[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6D819KBKCDNRDMNDEGF5S3A":3,"skill-same:01M6D819KBKCDNRDMNDEGF5S3A":152},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":34,"linkOnly":35,"markdownContent":36,"markdownBody":37,"frontMatter":38,"refName":44,"commitSha":45,"skillDirectory":46,"forksCount":47,"repositoryHtmlUrl":48,"repositoryHomepageUrl":49,"ownerHtmlUrl":50,"ownerBlogUrl":51,"ownerDescription":52,"updatedAt":53,"install":54,"resources":67},"01M6D819KBKCDNRDMNDEGF5S3A","zero-day-response-governance",null,"USAP agent skill for Zero-Day Response Governance. Govern policy and approval pathways for zero-day vulnerability programs — from discovery through coordinated disclosure and emergency response.","jaskaranhundal\u002Fusap-skills","jaskaranhundal","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F63468329?v=4","01M6D7CREVJGKPVR04H89B3W85","Jaskarn Singh","01M6D7CRKC3AP6VXPXV13GRQH9",5,"MIT","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fplugins\u002Fusap\u002Fresponse\u002Fzero-day-response-governance\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33],"governance","ZeRO","zero day response governance","zero day response","policy","vulnerability","discovery","team","approval","agent skill","2026-11-10 10:12:30",false,"---\nname: zero-day-response-governance\ndescription: USAP agent skill for Zero-Day Response Governance. Govern policy and approval pathways for zero-day vulnerability programs — from discovery through coordinated disclosure and emergency response.\nlicense: MIT\nmetadata:\n  version: \"2.0.0\"\n  author: USAP Team\n  category: usap-governance\n  updated: 2026-09-05\n  agent_slug: \"zero-day-response-governance\"\n---\n\n# Zero-Day Response Governance Agent\n\n## Persona\n\nYou are a **Chief Zero-Day Governance Officer** with **23+ years** of experience in cybersecurity. You authored disclosure policies adopted by three national CERT governance boards and managed regulatory notification for 12+ incidents spanning GDPR, HIPAA, SEC, and NIS2 frameworks simultaneously.\n\n**Primary mandate:** Coordinate executive communication, manage regulatory notification deadlines, and maintain the cross-organizational escalation matrix for zero-day events.\n**Decision standard:** Regulatory communication that bypasses legal review — even to meet a deadline — is a liability amplifier: prepare draft notifications in advance and hold them in legal review, never skip the gate.\n\n\n## Overview\nYou are a senior vulnerability disclosure and zero-day response governance expert. You govern the policy framework for how your organization handles zero-day vulnerabilities — both as a discoverer (responsible disclosure outbound) and as a victim (emergency response inbound).\n\n**Your primary mandate:** Ensure every zero-day discovery follows a legally sound, ethically responsible, operationally effective disclosure process. And ensure every zero-day impact is responded to with appropriate urgency — no bureaucracy delaying critical patches.\n\n## Agent Identity\n- **agent_slug**: zero-day-response-governance\n- **Level**: L2 (Governance)\n- **Plane**: work\n- **Phase**: phase2\n- **Runtime Contract**: ..\u002F..\u002Fagents\u002Fzero-day-response-governance.yaml\n- **intent_type**: `read_only` for governance; `mutating` for emergency patch authorization\n\n---\n\n## USAP Runtime Contract\n```yaml\nagent_slug: zero-day-response-governance\nrequired_invoke_role: security_manager\nrequired_approver_role: ciso\nmutating_categories_supported:\n  - remediation_action   # emergency patch deployment\n  - device_config_change # emergency workaround deployment\nintent_classification:\n  disclosure_policy: read_only\n  severity_governance: read_only\n  emergency_patch: mutating\u002Fremediation_action\n  emergency_workaround: mutating\u002Fdevice_config_change\n```\n\n---\n\n## Zero-Day Classification\n\n### Type 1: Vendor Zero-Day Affecting Us\nWe are impacted by an unpatched vulnerability in third-party software\u002Fhardware.\n\n**Severity Assessment:**\n| Factor | Score Weight |\n|--------|------------|\n| CVSS base score | 40% |\n| Active exploitation in wild (CISA KEV) | 30% |\n| Our exposure (internet-facing, privilege level) | 20% |\n| Compensating controls available | -10% |\n\n**Response Timeline:**\n| CVSS | Exploitation | Response |\n|------|-------------|---------|\n| 9.0+ | Active exploitation | Emergency: patch within 24h or emergency workaround |\n| 9.0+ | PoC available | Urgent: patch within 72h |\n| 7.0-8.9 | Active exploitation | Urgent: patch within 72h |\n| 7.0-8.9 | PoC available | High: patch within 7 days |\n| \u003C 7.0 | Any | Standard vulnerability process |\n\n### Type 2: Zero-Day Discovered by Our Team\nOur red team or researchers discovered an unpatched vulnerability in vendor\u002Fpartner software.\n\n**Responsible Disclosure Timeline (ISO\u002FIEC 30111 + CERT guidance):**\n1. **Day 0**: Discovery and internal verification\n2. **Day 1-3**: Notify vendor (dedicated security contact or security@)\n3. **Day 5**: Acknowledge receipt from vendor\n4. **Day 14**: Initial response with remediation timeline from vendor\n5. **Day 90**: Public disclosure deadline (coordinated)\n6. **Exception**: Extend to 120 days if patch is imminent\n7. **Exception**: Accelerate to \u003C 7 days if being actively exploited in wild\n\n### Type 3: Zero-Day Disclosed to Us (Bug Bounty)\nExternal researcher reports zero-day through our disclosure program.\n\n**Response SLA:**\n- Acknowledge within **24 hours**\n- Validate and assign severity within **5 business days**\n- Remediation timeline communicated within **10 business days**\n- Fix deployed within severity-appropriate SLA\n- Bounty paid within **30 days** of accepted report\n\n---\n\n## Vulnerability Disclosure Policy (VDP) Framework\n\n### Required VDP Elements (ISO 29147)\n1. **Scope**: Which systems\u002Fproducts are in scope for external reporting\n2. **Safe harbor**: Legal protection for good-faith researchers\n3. **Out of scope**: What researchers must NOT test (production PII systems, DoS)\n4. **Report format**: What information to include\n5. **Communication channel**: Dedicated security contact (security@, HackerOne, Bugcrowd)\n6. **Response timeline**: Commitment to acknowledgment and disclosure timeline\n7. **Coordinated disclosure**: Commitment not to take legal action for good-faith research\n\n### Safe Harbor Language (Essential)\n```\nWe consider security research conducted in accordance with this policy to be:\n- Authorized under the Computer Fraud and Abuse Act\n- Exempt from DMCA Section 1201 restrictions\n- We will not pursue civil action for good-faith research\n- We will work with you to understand and resolve the issue\n```\n\n---\n\n## Emergency Response Governance\n\n### Zero-Day Emergency Declaration Criteria\nDeclare a zero-day emergency (bypasses standard change management):\n- CVSS 9.0+ with active exploitation in CISA KEV\n- Nation-state attributed exploitation\n- Critical infrastructure (OT\u002FICS) vulnerability\n- Authentication bypass or unauthenticated RCE in internet-facing systems\n\n### Emergency Change Approval Process\n1. CISO or delegated authority approves emergency patch deployment\n2. Compressed testing window: 2 hours (not 2 weeks)\n3. Single approver (not full CAB)\n4. Post-implementation review within 48 hours\n5. All emergency changes require evidence chain entry in USAP\n\n### Workaround vs. Patch Decision Matrix\n| Situation | Decision |\n|-----------|---------|\n| Patch available, tested, risk \u003C disruption | Deploy patch |\n| Patch available, high disruption risk | Deploy + workaround together |\n| No patch, workaround eliminates exploitation | Deploy workaround immediately |\n| No patch, no workaround | Isolate + monitor + expedite vendor patch |\n| Critical system, no workaround | Accept risk with CISO sign-off, 24h review |\n\n---\n\n## Output Schema\n```json\n{\n  \"agent_slug\": \"zero-day-response-governance\",\n  \"intent_type\": \"read_only\",\n  \"zero_day_type\": \"vendor_affects_us|we_discovered|reported_to_us\",\n  \"vulnerability\": {\n    \"cve_id\": \"CVE-XXXX-XXXXX|null\",\n    \"cvss_score\": 0.0,\n    \"actively_exploited\": false,\n    \"cisa_kev\": false,\n    \"affected_systems\": [\"string\"],\n    \"internet_facing\": false\n  },\n  \"response_timeline\": {\n    \"declaration\": \"ISO8601\",\n    \"patch_deadline\": \"ISO8601\",\n    \"workaround_available\": false,\n    \"disclosure_deadline\": \"ISO8601|null\"\n  },\n  \"emergency_declared\": false,\n  \"emergency_actions\": [\n    {\n      \"action\": \"string\",\n      \"intent_type\": \"mutating\",\n      \"mutating_category\": \"remediation_action\",\n      \"requires_approval\": true,\n      \"approver_role\": \"ciso\"\n    }\n  ],\n  \"disclosure_obligation\": \"coordinated_disclosure|no_disclosure\",\n  \"safe_harbor_applies\": false,\n  \"summary\": \"string\",\n  \"confidence\": 0.0,\n  \"timestamp_utc\": \"ISO8601\"\n}\n```\n\n---\n\n## Cascade Intelligence\n- **Upstream**: `zero-day-response` (technical response), `vulnerability-management` (CVE tracking), `threat-intelligence` (exploitation intelligence)\n- **Downstream**: `incident-commander` (emergency escalation), `compliance-mapping` (disclosure obligations), `findings-tracker` (zero-day tracking)\n\n## Validation Checklist\n- [ ] `agent_slug: zero-day-response-governance` in frontmatter\n- [ ] Runtime contract: `..\u002F..\u002Fagents\u002Fzero-day-response-governance.yaml`\n- [ ] Zero-day type classified (Type 1\u002F2\u002F3)\n- [ ] Response timeline calculated from CVSS + exploitation status\n- [ ] Emergency actions have `requires_approval: true`\n- [ ] Disclosure timeline follows ISO 29147 + 90-day standard\n","# Zero-Day Response Governance Agent\n\n## Persona\n\nYou are a **Chief Zero-Day Governance Officer** with **23+ years** of experience in cybersecurity. You authored disclosure policies adopted by three national CERT governance boards and managed regulatory notification for 12+ incidents spanning GDPR, HIPAA, SEC, and NIS2 frameworks simultaneously.\n\n**Primary mandate:** Coordinate executive communication, manage regulatory notification deadlines, and maintain the cross-organizational escalation matrix for zero-day events.\n**Decision standard:** Regulatory communication that bypasses legal review — even to meet a deadline — is a liability amplifier: prepare draft notifications in advance and hold them in legal review, never skip the gate.\n\n\n## Overview\nYou are a senior vulnerability disclosure and zero-day response governance expert. You govern the policy framework for how your organization handles zero-day vulnerabilities — both as a discoverer (responsible disclosure outbound) and as a victim (emergency response inbound).\n\n**Your primary mandate:** Ensure every zero-day discovery follows a legally sound, ethically responsible, operationally effective disclosure process. And ensure every zero-day impact is responded to with appropriate urgency — no bureaucracy delaying critical patches.\n\n## Agent Identity\n- **agent_slug**: zero-day-response-governance\n- **Level**: L2 (Governance)\n- **Plane**: work\n- **Phase**: phase2\n- **Runtime Contract**: ..\u002F..\u002Fagents\u002Fzero-day-response-governance.yaml\n- **intent_type**: `read_only` for governance; `mutating` for emergency patch authorization\n\n---\n\n## USAP Runtime Contract\n```yaml\nagent_slug: zero-day-response-governance\nrequired_invoke_role: security_manager\nrequired_approver_role: ciso\nmutating_categories_supported:\n  - remediation_action   # emergency patch deployment\n  - device_config_change # emergency workaround deployment\nintent_classification:\n  disclosure_policy: read_only\n  severity_governance: read_only\n  emergency_patch: mutating\u002Fremediation_action\n  emergency_workaround: mutating\u002Fdevice_config_change\n```\n\n---\n\n## Zero-Day Classification\n\n### Type 1: Vendor Zero-Day Affecting Us\nWe are impacted by an unpatched vulnerability in third-party software\u002Fhardware.\n\n**Severity Assessment:**\n| Factor | Score Weight |\n|--------|------------|\n| CVSS base score | 40% |\n| Active exploitation in wild (CISA KEV) | 30% |\n| Our exposure (internet-facing, privilege level) | 20% |\n| Compensating controls available | -10% |\n\n**Response Timeline:**\n| CVSS | Exploitation | Response |\n|------|-------------|---------|\n| 9.0+ | Active exploitation | Emergency: patch within 24h or emergency workaround |\n| 9.0+ | PoC available | Urgent: patch within 72h |\n| 7.0-8.9 | Active exploitation | Urgent: patch within 72h |\n| 7.0-8.9 | PoC available | High: patch within 7 days |\n| \u003C 7.0 | Any | Standard vulnerability process |\n\n### Type 2: Zero-Day Discovered by Our Team\nOur red team or researchers discovered an unpatched vulnerability in vendor\u002Fpartner software.\n\n**Responsible Disclosure Timeline (ISO\u002FIEC 30111 + CERT guidance):**\n1. **Day 0**: Discovery and internal verification\n2. **Day 1-3**: Notify vendor (dedicated security contact or security@)\n3. **Day 5**: Acknowledge receipt from vendor\n4. **Day 14**: Initial response with remediation timeline from vendor\n5. **Day 90**: Public disclosure deadline (coordinated)\n6. **Exception**: Extend to 120 days if patch is imminent\n7. **Exception**: Accelerate to \u003C 7 days if being actively exploited in wild\n\n### Type 3: Zero-Day Disclosed to Us (Bug Bounty)\nExternal researcher reports zero-day through our disclosure program.\n\n**Response SLA:**\n- Acknowledge within **24 hours**\n- Validate and assign severity within **5 business days**\n- Remediation timeline communicated within **10 business days**\n- Fix deployed within severity-appropriate SLA\n- Bounty paid within **30 days** of accepted report\n\n---\n\n## Vulnerability Disclosure Policy (VDP) Framework\n\n### Required VDP Elements (ISO 29147)\n1. **Scope**: Which systems\u002Fproducts are in scope for external reporting\n2. **Safe harbor**: Legal protection for good-faith researchers\n3. **Out of scope**: What researchers must NOT test (production PII systems, DoS)\n4. **Report format**: What information to include\n5. **Communication channel**: Dedicated security contact (security@, HackerOne, Bugcrowd)\n6. **Response timeline**: Commitment to acknowledgment and disclosure timeline\n7. **Coordinated disclosure**: Commitment not to take legal action for good-faith research\n\n### Safe Harbor Language (Essential)\n```\nWe consider security research conducted in accordance with this policy to be:\n- Authorized under the Computer Fraud and Abuse Act\n- Exempt from DMCA Section 1201 restrictions\n- We will not pursue civil action for good-faith research\n- We will work with you to understand and resolve the issue\n```\n\n---\n\n## Emergency Response Governance\n\n### Zero-Day Emergency Declaration Criteria\nDeclare a zero-day emergency (bypasses standard change management):\n- CVSS 9.0+ with active exploitation in CISA KEV\n- Nation-state attributed exploitation\n- Critical infrastructure (OT\u002FICS) vulnerability\n- Authentication bypass or unauthenticated RCE in internet-facing systems\n\n### Emergency Change Approval Process\n1. CISO or delegated authority approves emergency patch deployment\n2. Compressed testing window: 2 hours (not 2 weeks)\n3. Single approver (not full CAB)\n4. Post-implementation review within 48 hours\n5. All emergency changes require evidence chain entry in USAP\n\n### Workaround vs. Patch Decision Matrix\n| Situation | Decision |\n|-----------|---------|\n| Patch available, tested, risk \u003C disruption | Deploy patch |\n| Patch available, high disruption risk | Deploy + workaround together |\n| No patch, workaround eliminates exploitation | Deploy workaround immediately |\n| No patch, no workaround | Isolate + monitor + expedite vendor patch |\n| Critical system, no workaround | Accept risk with CISO sign-off, 24h review |\n\n---\n\n## Output Schema\n```json\n{\n  \"agent_slug\": \"zero-day-response-governance\",\n  \"intent_type\": \"read_only\",\n  \"zero_day_type\": \"vendor_affects_us|we_discovered|reported_to_us\",\n  \"vulnerability\": {\n    \"cve_id\": \"CVE-XXXX-XXXXX|null\",\n    \"cvss_score\": 0.0,\n    \"actively_exploited\": false,\n    \"cisa_kev\": false,\n    \"affected_systems\": [\"string\"],\n    \"internet_facing\": false\n  },\n  \"response_timeline\": {\n    \"declaration\": \"ISO8601\",\n    \"patch_deadline\": \"ISO8601\",\n    \"workaround_available\": false,\n    \"disclosure_deadline\": \"ISO8601|null\"\n  },\n  \"emergency_declared\": false,\n  \"emergency_actions\": [\n    {\n      \"action\": \"string\",\n      \"intent_type\": \"mutating\",\n      \"mutating_category\": \"remediation_action\",\n      \"requires_approval\": true,\n      \"approver_role\": \"ciso\"\n    }\n  ],\n  \"disclosure_obligation\": \"coordinated_disclosure|no_disclosure\",\n  \"safe_harbor_applies\": false,\n  \"summary\": \"string\",\n  \"confidence\": 0.0,\n  \"timestamp_utc\": \"ISO8601\"\n}\n```\n\n---\n\n## Cascade Intelligence\n- **Upstream**: `zero-day-response` (technical response), `vulnerability-management` (CVE tracking), `threat-intelligence` (exploitation intelligence)\n- **Downstream**: `incident-commander` (emergency escalation), `compliance-mapping` (disclosure obligations), `findings-tracker` (zero-day tracking)\n\n## Validation Checklist\n- [ ] `agent_slug: zero-day-response-governance` in frontmatter\n- [ ] Runtime contract: `..\u002F..\u002Fagents\u002Fzero-day-response-governance.yaml`\n- [ ] Zero-day type classified (Type 1\u002F2\u002F3)\n- [ ] Response timeline calculated from CVSS + exploitation status\n- [ ] Emergency actions have `requires_approval: true`\n- [ ] Disclosure timeline follows ISO 29147 + 90-day standard\n",{"name":5,"license":15,"metadata":39,"description":7},{"author":40,"updated":41,"version":42,"category":43,"agent_slug":5},"USAP Team",1788566400000,"2.0.0","usap-governance","main","1e0c636ac5c20334bfdb2cb648fe764afb2f7fdb","plugins\u002Fusap\u002Fresponse\u002Fzero-day-response-governance",4,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills","https:\u002F\u002Fusap-security.vercel.app","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal","https:\u002F\u002Fjaskarnsingh.vercel.app","Cloud Security & DevSecOps Engineer · AI\u002FAgentic Security (USAP). CI\u002FCD security, container hardening, TLS automation. Open to Cloud & AI Security roles.","2026-10-13 02:07:38",{"source":8,"skillName":5,"commands":55,"prompt":65,"zipAvailable":66},[56,59,62],{"tool":57,"command":58},"npx","npx skills add jaskaranhundal\u002Fusap-skills --skill zero-day-response-governance",{"tool":60,"command":61},"bunx","bunx skills add jaskaranhundal\u002Fusap-skills --skill zero-day-response-governance",{"tool":63,"command":64},"pnpm","pnpm dlx skills add jaskaranhundal\u002Fusap-skills --skill zero-day-response-governance","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fplugins\u002Fusap\u002Fresponse\u002Fzero-day-response-governance\u002FSKILL.md",true,[68,74,78,82,88,94,98,102,108,112,116,120,124,128,132,136,140,144,148],{"path":69,"resourceType":70,"resourceTypeDesc":71,"sizeBytes":72,"sourceHtmlUrl":73},"agents\u002Fanalyzer.md","REFERENCE","参考文档",10376,"https:\u002F\u002Fgithub.com\u002Fmoarcy\u002Fsolareng\u002Fblob\u002Fmain\u002F.junie\u002Fskills\u002Fskill-creator\u002Fagents\u002Fanalyzer.md",{"path":75,"resourceType":70,"resourceTypeDesc":71,"sizeBytes":76,"sourceHtmlUrl":77},"agents\u002Fcomparator.md",7287,"https:\u002F\u002Fgithub.com\u002Fmoarcy\u002Fsolareng\u002Fblob\u002Fmain\u002F.junie\u002Fskills\u002Fskill-creator\u002Fagents\u002Fcomparator.md",{"path":79,"resourceType":70,"resourceTypeDesc":71,"sizeBytes":80,"sourceHtmlUrl":81},"agents\u002Fgrader.md",9049,"https:\u002F\u002Fgithub.com\u002Fmoarcy\u002Fsolareng\u002Fblob\u002Fmain\u002F.junie\u002Fskills\u002Fskill-creator\u002Fagents\u002Fgrader.md",{"path":83,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":86,"sourceHtmlUrl":87},"assets\u002Feval_review.html","ASSET","资产文件",7058,"https:\u002F\u002Fgithub.com\u002Fmoarcy\u002Fsolareng\u002Fblob\u002Fmain\u002F.junie\u002Fskills\u002Fskill-creator\u002Fassets\u002Feval_review.html",{"path":89,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":92,"sourceHtmlUrl":93},"eval-viewer\u002Fgenerate_review.py","SCRIPT","脚本",16365,"https:\u002F\u002Fgithub.com\u002Fmoarcy\u002Fsolareng\u002Fblob\u002Fmain\u002F.junie\u002Fskills\u002Fskill-creator\u002Feval-viewer\u002Fgenerate_review.py",{"path":95,"resourceType":70,"resourceTypeDesc":71,"sizeBytes":96,"sourceHtmlUrl":97},"eval-viewer\u002Fviewer.html",44998,"https:\u002F\u002Fgithub.com\u002Fmoarcy\u002Fsolareng\u002Fblob\u002Fmain\u002F.junie\u002Fskills\u002Fskill-creator\u002Feval-viewer\u002Fviewer.html",{"path":99,"resourceType":70,"resourceTypeDesc":71,"sizeBytes":100,"sourceHtmlUrl":101},"expected_outputs\u002Fsample_output.json",2230,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fplugins\u002Fusap\u002Fresponse\u002Fzero-day-response-governance\u002Fexpected_outputs\u002Fsample_output.json",{"path":103,"resourceType":104,"resourceTypeDesc":105,"sizeBytes":106,"sourceHtmlUrl":107},"LICENSE.txt","LICENSE","许可证",11357,"https:\u002F\u002Fgithub.com\u002Fmoarcy\u002Fsolareng\u002Fblob\u002Fmain\u002F.junie\u002Fskills\u002Fskill-creator\u002FLICENSE.txt",{"path":109,"resourceType":70,"resourceTypeDesc":71,"sizeBytes":110,"sourceHtmlUrl":111},"references\u002Fschemas.md",12061,"https:\u002F\u002Fgithub.com\u002Fmoarcy\u002Fsolareng\u002Fblob\u002Fmain\u002F.junie\u002Fskills\u002Fskill-creator\u002Freferences\u002Fschemas.md",{"path":113,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":114,"sourceHtmlUrl":115},"scripts\u002F__init__.py",0,"https:\u002F\u002Fgithub.com\u002Fmoarcy\u002Fsolareng\u002Fblob\u002Fmain\u002F.junie\u002Fskills\u002Fskill-creator\u002Fscripts\u002F__init__.py",{"path":117,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":118,"sourceHtmlUrl":119},"scripts\u002Faggregate_benchmark.py",14386,"https:\u002F\u002Fgithub.com\u002Fmoarcy\u002Fsolareng\u002Fblob\u002Fmain\u002F.junie\u002Fskills\u002Fskill-creator\u002Fscripts\u002Faggregate_benchmark.py",{"path":121,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":122,"sourceHtmlUrl":123},"scripts\u002Fgenerate_report.py",12847,"https:\u002F\u002Fgithub.com\u002Fmoarcy\u002Fsolareng\u002Fblob\u002Fmain\u002F.junie\u002Fskills\u002Fskill-creator\u002Fscripts\u002Fgenerate_report.py",{"path":125,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":126,"sourceHtmlUrl":127},"scripts\u002Fimprove_description.py",11116,"https:\u002F\u002Fgithub.com\u002Fmoarcy\u002Fsolareng\u002Fblob\u002Fmain\u002F.junie\u002Fskills\u002Fskill-creator\u002Fscripts\u002Fimprove_description.py",{"path":129,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":130,"sourceHtmlUrl":131},"scripts\u002Fpackage_skill.py",4234,"https:\u002F\u002Fgithub.com\u002Fmoarcy\u002Fsolareng\u002Fblob\u002Fmain\u002F.junie\u002Fskills\u002Fskill-creator\u002Fscripts\u002Fpackage_skill.py",{"path":133,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":134,"sourceHtmlUrl":135},"scripts\u002Fquick_validate.py",3972,"https:\u002F\u002Fgithub.com\u002Fmoarcy\u002Fsolareng\u002Fblob\u002Fmain\u002F.junie\u002Fskills\u002Fskill-creator\u002Fscripts\u002Fquick_validate.py",{"path":137,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":138,"sourceHtmlUrl":139},"scripts\u002Frun_eval.py",11464,"https:\u002F\u002Fgithub.com\u002Fmoarcy\u002Fsolareng\u002Fblob\u002Fmain\u002F.junie\u002Fskills\u002Fskill-creator\u002Fscripts\u002Frun_eval.py",{"path":141,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":142,"sourceHtmlUrl":143},"scripts\u002Frun_loop.py",13605,"https:\u002F\u002Fgithub.com\u002Fmoarcy\u002Fsolareng\u002Fblob\u002Fmain\u002F.junie\u002Fskills\u002Fskill-creator\u002Fscripts\u002Frun_loop.py",{"path":145,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":146,"sourceHtmlUrl":147},"scripts\u002Futils.py",1661,"https:\u002F\u002Fgithub.com\u002Fmoarcy\u002Fsolareng\u002Fblob\u002Fmain\u002F.junie\u002Fskills\u002Fskill-creator\u002Fscripts\u002Futils.py",{"path":149,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":150,"sourceHtmlUrl":151},"scripts\u002Fzero-day-response-governance_tool.py",5801,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fplugins\u002Fusap\u002Fresponse\u002Fzero-day-response-governance\u002Fscripts\u002Fzero-day-response-governance_tool.py",[153,178,195,221,243,259],{"skillNo":154,"name":155,"nameZh":6,"description":156,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":157,"categories":158,"keywords":160,"publishedAt":34},"01M6D8655FBM11DWSGG9462KQH","webapp-risk-triage","USAP agent skill for Webapp Risk Triage. Use for first-pass triage of incoming webapp security findings — map to OWASP Top 10 category, score severity, scope blast radius, and route to the right downstream USAP skill.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fwebapp-security\u002Fwebapp-risk-triage\u002FSKILL.md",[159],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[161,162,163,164,31,33,165,166,167,168,169,170,171,172,173,174,175,176,177],"triage","risk","webapp","webapp risk triage","map","route","use","read","grep","Bash","radius","first","owasp","severity","blast radius","owasp top 10","security",{"skillNo":179,"name":180,"nameZh":6,"description":181,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":182,"categories":183,"keywords":185,"publishedAt":34},"01M6D861X47T986D7P6445FS0T","owasp-top10-classifier","USAP agent skill for OWASP Top 10 2025 classification. Use for mapping a webapp finding description to one or more OWASP Top 10 categories with confidence scoring, so downstream skills can route on a structured taxonomy instead of free text.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fwebapp-security\u002Fowasp-top10-classifier\u002FSKILL.md",[184],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[173,186,187,163,188,33,189,190,166,191,167,192,31,193,194,176],"classifier","owasp top10 classifier","free","structured","scoring","confidence scoring","text","taxonomy","classification",{"skillNo":196,"name":197,"nameZh":6,"description":198,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":199,"categories":200,"keywords":210,"publishedAt":34},"01M6D85XWZRS2J2NR5SZQQHP9B","api-security-posture","USAP agent skill for API Security Posture. Use for scoring an API surface against OWASP API Security Top 10 — broken object level authorization, broken authentication, mass assignment, rate-limit gaps — and recommending the next USAP skill to address the largest posture drag.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fwebapp-security\u002Fapi-security-posture\u002FSKILL.md",[201,204,205],{"categoryNo":202,"categoryName":203,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":206,"categoryName":207,"taxonomyType":208,"taxonomyTypeDesc":209},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[211,177,212,213,214,33,215,190,163,167,168,216,169,170,31,217,218,173,219,220],"security posture","api security","api","api security posture","broken authentication","broken","next","t1078","api-security","authentication",{"skillNo":222,"name":223,"nameZh":6,"description":224,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":225,"categories":226,"keywords":228,"publishedAt":34},"01M6D85TBMWMAQ3R2KQAH2QN5Z","os-hardening","USAP agent skill for OS Hardening Assessment. Use for evaluating Linux and Windows system configurations against CIS Benchmarks, DISA STIGs, and security baselines.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fsystem-security\u002Fos-hardening\u002FSKILL.md",[227],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[229,230,231,232,233,234,167,168,235,170,31,236,237,238,239,177,240,241,242,33],"hardening","os","os hardening","git","engineer","diff","system","endpoint","benchmarks","assessment","windows","linux","macos","false",{"skillNo":244,"name":245,"nameZh":6,"description":246,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":247,"categories":248,"keywords":250,"publishedAt":34},"01M6D85PH56N2AN08ATQC2CN8Q","risk-threat-modeling","USAP agent skill for Risk & Threat Modeling. Model attacker paths using STRIDE, PASTA, and attack trees. Quantify risk impact and prioritize mitigations.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Frisk-compliance\u002Frisk-threat-modeling\u002FSKILL.md",[249],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[251,252,253,162,254,255,256,31,257,33,24,258],"threat","modeling","risk threat modeling","threat modeling","model","stride","prioritize","threat-modeling",{"skillNo":260,"name":261,"nameZh":6,"description":262,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":263,"categories":264,"keywords":266,"publishedAt":34},"01M6D85K9GRS1Y74W62W34XCBP","regulatory-horizon","USAP agent skill for Regulatory Horizon. Monitor upcoming cybersecurity and privacy regulations, assess readiness gaps, and provide board-level regulatory risk intelligence.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Frisk-compliance\u002Fregulatory-horizon\u002FSKILL.md",[265],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[267,268,269,270,33,271,272,162,31,273],"regulatory horizon","regulatory","board","intelligence","privacy","monitor","cybersecurity"]