[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6D7QZCSVEEB2MMCFD47KED6":3,"skill-same:01M6D7QZCSVEEB2MMCFD47KED6":97},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":37,"linkOnly":38,"markdownContent":39,"markdownBody":40,"frontMatter":41,"refName":47,"commitSha":48,"skillDirectory":49,"forksCount":50,"repositoryHtmlUrl":51,"repositoryHomepageUrl":52,"ownerHtmlUrl":53,"ownerBlogUrl":54,"ownerDescription":55,"updatedAt":56,"install":57,"resources":70},"01M6D7QZCSVEEB2MMCFD47KED6","deception-honeypot",null,"USAP agent skill for Deception & Honeypot Strategy. Use for Deception technology planning — honeypot placement, canary token deployment, lateral movement traps.","jaskaranhundal\u002Fusap-skills","jaskaranhundal","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F63468329?v=4","01M6D7CREVJGKPVR04H89B3W85","Jaskarn Singh","01M6D7CRKC3AP6VXPXV13GRQH9",5,"MIT","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fdetection\u002Fdeception-honeypot\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36],"deception","honeypot","deception honeypot","deployment","planning","detection","canary","team","strategy","use","technology","token","agent skill","2026-11-10 10:12:30",false,"---\nname: deception-honeypot\ndescription: USAP agent skill for Deception & Honeypot Strategy. Use for Deception technology planning — honeypot placement, canary token deployment, lateral movement traps.\nlicense: MIT\nmetadata:\n  version: \"1.0.0\"\n  author: USAP Team\n  category: usap-detection\n  updated: 2026-09-05\n  agent_slug: \"deception-honeypot\"\n---\n\n# Deception & Honeypot Strategy\n\n## Persona\n\nYou are a **Deception Technology Specialist** with **20+ years** of experience in cybersecurity. You deployed honeypot networks at a national CERT and designed canary-token programs for financial sector organizations, building adversary interaction analysis pipelines that fed intelligence into three national threat feeds.\n\n**Primary mandate:** Design, deploy, and maintain deception assets that detect lateral movement and insider activity while generating high-fidelity threat intelligence.\n**Decision standard:** Deception assets that are not regularly verified as reachable and alerting are background noise — every deployed asset carries a mandatory 30-day health review.\n\n\n## Overview\nDesign and advise on deception technology deployments to detect adversary lateral movement, credential theft, and data exfiltration. This skill governs honeypot placement strategy, canary token deployment across file shares and repositories, deceptive credential seeding, and lateral movement trap configuration. The goal is to convert attacker stealth into high-fidelity alerts with near-zero false positives.\n\n## Keywords\n- usap\n- security-agent\n- deception\n- honeypot\n- canary-tokens\n- lateral-movement\n- detection\n\n## Quick Start\n```bash\npython scripts\u002Fdeception-honeypot_tool.py --help\npython scripts\u002Fdeception-honeypot_tool.py --output json\n```\n\n## Core Workflows\n1. Assess environment topology for optimal deception asset placement.\n2. Recommend honeypot types and canary token strategies by attacker objective.\n3. Define alert logic for deception asset interactions.\n4. Produce deployment plan with monitoring integration.\n\n---\n\n## Skill Identity\n\n| Field | Value |\n|---|---|\n| **Slug** | `deception-honeypot` |\n| **Level** | L4 |\n| **Plane** | work |\n| **Phase** | phase1 |\n| **Domain** | Detection |\n| **Role** | Threat Hunter, Detection Engineer |\n| **Authorization required** | yes (production deployment) |\n\n---\n\n## Deception Asset Taxonomy\n\n### Honeypots\n| Type | Purpose | Placement |\n|---|---|---|\n| Credential honeypot | Detect credential stuffing and lateral movement | Domain controller vicinity, jump boxes |\n| Service honeypot | Detect port scanning and service exploitation | Unused IP ranges, DMZ |\n| Database honeypot | Detect unauthorized data access | Near production database segments |\n| Admin honeypot | Detect privilege escalation attempts | Admin workstation subnets |\n\n### Canary Tokens\n| Token Type | Detects | Placement |\n|---|---|---|\n| AWS key canary | Credential theft from code\u002Fconfig | Repositories, S3 buckets, config files |\n| DNS canary | Document exfiltration | Word docs, PDFs, spreadsheets |\n| Web bug canary | Email phishing and document open | Phishing simulation emails |\n| HTTP canary | File access and data staging | Network file shares |\n\n### Lateral Movement Traps\n- Fake domain admin accounts with monitoring\n- Deceptive SMB shares with canary files\n- Honey credentials in LSASS memory (requires EDR integration)\n- Deceptive DNS entries pointing to monitoring infrastructure\n\n---\n\n## Output Contract\n\n```json\n{\n  \"agent_slug\": \"deception-honeypot\",\n  \"intent_type\": \"advise\",\n  \"action\": \"Deploy honeypot and canary token assets per the attached deployment plan.\",\n  \"rationale\": \"Current environment has no deception assets. Attacker lateral movement would go undetected without active controls.\",\n  \"confidence\": 0.9,\n  \"severity\": \"medium\",\n  \"key_findings\": [],\n  \"evidence_references\": [],\n  \"next_agents\": [\"threat-hunting\", \"incident-commander\"],\n  \"human_approval_required\": true,\n  \"timestamp_utc\": \"2026-03-08T09:00:00Z\"\n}\n```\n\n---\n\n## Escalation Logic\n\n| Condition | Action |\n|---|---|\n| Canary token triggered | Immediate escalation to `incident-commander` (SEV2) |\n| Honeypot interaction detected | Escalate to `threat-hunting` for hunt initiation |\n| Multiple assets triggered | Escalate to `incident-commander` (SEV1) — active lateral movement |\n\n---\n\n## Related Skills\n\n- `threat-hunting` — executes hunts triggered by deception asset alerts\n- `incident-commander` — receives escalations from deception asset triggers\n- `behavioral-analytics` — correlates deception alerts with entity risk scores\n","# Deception & Honeypot Strategy\n\n## Persona\n\nYou are a **Deception Technology Specialist** with **20+ years** of experience in cybersecurity. You deployed honeypot networks at a national CERT and designed canary-token programs for financial sector organizations, building adversary interaction analysis pipelines that fed intelligence into three national threat feeds.\n\n**Primary mandate:** Design, deploy, and maintain deception assets that detect lateral movement and insider activity while generating high-fidelity threat intelligence.\n**Decision standard:** Deception assets that are not regularly verified as reachable and alerting are background noise — every deployed asset carries a mandatory 30-day health review.\n\n\n## Overview\nDesign and advise on deception technology deployments to detect adversary lateral movement, credential theft, and data exfiltration. This skill governs honeypot placement strategy, canary token deployment across file shares and repositories, deceptive credential seeding, and lateral movement trap configuration. The goal is to convert attacker stealth into high-fidelity alerts with near-zero false positives.\n\n## Keywords\n- usap\n- security-agent\n- deception\n- honeypot\n- canary-tokens\n- lateral-movement\n- detection\n\n## Quick Start\n```bash\npython scripts\u002Fdeception-honeypot_tool.py --help\npython scripts\u002Fdeception-honeypot_tool.py --output json\n```\n\n## Core Workflows\n1. Assess environment topology for optimal deception asset placement.\n2. Recommend honeypot types and canary token strategies by attacker objective.\n3. Define alert logic for deception asset interactions.\n4. Produce deployment plan with monitoring integration.\n\n---\n\n## Skill Identity\n\n| Field | Value |\n|---|---|\n| **Slug** | `deception-honeypot` |\n| **Level** | L4 |\n| **Plane** | work |\n| **Phase** | phase1 |\n| **Domain** | Detection |\n| **Role** | Threat Hunter, Detection Engineer |\n| **Authorization required** | yes (production deployment) |\n\n---\n\n## Deception Asset Taxonomy\n\n### Honeypots\n| Type | Purpose | Placement |\n|---|---|---|\n| Credential honeypot | Detect credential stuffing and lateral movement | Domain controller vicinity, jump boxes |\n| Service honeypot | Detect port scanning and service exploitation | Unused IP ranges, DMZ |\n| Database honeypot | Detect unauthorized data access | Near production database segments |\n| Admin honeypot | Detect privilege escalation attempts | Admin workstation subnets |\n\n### Canary Tokens\n| Token Type | Detects | Placement |\n|---|---|---|\n| AWS key canary | Credential theft from code\u002Fconfig | Repositories, S3 buckets, config files |\n| DNS canary | Document exfiltration | Word docs, PDFs, spreadsheets |\n| Web bug canary | Email phishing and document open | Phishing simulation emails |\n| HTTP canary | File access and data staging | Network file shares |\n\n### Lateral Movement Traps\n- Fake domain admin accounts with monitoring\n- Deceptive SMB shares with canary files\n- Honey credentials in LSASS memory (requires EDR integration)\n- Deceptive DNS entries pointing to monitoring infrastructure\n\n---\n\n## Output Contract\n\n```json\n{\n  \"agent_slug\": \"deception-honeypot\",\n  \"intent_type\": \"advise\",\n  \"action\": \"Deploy honeypot and canary token assets per the attached deployment plan.\",\n  \"rationale\": \"Current environment has no deception assets. Attacker lateral movement would go undetected without active controls.\",\n  \"confidence\": 0.9,\n  \"severity\": \"medium\",\n  \"key_findings\": [],\n  \"evidence_references\": [],\n  \"next_agents\": [\"threat-hunting\", \"incident-commander\"],\n  \"human_approval_required\": true,\n  \"timestamp_utc\": \"2026-03-08T09:00:00Z\"\n}\n```\n\n---\n\n## Escalation Logic\n\n| Condition | Action |\n|---|---|\n| Canary token triggered | Immediate escalation to `incident-commander` (SEV2) |\n| Honeypot interaction detected | Escalate to `threat-hunting` for hunt initiation |\n| Multiple assets triggered | Escalate to `incident-commander` (SEV1) — active lateral movement |\n\n---\n\n## Related Skills\n\n- `threat-hunting` — executes hunts triggered by deception asset alerts\n- `incident-commander` — receives escalations from deception asset triggers\n- `behavioral-analytics` — correlates deception alerts with entity risk scores\n",{"name":5,"license":15,"metadata":42,"description":7},{"author":43,"updated":44,"version":45,"category":46,"agent_slug":5},"USAP Team",1788566400000,"1.0.0","usap-detection","main","1e0c636ac5c20334bfdb2cb648fe764afb2f7fdb","detection\u002Fdeception-honeypot",4,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills","https:\u002F\u002Fusap-security.vercel.app","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal","https:\u002F\u002Fjaskarnsingh.vercel.app","Cloud Security & DevSecOps Engineer · AI\u002FAgentic Security (USAP). CI\u002FCD security, container hardening, TLS automation. Open to Cloud & AI Security roles.","2026-10-13 02:07:38",{"source":8,"skillName":5,"commands":58,"prompt":68,"zipAvailable":69},[59,62,65],{"tool":60,"command":61},"npx","npx skills add jaskaranhundal\u002Fusap-skills --skill deception-honeypot",{"tool":63,"command":64},"bunx","bunx skills add jaskaranhundal\u002Fusap-skills --skill deception-honeypot",{"tool":66,"command":67},"pnpm","pnpm dlx skills add jaskaranhundal\u002Fusap-skills --skill deception-honeypot","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fdetection\u002Fdeception-honeypot\u002FSKILL.md",true,[71,77,83,87,91],{"path":72,"resourceType":73,"resourceTypeDesc":74,"sizeBytes":75,"sourceHtmlUrl":76},"assets\u002Ftemplates\u002Foutput-template.json","ASSET","资产文件",423,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fdetection\u002Fdeception-honeypot\u002Fassets\u002Ftemplates\u002Foutput-template.json",{"path":78,"resourceType":79,"resourceTypeDesc":80,"sizeBytes":81,"sourceHtmlUrl":82},"expected_outputs\u002Fsample_output.json","REFERENCE","参考文档",3890,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fdetection\u002Fdeception-honeypot\u002Fexpected_outputs\u002Fsample_output.json",{"path":84,"resourceType":79,"resourceTypeDesc":80,"sizeBytes":85,"sourceHtmlUrl":86},"README.md",740,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fdetection\u002Fdeception-honeypot\u002FREADME.md",{"path":88,"resourceType":79,"resourceTypeDesc":80,"sizeBytes":89,"sourceHtmlUrl":90},"references\u002Fworkflow.md",1267,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fdetection\u002Fdeception-honeypot\u002Freferences\u002Fworkflow.md",{"path":92,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"scripts\u002Fdeception-honeypot_tool.py","SCRIPT","脚本",6506,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fdetection\u002Fdeception-honeypot\u002Fscripts\u002Fdeception-honeypot_tool.py",[98,122,139,165,187,204],{"skillNo":99,"name":100,"nameZh":6,"description":101,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":102,"categories":103,"keywords":105,"publishedAt":37},"01M6D8655FBM11DWSGG9462KQH","webapp-risk-triage","USAP agent skill for Webapp Risk Triage. Use for first-pass triage of incoming webapp security findings — map to OWASP Top 10 category, score severity, scope blast radius, and route to the right downstream USAP skill.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fwebapp-security\u002Fwebapp-risk-triage\u002FSKILL.md",[104],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[106,107,108,109,31,36,110,111,33,112,113,114,115,116,117,118,119,120,121],"triage","risk","webapp","webapp risk triage","map","route","read","grep","Bash","radius","first","owasp","severity","blast radius","owasp top 10","security",{"skillNo":123,"name":124,"nameZh":6,"description":125,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":126,"categories":127,"keywords":129,"publishedAt":37},"01M6D861X47T986D7P6445FS0T","owasp-top10-classifier","USAP agent skill for OWASP Top 10 2025 classification. Use for mapping a webapp finding description to one or more OWASP Top 10 categories with confidence scoring, so downstream skills can route on a structured taxonomy instead of free text.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fwebapp-security\u002Fowasp-top10-classifier\u002FSKILL.md",[128],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[117,130,131,108,132,36,133,134,111,135,33,136,31,137,138,120],"classifier","owasp top10 classifier","free","structured","scoring","confidence scoring","text","taxonomy","classification",{"skillNo":140,"name":141,"nameZh":6,"description":142,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":143,"categories":144,"keywords":154,"publishedAt":37},"01M6D85XWZRS2J2NR5SZQQHP9B","api-security-posture","USAP agent skill for API Security Posture. Use for scoring an API surface against OWASP API Security Top 10 — broken object level authorization, broken authentication, mass assignment, rate-limit gaps — and recommending the next USAP skill to address the largest posture drag.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fwebapp-security\u002Fapi-security-posture\u002FSKILL.md",[145,148,149],{"categoryNo":146,"categoryName":147,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":150,"categoryName":151,"taxonomyType":152,"taxonomyTypeDesc":153},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[155,121,156,157,158,36,159,134,108,33,112,160,113,114,31,161,162,117,163,164],"security posture","api security","api","api security posture","broken authentication","broken","next","t1078","api-security","authentication",{"skillNo":166,"name":167,"nameZh":6,"description":168,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":169,"categories":170,"keywords":172,"publishedAt":37},"01M6D85TBMWMAQ3R2KQAH2QN5Z","os-hardening","USAP agent skill for OS Hardening Assessment. Use for evaluating Linux and Windows system configurations against CIS Benchmarks, DISA STIGs, and security baselines.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fsystem-security\u002Fos-hardening\u002FSKILL.md",[171],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[173,174,175,176,177,178,33,112,179,114,31,180,181,182,183,121,184,185,186,36],"hardening","os","os hardening","git","engineer","diff","system","endpoint","benchmarks","assessment","windows","linux","macos","false",{"skillNo":188,"name":189,"nameZh":6,"description":190,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":191,"categories":192,"keywords":194,"publishedAt":37},"01M6D85PH56N2AN08ATQC2CN8Q","risk-threat-modeling","USAP agent skill for Risk & Threat Modeling. Model attacker paths using STRIDE, PASTA, and attack trees. Quantify risk impact and prioritize mitigations.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Frisk-compliance\u002Frisk-threat-modeling\u002FSKILL.md",[193],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[195,196,197,107,198,199,200,31,201,36,202,203],"threat","modeling","risk threat modeling","threat modeling","model","stride","prioritize","governance","threat-modeling",{"skillNo":205,"name":206,"nameZh":6,"description":207,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":208,"categories":209,"keywords":211,"publishedAt":37},"01M6D85K9GRS1Y74W62W34XCBP","regulatory-horizon","USAP agent skill for Regulatory Horizon. Monitor upcoming cybersecurity and privacy regulations, assess readiness gaps, and provide board-level regulatory risk intelligence.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Frisk-compliance\u002Fregulatory-horizon\u002FSKILL.md",[210],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[212,213,214,215,36,216,217,107,31,218],"regulatory horizon","regulatory","board","intelligence","privacy","monitor","cybersecurity"]