N]\nCOMMUNICATION FINDINGS: [N]\n\nNERC CIP COMPLIANCE:\n  CIP-002: [Status]\n  CIP-005: [Status]\n  CIP-007: [Status]\n```\n",{"name":5,"tags":49,"author":52,"domain":24,"license":15,"version":53,"nist_csf":54,"subdomain":59,"description":7,"mitre_attack":60},[38,37,27,35,34,31,50,51],"power-grid","substation","mahipal","1.0.0",[55,56,57,58],"PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02","ot-ics-security",[61,62,63,64,65],"T1078","T1190","T1059","T0816","T0836","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-power-grid-cybersecurity-assessment",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":77,"prompt":87,"zipAvailable":88},[78,81,84],{"tool":79,"command":80},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-power-grid-cybersecurity-assessment",{"tool":82,"command":83},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-power-grid-cybersecurity-assessment",{"tool":85,"command":86},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-power-grid-cybersecurity-assessment","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-power-grid-cybersecurity-assessment\u002FSKILL.md",true,[90,96,100,105,109,113,117],{"path":91,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":94,"sourceHtmlUrl":95},"GLOSSARY-FORMAT.md","REFERENCE","参考文档",2131,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fteach\u002FGLOSSARY-FORMAT.md",{"path":97,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":98,"sourceHtmlUrl":99},"LEARNING-RECORD-FORMAT.md",2777,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fteach\u002FLEARNING-RECORD-FORMAT.md",{"path":101,"resourceType":101,"resourceTypeDesc":102,"sizeBytes":103,"sourceHtmlUrl":104},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-power-grid-cybersecurity-assessment\u002FLICENSE",{"path":106,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":107,"sourceHtmlUrl":108},"MISSION-FORMAT.md",1553,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fteach\u002FMISSION-FORMAT.md",{"path":110,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":111,"sourceHtmlUrl":112},"references\u002Fapi-reference.md",1432,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-power-grid-cybersecurity-assessment\u002Freferences\u002Fapi-reference.md",{"path":114,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":115,"sourceHtmlUrl":116},"RESOURCES-FORMAT.md",1926,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fteach\u002FRESOURCES-FORMAT.md",{"path":118,"resourceType":119,"resourceTypeDesc":120,"sizeBytes":121,"sourceHtmlUrl":122},"scripts\u002Fagent.py","SCRIPT","脚本",7540,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-power-grid-cybersecurity-assessment\u002Fscripts\u002Fagent.py",[124,150,173,199,225,252],{"skillNo":125,"name":126,"nameZh":6,"description":127,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":128,"categories":129,"keywords":131,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[130],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[132,133,134,135,136,24,137,138,36,139,140,141,142,143,144,145,146,147,148,149],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":151,"name":152,"nameZh":6,"description":153,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":154,"categories":155,"keywords":157,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[156],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[158,146,159,160,136,161,24,36,41,162,163,164,165,166,167,168,169,170,171,172],"boot","TPM","validating tpm measured boot attestation","policy","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":174,"name":175,"nameZh":6,"description":176,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":177,"categories":178,"keywords":183,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[179,182],{"categoryNo":180,"categoryName":181,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[167,184,185,186,187,24,188,189,41,40,190,191,192,193,194,33,195,196,197,198],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":200,"name":201,"nameZh":6,"description":202,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":203,"categories":204,"keywords":206,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[205],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[207,208,209,24,210,211,212,213,214,215,216,217,218,219,220,221,164,222,223,224],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":226,"name":227,"nameZh":6,"description":228,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":229,"categories":230,"keywords":232,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[231],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[233,234,235,24,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":253,"name":254,"nameZh":6,"description":255,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":256,"categories":257,"keywords":259,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[258],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[136,260,24,261,262,263,264,265,266,267,268,33,269,195,30,270,271,272,273,274],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]