[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6C1RBC0SSM6JEGFCJZY6QAS":3,"skill-same:01M6C1RBC0SSM6JEGFCJZY6QAS":81},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":46,"linkOnly":47,"markdownContent":48,"markdownBody":49,"frontMatter":50,"refName":57,"commitSha":58,"skillDirectory":59,"forksCount":60,"repositoryHtmlUrl":61,"repositoryHomepageUrl":62,"ownerHtmlUrl":63,"ownerBlogUrl":64,"ownerDescription":65,"updatedAt":66,"install":67,"resources":80},"01M6C1RBC0SSM6JEGFCJZY6QAS","forensics-profile",null,"Build target system profile via SSH or cloud API enumeration","jmagly\u002Faiwg","jmagly","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1159087?v=4","01M6C10AK8N2WCSQN11FYGTJWN","Joseph Magly","01M6C10AQ8A2RMED1Y1BSVY7NF",229,"MIT","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fforensics-complete\u002Fskills\u002Fforensics-profile\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45],"forensics","forensics profile","profile","api","path","output","via","deep","build","system","azure","ssh","enumeration","reconnaissance","gcp","aws","cloud","2026-11-10 10:12:30",false,"---\nnamespace: aiwg\nname: forensics-profile\nplatforms: [all]\ndescription: Build target system profile via SSH or cloud API enumeration\ncommandHint:\n  argumentHint: \"\u003Ctarget> [--output path] [--deep] [--cloud aws|azure|gcp]\"\n  category: forensics-reconnaissance\n---\n\n# \u002Fforensics-profile\n\nBuild a comprehensive system profile of the target by enumerating OS details, running services, user accounts, installed packages, network configuration, and security controls. The profile establishes a baseline for subsequent investigation stages.\n\n## Usage\n\n`\u002Fforensics-profile \u003Ctarget> [options]`\n\n## Arguments\n\n| Argument | Required | Description |\n|----------|----------|-------------|\n| target | Yes | SSH connection string (`ssh:\u002F\u002Fuser@host:port`) or cloud target (`aws:\u002F\u002Faccount-id\u002Fregion`) |\n| --output | No | Custom output directory (default: `.aiwg\u002Fforensics\u002Fprofiles\u002F\u003Chostname>-\u003Cdate>\u002F`) |\n| --deep | No | Perform deep enumeration including package inventory and kernel config |\n| --cloud | No | Cloud provider context: `aws`, `azure`, or `gcp` |\n| --no-network | No | Skip network enumeration (faster, less intrusive) |\n| --format | No | Output format: `markdown` (default) or `json` |\n\n## Behavior\n\nWhen invoked, this command:\n\n1. **Parse Target**\n   - Resolve hostname or IP from connection string\n   - Verify SSH connectivity or cloud API access\n   - Detect operating system family (Linux distro, version, kernel)\n   - Record target identifier for artifact naming\n\n2. **System Enumeration**\n   - Collect OS version, kernel version, architecture\n   - Enumerate running processes and services\n   - List installed packages and versions\n   - Check uptime and last reboot time\n   - Identify virtualization or container environment\n\n3. **User and Account Inventory**\n   - Enumerate local user accounts from `\u002Fetc\u002Fpasswd`\n   - Identify privileged users (UID 0, sudo group members)\n   - Check for recently created or modified accounts\n   - Review `\u002Fetc\u002Fsudoers` and sudoers.d entries\n   - List active login sessions and recent auth history\n\n4. **Network Baseline**\n   - Capture listening ports and bound services\n   - Document active network connections\n   - Record network interfaces and IP assignments\n   - Identify firewall rules (iptables, nftables, ufw)\n   - Note DNS resolver configuration\n\n5. **Security Control Assessment**\n   - Check for security tools (auditd, fail2ban, SELinux, AppArmor)\n   - Review SSH daemon configuration\n   - Identify logging configuration and log rotation\n   - Note enabled\u002Fdisabled security features\n\n6. **Save Profile Artifact**\n   - Write `system-profile.md` with structured findings\n   - Write `system-profile.json` for machine processing\n   - Generate SHA-256 hash of profile files\n   - Log acquisition metadata and timestamps\n\n## Examples\n\n### Example 1: Basic SSH profile\n```bash\n\u002Fforensics-profile ssh:\u002F\u002Fadmin@192.168.1.50:22\n```\n\n### Example 2: Deep profile with custom output\n```bash\n\u002Fforensics-profile ssh:\u002F\u002Froot@10.0.0.5 --deep --output .aiwg\u002Fforensics\u002Fprofiles\u002Fweb-server\u002F\n```\n\n### Example 3: Cloud target\n```bash\n\u002Fforensics-profile aws:\u002F\u002F123456789012\u002Fus-east-1 --cloud aws\n```\n\n### Example 4: JSON output for pipeline use\n```bash\n\u002Fforensics-profile ssh:\u002F\u002Fanalyst@host --format json\n```\n\n## Output\n\nArtifacts are saved to `.aiwg\u002Fforensics\u002Fprofiles\u002F\u003Chostname>-\u003Cdate>\u002F`:\n\n```\n.aiwg\u002Fforensics\u002Fprofiles\u002Fweb01-2026-02-27\u002F\n├── system-profile.md         # Human-readable profile\n├── system-profile.json       # Machine-readable profile\n├── acquisition-log.yaml      # Timing and metadata\n└── checksums.sha256          # Integrity hashes\n```\n\n### Sample Output\n\n```\nProfiling Target: 192.168.1.50\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\nStep 1: Connecting to target\n  Connected via SSH (admin@192.168.1.50:22)\n  OS detected: Ubuntu 22.04.3 LTS (kernel 5.15.0-91)\n\nStep 2: System enumeration\n  Hostname: web01.internal\n  Uptime: 47 days, 3 hours\n  Architecture: x86_64\n  Running services: 23 active units\n  Installed packages: 412\n\nStep 3: User inventory\n  Total accounts: 28 (4 with shell access)\n  Privileged users: root, deploy\n  Sudo group members: admin, deploy\n  Active sessions: 2\n\nStep 4: Network baseline\n  Interfaces: eth0 (10.0.1.50\u002F24), lo\n  Listening ports: 22 (sshd), 80 (nginx), 443 (nginx), 3306 (mysqld)\n  Active connections: 14 established\n  Firewall: ufw active (12 rules)\n\nStep 5: Security controls\n  auditd: active\n  fail2ban: active (3 jails)\n  AppArmor: enforcing (18 profiles)\n  SSH: password auth disabled, key-only\n\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nProfile complete.\n\nOutput: .aiwg\u002Fforensics\u002Fprofiles\u002Fweb01-2026-02-27\u002F\nNext Steps:\n  \u002Fforensics-triage ssh:\u002F\u002Fadmin@192.168.1.50    - Capture volatile data\n  \u002Fforensics-investigate ssh:\u002F\u002Fadmin@192.168.1.50 --scope full\n```\n\n## References\n\n- @$AIWG_ROOT\u002Fagentic\u002Fcode\u002Fframeworks\u002Fforensics-complete\u002Fagents\u002Frecon-agent.md - Recon Agent\n- @$AIWG_ROOT\u002Fagentic\u002Fcode\u002Fframeworks\u002Fforensics-complete\u002Ftemplates\u002Ftarget-profile.md - Profile template\n- @$AIWG_ROOT\u002Fagentic\u002Fcode\u002Fframeworks\u002Fforensics-complete\u002Fcommands\u002Fforensics-triage.md - Next stage\n","# \u002Fforensics-profile\n\nBuild a comprehensive system profile of the target by enumerating OS details, running services, user accounts, installed packages, network configuration, and security controls. The profile establishes a baseline for subsequent investigation stages.\n\n## Usage\n\n`\u002Fforensics-profile \u003Ctarget> [options]`\n\n## Arguments\n\n| Argument | Required | Description |\n|----------|----------|-------------|\n| target | Yes | SSH connection string (`ssh:\u002F\u002Fuser@host:port`) or cloud target (`aws:\u002F\u002Faccount-id\u002Fregion`) |\n| --output | No | Custom output directory (default: `.aiwg\u002Fforensics\u002Fprofiles\u002F\u003Chostname>-\u003Cdate>\u002F`) |\n| --deep | No | Perform deep enumeration including package inventory and kernel config |\n| --cloud | No | Cloud provider context: `aws`, `azure`, or `gcp` |\n| --no-network | No | Skip network enumeration (faster, less intrusive) |\n| --format | No | Output format: `markdown` (default) or `json` |\n\n## Behavior\n\nWhen invoked, this command:\n\n1. **Parse Target**\n   - Resolve hostname or IP from connection string\n   - Verify SSH connectivity or cloud API access\n   - Detect operating system family (Linux distro, version, kernel)\n   - Record target identifier for artifact naming\n\n2. **System Enumeration**\n   - Collect OS version, kernel version, architecture\n   - Enumerate running processes and services\n   - List installed packages and versions\n   - Check uptime and last reboot time\n   - Identify virtualization or container environment\n\n3. **User and Account Inventory**\n   - Enumerate local user accounts from `\u002Fetc\u002Fpasswd`\n   - Identify privileged users (UID 0, sudo group members)\n   - Check for recently created or modified accounts\n   - Review `\u002Fetc\u002Fsudoers` and sudoers.d entries\n   - List active login sessions and recent auth history\n\n4. **Network Baseline**\n   - Capture listening ports and bound services\n   - Document active network connections\n   - Record network interfaces and IP assignments\n   - Identify firewall rules (iptables, nftables, ufw)\n   - Note DNS resolver configuration\n\n5. **Security Control Assessment**\n   - Check for security tools (auditd, fail2ban, SELinux, AppArmor)\n   - Review SSH daemon configuration\n   - Identify logging configuration and log rotation\n   - Note enabled\u002Fdisabled security features\n\n6. **Save Profile Artifact**\n   - Write `system-profile.md` with structured findings\n   - Write `system-profile.json` for machine processing\n   - Generate SHA-256 hash of profile files\n   - Log acquisition metadata and timestamps\n\n## Examples\n\n### Example 1: Basic SSH profile\n```bash\n\u002Fforensics-profile ssh:\u002F\u002Fadmin@192.168.1.50:22\n```\n\n### Example 2: Deep profile with custom output\n```bash\n\u002Fforensics-profile ssh:\u002F\u002Froot@10.0.0.5 --deep --output .aiwg\u002Fforensics\u002Fprofiles\u002Fweb-server\u002F\n```\n\n### Example 3: Cloud target\n```bash\n\u002Fforensics-profile aws:\u002F\u002F123456789012\u002Fus-east-1 --cloud aws\n```\n\n### Example 4: JSON output for pipeline use\n```bash\n\u002Fforensics-profile ssh:\u002F\u002Fanalyst@host --format json\n```\n\n## Output\n\nArtifacts are saved to `.aiwg\u002Fforensics\u002Fprofiles\u002F\u003Chostname>-\u003Cdate>\u002F`:\n\n```\n.aiwg\u002Fforensics\u002Fprofiles\u002Fweb01-2026-02-27\u002F\n├── system-profile.md         # Human-readable profile\n├── system-profile.json       # Machine-readable profile\n├── acquisition-log.yaml      # Timing and metadata\n└── checksums.sha256          # Integrity hashes\n```\n\n### Sample Output\n\n```\nProfiling Target: 192.168.1.50\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\nStep 1: Connecting to target\n  Connected via SSH (admin@192.168.1.50:22)\n  OS detected: Ubuntu 22.04.3 LTS (kernel 5.15.0-91)\n\nStep 2: System enumeration\n  Hostname: web01.internal\n  Uptime: 47 days, 3 hours\n  Architecture: x86_64\n  Running services: 23 active units\n  Installed packages: 412\n\nStep 3: User inventory\n  Total accounts: 28 (4 with shell access)\n  Privileged users: root, deploy\n  Sudo group members: admin, deploy\n  Active sessions: 2\n\nStep 4: Network baseline\n  Interfaces: eth0 (10.0.1.50\u002F24), lo\n  Listening ports: 22 (sshd), 80 (nginx), 443 (nginx), 3306 (mysqld)\n  Active connections: 14 established\n  Firewall: ufw active (12 rules)\n\nStep 5: Security controls\n  auditd: active\n  fail2ban: active (3 jails)\n  AppArmor: enforcing (18 profiles)\n  SSH: password auth disabled, key-only\n\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nProfile complete.\n\nOutput: .aiwg\u002Fforensics\u002Fprofiles\u002Fweb01-2026-02-27\u002F\nNext Steps:\n  \u002Fforensics-triage ssh:\u002F\u002Fadmin@192.168.1.50    - Capture volatile data\n  \u002Fforensics-investigate ssh:\u002F\u002Fadmin@192.168.1.50 --scope full\n```\n\n## References\n\n- @$AIWG_ROOT\u002Fagentic\u002Fcode\u002Fframeworks\u002Fforensics-complete\u002Fagents\u002Frecon-agent.md - Recon Agent\n- @$AIWG_ROOT\u002Fagentic\u002Fcode\u002Fframeworks\u002Fforensics-complete\u002Ftemplates\u002Ftarget-profile.md - Profile template\n- @$AIWG_ROOT\u002Fagentic\u002Fcode\u002Fframeworks\u002Fforensics-complete\u002Fcommands\u002Fforensics-triage.md - Next stage\n",{"name":5,"namespace":51,"platforms":52,"commandHint":54,"description":7},"aiwg",[53],"all",{"category":55,"argumentHint":56},"forensics-reconnaissance","\u003Ctarget> [--output path] [--deep] [--cloud aws|azure|gcp]","main","a602706fc62ff1cfcb18001358ac39647b08acf5","agentic\u002Fcode\u002Fframeworks\u002Fforensics-complete\u002Fskills\u002Fforensics-profile",36,"https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg","https:\u002F\u002Faiwg.io","https:\u002F\u002Fgithub.com\u002Fjmagly","https:\u002F\u002Fintegrolabs.io","ml\u002Fai, industrial automation, safety\u002Fsecurity, ssi\r\n\r\nmagly.net\r\nintegrolabs.io\r\naiwg.io\r\nfortemi.com\r\npagenary.com\r\nbytecask.com","2026-11-14 10:46:34",{"source":8,"skillName":5,"commands":68,"prompt":78,"zipAvailable":79},[69,72,75],{"tool":70,"command":71},"npx","npx skills add jmagly\u002Faiwg --skill forensics-profile",{"tool":73,"command":74},"bunx","bunx skills add jmagly\u002Faiwg --skill forensics-profile",{"tool":76,"command":77},"pnpm","pnpm dlx skills add jmagly\u002Faiwg --skill forensics-profile","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fforensics-complete\u002Fskills\u002Fforensics-profile\u002FSKILL.md",true,[],[82,110,134,140,147,161],{"skillNo":83,"name":84,"nameZh":6,"description":85,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":86,"categories":87,"keywords":89,"publishedAt":46},"01M70QA0BSYJ49EES9V4RE8QH1","host-hardening","Read-only system hardening baseline and plan-first host hardening recommendations for SSH, Docker bind addresses, firewall persistence, datastores, exporters and audit retention.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fplugins\u002Fsecurity-engineering\u002Fskills\u002Fhost-hardening\u002FSKILL.md",[88],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109],"host","host hardening","hardening","read","re","recommendations","remediation","plan","port","verification","Bash","access","only","retention","audit","never","firewall","bind","secrets","request",{"skillNo":111,"name":112,"nameZh":6,"description":113,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":114,"categories":115,"keywords":120,"publishedAt":46},"01M70PNT2Z4HMZPRBTAF6073NN","exposure-analysis","Read-only firewall analysis and effective host exposure reconstruction for Docker published ports, UFW bypass, stale rules, CDN scope, IPv6 asymmetry and external probe allowlists.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fplugins\u002Fforensics\u002Fskills\u002Fexposure-analysis\u002FSKILL.md",[116,119],{"categoryNo":117,"categoryName":118,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[121,122,123,93,124,98,125,126,100,127,90,128,102,129,130,105,106,131,132,133],"exposure analysis","analysis","unknown","credentials","collection","ufw","ports","internet","local","scope","reconstruction","operator","write",{"skillNo":135,"name":84,"nameZh":6,"description":85,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":136,"categories":137,"keywords":139,"publishedAt":46},"01M70P8QATMPKA78E4FT5D2TNA","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Fskills\u002Fhost-hardening\u002FSKILL.md",[138],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[92,90,91,101,93,109,96,95,104,97,98,99,100,108,102,103,94,105,106,107],{"skillNo":141,"name":112,"nameZh":6,"description":113,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":142,"categories":143,"keywords":146,"publishedAt":46},"01M70NMPVJ5H0JH131P60FW4R8","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fforensics-complete\u002Fskills\u002Fexposure-analysis\u002FSKILL.md",[144,145],{"categoryNo":117,"categoryName":118,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[122,121,105,124,98,125,100,123,90,128,102,129,130,93,106,127,126,131,132,133],{"skillNo":148,"name":149,"nameZh":6,"description":150,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":151,"categories":152,"keywords":154,"publishedAt":46},"01M6CB4DDR0B4NNCFK7ZK7449H","fixture-skill","Exercise rule delivery.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Ftest\u002Ffixtures\u002Frule-delivery\u002Fskills\u002Ffixture-skill\u002FSKILL.md",[153],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[155,156,157,158,159,160],"fixture skill","fixture","rule","delivery","true","exercise",{"skillNo":162,"name":163,"nameZh":6,"description":164,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":165,"categories":166,"keywords":168,"publishedAt":46},"01M6CB4AVK1W76MFMPP0JP32CJ","pi-local","Pi-local duplicate-precedence fixture.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Ftest\u002Ffixtures\u002Fproviders\u002Fpi\u002Fproject\u002F.pi\u002Fskills\u002Fpi-local\u002FSKILL.md",[167],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[169,170,129,171,156],"pi","pi local","duplicate"]