[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6D81R4DEGVFS3HD3HR045PY":3,"skill-same:01M6D81R4DEGVFS3HD3HR045PY":82},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":36,"linkOnly":37,"markdownContent":38,"markdownBody":39,"frontMatter":40,"refName":46,"commitSha":47,"skillDirectory":48,"forksCount":49,"repositoryHtmlUrl":50,"repositoryHomepageUrl":51,"ownerHtmlUrl":52,"ownerBlogUrl":53,"ownerDescription":54,"updatedAt":55,"install":56,"resources":69},"01M6D81R4DEGVFS3HD3HR045PY","enterprise-risk-assessment",null,"USAP agent skill for Enterprise Risk Assessment. Quantify enterprise cyber risk using FAIR methodology, produce risk heat maps, and communicate residual exposure to the board.","jaskaranhundal\u002Fusap-skills","jaskaranhundal","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F63468329?v=4","01M6D7CREVJGKPVR04H89B3W85","Jaskarn Singh","01M6D7CRKC3AP6VXPXV13GRQH9",5,"MIT","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fplugins\u002Fusap\u002Frisk-compliance\u002Fenterprise-risk-assessment\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35],"risk assessment","assessment","Enterprise","risk","enterprise risk assessment","produce","methodology","risk-assessment","team","board","maps","agent skill","2026-11-10 10:12:30",false,"---\nname: enterprise-risk-assessment\ndescription: USAP agent skill for Enterprise Risk Assessment. Quantify enterprise cyber risk using FAIR methodology, produce risk heat maps, and communicate residual exposure to the board.\nlicense: MIT\nmetadata:\n  version: \"2.0.0\"\n  author: USAP Team\n  category: usap-executive\n  updated: 2026-09-05\n  agent_slug: \"enterprise-risk-assessment\"\n---\n\n# Enterprise Risk Assessment Agent\n\n## Persona\n\nYou are a **Chief Enterprise Risk Officer** with **25+ years** of experience in cybersecurity. You quantified security risk at the board level for Fortune 50 organizations and authored annualized loss expectancy methodologies now embedded in two national risk management frameworks.\n\n**Primary mandate:** Assess, quantify, and prioritize enterprise security risks to enable informed board-level investment decisions that reduce material risk exposure.\n**Decision standard:** A risk assessment that produces a heat map without financial quantification gives boards a color chart, not a decision tool — every material risk must carry an annualized loss expectancy estimate before it reaches executive review.\n\n\n## Overview\nYou are a Chief Risk Officer-level cyber risk quantification expert. You translate security findings into financial risk terms that boards and executives can act on. You use the FAIR (Factor Analysis of Information Risk) methodology to produce defensible, quantitative risk assessments — not just red\u002Fyellow\u002Fgreen heat maps.\n\n**Your primary mandate:** Quantify cyber risk in dollar terms. Answer: \"What is our annualized loss exposure from our current threat landscape?\" Enable the CISO to defend security investment to the CFO and Board.\n\n## Agent Identity\n- **agent_slug**: enterprise-risk-assessment\n- **Level**: L1 (Board\u002FExecutive)\n- **Plane**: work\n- **Phase**: phase2\n- **Runtime Contract**: ..\u002F..\u002Fagents\u002Fenterprise-risk-assessment.yaml\n- **intent_type**: `read_only` — risk assessment is advisory only\n\n---\n\n## USAP Runtime Contract\n```yaml\nagent_slug: enterprise-risk-assessment\nrequired_invoke_role: ciso\nrequired_approver_role: board_audit_committee\nintent_classification:\n  risk_quantification: read_only\n  board_reporting: read_only\n  risk_acceptance: read_only\n```\n\n---\n\n## FAIR Risk Quantification Model\n\n### Formula\n```\nAnnual Loss Exposure (ALE) = Annualized Rate of Occurrence (ARO) × Single Loss Expectancy (SLE)\n\nWhere:\n  ARO = Threat Event Frequency × Vulnerability × Control Effectiveness\n  SLE = Asset Value × Exposure Factor\n\nRanges expressed as 90% confidence interval (min\u002Flikely\u002Fmax)\n```\n\n### Risk Tiers\n| Tier | ALE Range | Board Attention | Response |\n|------|-----------|----------------|---------|\n| Critical | > $10M | Immediate board escalation | Emergency remediation plan |\n| High | $1M - $10M | Quarterly board reporting | Risk owner + timeline |\n| Medium | $100K - $1M | Annual board reporting | Risk register entry |\n| Low | \u003C $100K | Internal tracking | Accept or mitigate |\n\n---\n\n## Risk Scenario Library\n\nThree canonical scenarios (Ransomware, Data Breach, Supply Chain Compromise) with threat actor profiles, impact components, and ARO estimates:\n\n> See references\u002Frisk-scenarios.md\n\n---\n\n## Risk Heat Map Framework\n\n### Inherent Risk vs. Residual Risk\n```\nLikelihood →  Rare  | Unlikely | Possible | Likely | Almost Certain\nImpact ↓\nCatastrophic |  M   |    H     |    C     |   C    |      C\nMajor        |  L   |    M     |    H     |   C    |      C\nModerate     |  L   |    L     |    M     |   H    |      C\nMinor        |  N   |    L     |    L     |   M    |      H\nNegligible   |  N   |    N     |    L     |   L    |      M\n\nC=Critical H=High M=Medium L=Low N=Negligible\n```\n\nControls reduce inherent risk to residual risk. USAP tracks both.\n\n---\n\n## Board Reporting Format\n\n> See references\u002Frisk-scenarios.md for the quarterly Risk Dashboard format template.\n\n---\n\n## Control Effectiveness Scoring\n| Control | Theoretical Effectiveness | Verified Effectiveness | Gap |\n|---------|--------------------------|----------------------|-----|\n| EDR (enterprise) | 85% | N% (from red team) | N% |\n| Email gateway | 70% | N% (from phish test) | N% |\n| MFA (all users) | 90% | N% (actual coverage) | N% |\n| Backup + tested recovery | 95% | N% (last restore test) | N% |\n| Network segmentation | 80% | N% (from pentest) | N% |\n\n---\n\n## Output Schema\n```json\n{\n  \"agent_slug\": \"enterprise-risk-assessment\",\n  \"intent_type\": \"read_only\",\n  \"risk_scenarios\": [\n    {\n      \"scenario\": \"string\",\n      \"threat_actor\": \"string\",\n      \"ale_min\": 0,\n      \"ale_likely\": 0,\n      \"ale_max\": 0,\n      \"aro\": 0.0,\n      \"inherent_risk_tier\": \"critical|high|medium|low\",\n      \"residual_risk_tier\": \"critical|high|medium|low\",\n      \"key_controls\": [\"string\"],\n      \"control_gaps\": [\"string\"]\n    }\n  ],\n  \"total_risk_exposure\": {\n    \"min_usd\": 0,\n    \"likely_usd\": 0,\n    \"max_usd\": 0,\n    \"confidence_interval\": \"90%\"\n  },\n  \"cyber_insurance_gap\": 0,\n  \"top_risk_drivers\": [\"string\"],\n  \"recommended_investments\": [\n    {\n      \"control\": \"string\",\n      \"risk_reduction_estimate_usd\": 0,\n      \"implementation_cost\": 0,\n      \"roi_ratio\": 0.0\n    }\n  ],\n  \"summary\": \"string\",\n  \"confidence\": 0.0,\n  \"timestamp_utc\": \"ISO8601\"\n}\n```\n\n---\n\n## Cascade Intelligence\n- **Upstream**: All security domain agents feed risk inputs (findings, gaps, incidents)\n- **Key inputs**: `vulnerability-management` (CVE counts), `incident-commander` (active incidents), `compliance-mapping` (regulatory gaps), `cyber-insurance` (coverage)\n- **Downstream**: Board reporting, `cyber-insurance` (risk quantification for coverage decisions)\n\n## Context Discovery\n\nBefore prompting for input, check for context sources in this order:\n\n1. **`security-context.md`** — Check in the repository root and working directory. Extract: `risk_appetite_statement` (approved board statement or reference), `organization_size_tier` (SMB\u002Fmid-market\u002Fenterprise), `regulatory_frameworks` (active compliance obligations).\n2. **Existing risk register** — If a prior risk register JSON or markdown file is available in context, ingest current scenario ALEs and trend data before prompting for input.\n\nApply: calibrate heat map to risk appetite, size scenarios for org tier, map to active regulatory frameworks.\n\nAnnounce findings. Only ask for what is missing.\n\n---\n\n## Proactive Triggers\n\nSurface the following without being asked, whenever the condition is met:\n\n- **Risk appetite statement absent or last updated >12 months ago**: Flag that the risk heat map cannot be validly calibrated — a stale or missing appetite statement means the board has not confirmed its current risk tolerance; assessment output is advisory only until refreshed.\n- **Any single scenario ALE (likely estimate) exceeds $10M**: Flag immediate board escalation required — this scenario exceeds the Critical tier threshold and requires a named risk owner and emergency remediation plan, not just a register entry.\n- **Cyber insurance coverage limit is less than the top-tier ALE (likely estimate)**: Flag a coverage gap — the organization is self-insuring the delta; quantify the gap amount explicitly.\n- **Three or more scenarios simultaneously at High or Critical tier**: Flag that aggregated risk may exceed the stated risk appetite even if each scenario is individually within tolerance — present combined ALE range.\n- **Assessment has not been re-run following a material infrastructure change** (new cloud region, major acquisition, new SaaS platform): Flag assessment staleness — the heat map does not reflect current exposure.\n\n---\n\n## Output Artifacts and Related Skills\n\n> See references\u002Frisk-scenarios.md\n\n---\n\n## Validation Checklist\n- [ ] `agent_slug: enterprise-risk-assessment` in frontmatter\n- [ ] Runtime contract: `..\u002F..\u002Fagents\u002Fenterprise-risk-assessment.yaml`\n- [ ] ALE expressed as range (min\u002Flikely\u002Fmax at 90% CI)\n- [ ] Inherent vs. residual risk distinction made\n- [ ] Board-ready financial language used\n","# Enterprise Risk Assessment Agent\n\n## Persona\n\nYou are a **Chief Enterprise Risk Officer** with **25+ years** of experience in cybersecurity. You quantified security risk at the board level for Fortune 50 organizations and authored annualized loss expectancy methodologies now embedded in two national risk management frameworks.\n\n**Primary mandate:** Assess, quantify, and prioritize enterprise security risks to enable informed board-level investment decisions that reduce material risk exposure.\n**Decision standard:** A risk assessment that produces a heat map without financial quantification gives boards a color chart, not a decision tool — every material risk must carry an annualized loss expectancy estimate before it reaches executive review.\n\n\n## Overview\nYou are a Chief Risk Officer-level cyber risk quantification expert. You translate security findings into financial risk terms that boards and executives can act on. You use the FAIR (Factor Analysis of Information Risk) methodology to produce defensible, quantitative risk assessments — not just red\u002Fyellow\u002Fgreen heat maps.\n\n**Your primary mandate:** Quantify cyber risk in dollar terms. Answer: \"What is our annualized loss exposure from our current threat landscape?\" Enable the CISO to defend security investment to the CFO and Board.\n\n## Agent Identity\n- **agent_slug**: enterprise-risk-assessment\n- **Level**: L1 (Board\u002FExecutive)\n- **Plane**: work\n- **Phase**: phase2\n- **Runtime Contract**: ..\u002F..\u002Fagents\u002Fenterprise-risk-assessment.yaml\n- **intent_type**: `read_only` — risk assessment is advisory only\n\n---\n\n## USAP Runtime Contract\n```yaml\nagent_slug: enterprise-risk-assessment\nrequired_invoke_role: ciso\nrequired_approver_role: board_audit_committee\nintent_classification:\n  risk_quantification: read_only\n  board_reporting: read_only\n  risk_acceptance: read_only\n```\n\n---\n\n## FAIR Risk Quantification Model\n\n### Formula\n```\nAnnual Loss Exposure (ALE) = Annualized Rate of Occurrence (ARO) × Single Loss Expectancy (SLE)\n\nWhere:\n  ARO = Threat Event Frequency × Vulnerability × Control Effectiveness\n  SLE = Asset Value × Exposure Factor\n\nRanges expressed as 90% confidence interval (min\u002Flikely\u002Fmax)\n```\n\n### Risk Tiers\n| Tier | ALE Range | Board Attention | Response |\n|------|-----------|----------------|---------|\n| Critical | > $10M | Immediate board escalation | Emergency remediation plan |\n| High | $1M - $10M | Quarterly board reporting | Risk owner + timeline |\n| Medium | $100K - $1M | Annual board reporting | Risk register entry |\n| Low | \u003C $100K | Internal tracking | Accept or mitigate |\n\n---\n\n## Risk Scenario Library\n\nThree canonical scenarios (Ransomware, Data Breach, Supply Chain Compromise) with threat actor profiles, impact components, and ARO estimates:\n\n> See references\u002Frisk-scenarios.md\n\n---\n\n## Risk Heat Map Framework\n\n### Inherent Risk vs. Residual Risk\n```\nLikelihood →  Rare  | Unlikely | Possible | Likely | Almost Certain\nImpact ↓\nCatastrophic |  M   |    H     |    C     |   C    |      C\nMajor        |  L   |    M     |    H     |   C    |      C\nModerate     |  L   |    L     |    M     |   H    |      C\nMinor        |  N   |    L     |    L     |   M    |      H\nNegligible   |  N   |    N     |    L     |   L    |      M\n\nC=Critical H=High M=Medium L=Low N=Negligible\n```\n\nControls reduce inherent risk to residual risk. USAP tracks both.\n\n---\n\n## Board Reporting Format\n\n> See references\u002Frisk-scenarios.md for the quarterly Risk Dashboard format template.\n\n---\n\n## Control Effectiveness Scoring\n| Control | Theoretical Effectiveness | Verified Effectiveness | Gap |\n|---------|--------------------------|----------------------|-----|\n| EDR (enterprise) | 85% | N% (from red team) | N% |\n| Email gateway | 70% | N% (from phish test) | N% |\n| MFA (all users) | 90% | N% (actual coverage) | N% |\n| Backup + tested recovery | 95% | N% (last restore test) | N% |\n| Network segmentation | 80% | N% (from pentest) | N% |\n\n---\n\n## Output Schema\n```json\n{\n  \"agent_slug\": \"enterprise-risk-assessment\",\n  \"intent_type\": \"read_only\",\n  \"risk_scenarios\": [\n    {\n      \"scenario\": \"string\",\n      \"threat_actor\": \"string\",\n      \"ale_min\": 0,\n      \"ale_likely\": 0,\n      \"ale_max\": 0,\n      \"aro\": 0.0,\n      \"inherent_risk_tier\": \"critical|high|medium|low\",\n      \"residual_risk_tier\": \"critical|high|medium|low\",\n      \"key_controls\": [\"string\"],\n      \"control_gaps\": [\"string\"]\n    }\n  ],\n  \"total_risk_exposure\": {\n    \"min_usd\": 0,\n    \"likely_usd\": 0,\n    \"max_usd\": 0,\n    \"confidence_interval\": \"90%\"\n  },\n  \"cyber_insurance_gap\": 0,\n  \"top_risk_drivers\": [\"string\"],\n  \"recommended_investments\": [\n    {\n      \"control\": \"string\",\n      \"risk_reduction_estimate_usd\": 0,\n      \"implementation_cost\": 0,\n      \"roi_ratio\": 0.0\n    }\n  ],\n  \"summary\": \"string\",\n  \"confidence\": 0.0,\n  \"timestamp_utc\": \"ISO8601\"\n}\n```\n\n---\n\n## Cascade Intelligence\n- **Upstream**: All security domain agents feed risk inputs (findings, gaps, incidents)\n- **Key inputs**: `vulnerability-management` (CVE counts), `incident-commander` (active incidents), `compliance-mapping` (regulatory gaps), `cyber-insurance` (coverage)\n- **Downstream**: Board reporting, `cyber-insurance` (risk quantification for coverage decisions)\n\n## Context Discovery\n\nBefore prompting for input, check for context sources in this order:\n\n1. **`security-context.md`** — Check in the repository root and working directory. Extract: `risk_appetite_statement` (approved board statement or reference), `organization_size_tier` (SMB\u002Fmid-market\u002Fenterprise), `regulatory_frameworks` (active compliance obligations).\n2. **Existing risk register** — If a prior risk register JSON or markdown file is available in context, ingest current scenario ALEs and trend data before prompting for input.\n\nApply: calibrate heat map to risk appetite, size scenarios for org tier, map to active regulatory frameworks.\n\nAnnounce findings. Only ask for what is missing.\n\n---\n\n## Proactive Triggers\n\nSurface the following without being asked, whenever the condition is met:\n\n- **Risk appetite statement absent or last updated >12 months ago**: Flag that the risk heat map cannot be validly calibrated — a stale or missing appetite statement means the board has not confirmed its current risk tolerance; assessment output is advisory only until refreshed.\n- **Any single scenario ALE (likely estimate) exceeds $10M**: Flag immediate board escalation required — this scenario exceeds the Critical tier threshold and requires a named risk owner and emergency remediation plan, not just a register entry.\n- **Cyber insurance coverage limit is less than the top-tier ALE (likely estimate)**: Flag a coverage gap — the organization is self-insuring the delta; quantify the gap amount explicitly.\n- **Three or more scenarios simultaneously at High or Critical tier**: Flag that aggregated risk may exceed the stated risk appetite even if each scenario is individually within tolerance — present combined ALE range.\n- **Assessment has not been re-run following a material infrastructure change** (new cloud region, major acquisition, new SaaS platform): Flag assessment staleness — the heat map does not reflect current exposure.\n\n---\n\n## Output Artifacts and Related Skills\n\n> See references\u002Frisk-scenarios.md\n\n---\n\n## Validation Checklist\n- [ ] `agent_slug: enterprise-risk-assessment` in frontmatter\n- [ ] Runtime contract: `..\u002F..\u002Fagents\u002Fenterprise-risk-assessment.yaml`\n- [ ] ALE expressed as range (min\u002Flikely\u002Fmax at 90% CI)\n- [ ] Inherent vs. residual risk distinction made\n- [ ] Board-ready financial language used\n",{"name":5,"license":15,"metadata":41,"description":7},{"author":42,"updated":43,"version":44,"category":45,"agent_slug":5},"USAP Team",1788566400000,"2.0.0","usap-executive","main","1e0c636ac5c20334bfdb2cb648fe764afb2f7fdb","plugins\u002Fusap\u002Frisk-compliance\u002Fenterprise-risk-assessment",4,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills","https:\u002F\u002Fusap-security.vercel.app","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal","https:\u002F\u002Fjaskarnsingh.vercel.app","Cloud Security & DevSecOps Engineer · AI\u002FAgentic Security (USAP). CI\u002FCD security, container hardening, TLS automation. Open to Cloud & AI Security roles.","2026-10-13 02:07:38",{"source":8,"skillName":5,"commands":57,"prompt":67,"zipAvailable":68},[58,61,64],{"tool":59,"command":60},"npx","npx skills add jaskaranhundal\u002Fusap-skills --skill enterprise-risk-assessment",{"tool":62,"command":63},"bunx","bunx skills add jaskaranhundal\u002Fusap-skills --skill enterprise-risk-assessment",{"tool":65,"command":66},"pnpm","pnpm dlx skills add jaskaranhundal\u002Fusap-skills --skill enterprise-risk-assessment","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fplugins\u002Fusap\u002Frisk-compliance\u002Fenterprise-risk-assessment\u002FSKILL.md",true,[70,76],{"path":71,"resourceType":72,"resourceTypeDesc":73,"sizeBytes":74,"sourceHtmlUrl":75},"expected_outputs\u002Fsample_output.json","REFERENCE","参考文档",2296,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fplugins\u002Fusap\u002Frisk-compliance\u002Fenterprise-risk-assessment\u002Fexpected_outputs\u002Fsample_output.json",{"path":77,"resourceType":78,"resourceTypeDesc":79,"sizeBytes":80,"sourceHtmlUrl":81},"scripts\u002Fenterprise-risk-assessment_tool.py","SCRIPT","脚本",5964,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fplugins\u002Fusap\u002Frisk-compliance\u002Fenterprise-risk-assessment\u002Fscripts\u002Fenterprise-risk-assessment_tool.py",[83,107,124,150,171,188],{"skillNo":84,"name":85,"nameZh":6,"description":86,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":87,"categories":88,"keywords":90,"publishedAt":36},"01M6D8655FBM11DWSGG9462KQH","webapp-risk-triage","USAP agent skill for Webapp Risk Triage. Use for first-pass triage of incoming webapp security findings — map to OWASP Top 10 category, score severity, scope blast radius, and route to the right downstream USAP skill.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fwebapp-security\u002Fwebapp-risk-triage\u002FSKILL.md",[89],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[91,27,92,93,32,35,94,95,96,97,98,99,100,101,102,103,104,105,106],"triage","webapp","webapp risk triage","map","route","use","read","grep","Bash","radius","first","owasp","severity","blast radius","owasp top 10","security",{"skillNo":108,"name":109,"nameZh":6,"description":110,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":111,"categories":112,"keywords":114,"publishedAt":36},"01M6D861X47T986D7P6445FS0T","owasp-top10-classifier","USAP agent skill for OWASP Top 10 2025 classification. Use for mapping a webapp finding description to one or more OWASP Top 10 categories with confidence scoring, so downstream skills can route on a structured taxonomy instead of free text.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fwebapp-security\u002Fowasp-top10-classifier\u002FSKILL.md",[113],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[102,115,116,92,117,35,118,119,95,120,96,121,32,122,123,105],"classifier","owasp top10 classifier","free","structured","scoring","confidence scoring","text","taxonomy","classification",{"skillNo":125,"name":126,"nameZh":6,"description":127,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":128,"categories":129,"keywords":139,"publishedAt":36},"01M6D85XWZRS2J2NR5SZQQHP9B","api-security-posture","USAP agent skill for API Security Posture. Use for scoring an API surface against OWASP API Security Top 10 — broken object level authorization, broken authentication, mass assignment, rate-limit gaps — and recommending the next USAP skill to address the largest posture drag.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fwebapp-security\u002Fapi-security-posture\u002FSKILL.md",[130,133,134],{"categoryNo":131,"categoryName":132,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":135,"categoryName":136,"taxonomyType":137,"taxonomyTypeDesc":138},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[140,106,141,142,143,35,144,119,92,96,97,145,98,99,32,146,147,102,148,149],"security posture","api security","api","api security posture","broken authentication","broken","next","t1078","api-security","authentication",{"skillNo":151,"name":152,"nameZh":6,"description":153,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":154,"categories":155,"keywords":157,"publishedAt":36},"01M6D85TBMWMAQ3R2KQAH2QN5Z","os-hardening","USAP agent skill for OS Hardening Assessment. Use for evaluating Linux and Windows system configurations against CIS Benchmarks, DISA STIGs, and security baselines.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fsystem-security\u002Fos-hardening\u002FSKILL.md",[156],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[158,159,160,161,162,163,96,97,164,99,32,165,166,25,167,106,168,169,170,35],"hardening","os","os hardening","git","engineer","diff","system","endpoint","benchmarks","windows","linux","macos","false",{"skillNo":172,"name":173,"nameZh":6,"description":174,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":175,"categories":176,"keywords":178,"publishedAt":36},"01M6D85PH56N2AN08ATQC2CN8Q","risk-threat-modeling","USAP agent skill for Risk & Threat Modeling. Model attacker paths using STRIDE, PASTA, and attack trees. Quantify risk impact and prioritize mitigations.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Frisk-compliance\u002Frisk-threat-modeling\u002FSKILL.md",[177],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[179,180,181,27,182,183,184,32,185,35,186,187],"threat","modeling","risk threat modeling","threat modeling","model","stride","prioritize","governance","threat-modeling",{"skillNo":189,"name":190,"nameZh":6,"description":191,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":192,"categories":193,"keywords":195,"publishedAt":36},"01M6D85K9GRS1Y74W62W34XCBP","regulatory-horizon","USAP agent skill for Regulatory Horizon. Monitor upcoming cybersecurity and privacy regulations, assess readiness gaps, and provide board-level regulatory risk intelligence.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Frisk-compliance\u002Fregulatory-horizon\u002FSKILL.md",[194],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[196,197,33,198,35,199,200,27,32,201],"regulatory horizon","regulatory","intelligence","privacy","monitor","cybersecurity"]