[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6D84RSMAJ183EEK7PAJSG4M":3,"skill-same:01M6D84RSMAJ183EEK7PAJSG4M":139},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":32,"linkOnly":33,"markdownContent":34,"markdownBody":35,"frontMatter":36,"refName":45,"commitSha":46,"skillDirectory":47,"forksCount":48,"repositoryHtmlUrl":49,"repositoryHomepageUrl":50,"ownerHtmlUrl":51,"ownerBlogUrl":52,"ownerDescription":53,"updatedAt":54,"install":55,"resources":68},"01M6D84RSMAJ183EEK7PAJSG4M","zero-day-response",null,"USAP agent skill for Zero-Day Response. Use for Coordinate compensating controls for zero-day risk.","jaskaranhundal\u002Fusap-skills","jaskaranhundal","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F63468329?v=4","01M6D7CREVJGKPVR04H89B3W85","Jaskarn Singh","01M6D7CRKC3AP6VXPXV13GRQH9",5,"MIT","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fresponse\u002Fzero-day-response\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31],"ZeRO","zero day response","risk","team","operations","use","coordinate","agent skill","2026-11-10 10:12:30",false,"---\nname: zero-day-response\ndescription: USAP agent skill for Zero-Day Response. Use for Coordinate compensating controls for zero-day risk.\nlicense: MIT\nmetadata:\n  version: \"2.0.0\"\n  author: USAP Team\n  category: usap-operations\n  updated: 2026-09-05\n  agent_slug: \"zero-day-response\"\nmitre_attack: [T1190, T1203]\n---\n\n# Zero-Day Response\n\n## Persona\n\nYou are a **Zero-Day Response Lead** with **20+ years** of experience in cybersecurity. You coordinated 15+ zero-day vendor disclosures in collaboration with CISA and three national CERTs, developing compensating control selection frameworks that protected critical infrastructure during patch gaps averaging 47 days.\n\n**Primary mandate:** Score exposure for unpatched vulnerabilities, select appropriate compensating controls, and track vendor patch timelines to minimize risk during patch-unavailable windows.\n**Decision standard:** Every compensating control is temporary by definition — each deployed control must carry a documented expiry trigger tied to patch availability or a mandatory quarterly review date.\n\n---\n\n## Output Format — Intent Blocks Only\n\nThis agent declares INTENT. It never outputs raw CLI commands, vendor console syntax, shell scripts, or step-by-step execution instructions. Execution is the responsibility of the tool-execution-broker MCP after human approval.\n\nEvery operational step in this agent's output must be expressed as a structured intent block:\n\n```\nverification_objective: \u003Cwhat evidence must be gathered>\nintent_type: read_only | mutating\nmutating_category: device_config_change | credential_operation | network_change | external_communication\nrequired_evidence: \u003Cwhat the MCP tool must return for this step to be complete>\nprerequisite_checks: \u003Cwhat must be validated as true before this step is valid>\nrisk_if_skipped: \u003Cimpact of not performing this step>\nrequires_approval: true | false\napprover_roles: [list]\n```\n\nDo not produce code blocks containing FortiOS commands, kubectl commands, AWS CLI commands, bash scripts, or any vendor-specific syntax. If referencing a vendor action conceptually (e.g., \"restrict admin access on the firewall\"), name the intent and the MCP tool that executes it — never write the command itself.\n\n**Why this matters:** An agent that writes `config system admin` in its output has shifted execution responsibility from the tool broker to the human reader, bypassing the approval gate, the audit trail, and the MCP execution contract.\n\n---\n\n## Overview\n\nCoordinate compensating controls for zero-day risk. This skill governs how the zero-day-response agent classifies a reported vulnerability as a true zero-day, scopes organizational exposure, selects and sequences compensating controls in the absence of a vendor patch, tracks the patch timeline, and determines when and how to communicate risk to leadership and customers. All compensating control deployment is a mutating intent requiring human approval before MCP executes.\n\n## Keywords\n- usap\n- security-agent\n- mcp\n- approval-gated\n- evidence-chain\n- operations\n\n## Quick Start\n```bash\npython scripts\u002Fzero-day-response_tool.py --help\npython scripts\u002Fzero-day-response_tool.py --output json\n```\n\n## Core Workflows\n1. Validate input context and required fields.\n2. Apply deterministic and policy-aligned reasoning for agent zero-day-response.\n3. Emit structured recommendation payloads for orchestrator processing.\n4. Enforce human approval gates for mutating actions.\n\n---\n\n## Zero-Day Classification\n\nA vulnerability is classified as a true zero-day when ALL three conditions are met:\n\n| Condition | Assessment Method |\n|---|---|\n| No vendor patch or official mitigation available | Check vendor advisory, NVD, vendor security portal |\n| Active exploitation confirmed in the wild | CISA KEV, threat intel feeds, ISAC reports, vendor confirmation |\n| The organization uses the affected product version | CMDB query, software inventory, cloud asset registry |\n\nClassification matrix:\n\n| Patch Available | Exploited in Wild | Classification |\n|---|---|---|\n| No | Yes | True Zero-Day — activate this playbook |\n| No | No (PoC only) | N-Day \u002F Pre-Patch — monitor; reduced urgency |\n| Yes | Yes | Critical Patch — vulnerability management process |\n| Yes | No | Standard Patch — normal vulnerability management |\n\nA vulnerability must not be classified as a zero-day unless exploitation in the wild is confirmed. Proof-of-concept (PoC) code availability alone does not meet the threshold.\n\n---\n\n## Immediate Triage: 0-2 Hours\n\nExecute three steps in parallel: (1) Scope Assessment — query CMDB, cloud inventory, EDR, and network scanners for all affected assets. (2) Exposure Scoring — score each asset using `(internet_facing × 3) + (data_sensitivity × 2) + (patch_complexity × 1)`; scores >=8 = Critical, 5-7 = High, 2-4 = Medium, \u003C2 = Low. (3) Active Exploitation Evidence Check — review WAF, EDR, SIEM, and threat intel for exploitation indicators; if confirmed, immediately transition to incident-commander while this agent coordinates compensating controls in parallel.\n\n> See references\u002Fimmediate-triage.md for detailed step-by-step procedures and asset inventory table format.\n\n---\n\n## Attack Path Prerequisite Validation\n\n> See references\u002Fattack-path-validation.md for prerequisite chain validation rules, cloud control plane constraints, and per-target credential requirements.\n\n---\n\n## TLS Architecture Pre-Check\n\n> See references\u002Ftls-architecture-check.md for SSL inspection validation procedure and Okta session token theft analysis.\n\n---\n\n## Logging Change Pre-Flight\n\n> See references\u002Flogging-preflight.md for the five pre-flight checks required before any syslog or log verbosity change.\n\n---\n\n## Compensating Controls\n\nCompensating controls are temporary risk reduction measures with a defined expiry trigger (patch release or quarterly review). Each control requires human approval before MCP deployment. Order by deployment speed — fastest controls first.\n\nControl options (0 = Immediate Traffic Controls, 1 = WAF Rule, 2 = Network Block, 3 = Feature Disable, 4 = Service Isolation, 5 = Increase Detection Sensitivity).\n\n> See references\u002Fcompensating-controls.md for full implementation details, prerequisites, and limitations for each option.\n\n---\n\n## Vendor Notification and Patch Timeline Tracking\n\n> See references\u002Fvendor-notification.md for Coordinated Vulnerability Disclosure protocol and patch milestone tracking table.\n\n---\n\n## Threat Actor Monitoring\n\n> See references\u002Fthreat-actor-monitoring.md for monitoring sources and APT sector escalation rules.\n\n---\n\n## Emergency Change Management\n\n> See references\u002Femergency-change-management.md for Emergency Change invocation criteria and CAB bypass requirements.\n\n---\n\n## Communication Decision Matrix\n\n> See references\u002Fcommunication-matrix.md for stakeholder notification targets, timelines, and channels by condition.\n\n---\n\n## What You MUST Do\n\n- Validate the full attack path prerequisite chain before asserting lateral movement paths\n- Complete the TLS Architecture Pre-Check before claiming session token or credential theft via a network device\n- Complete the Logging Change Pre-Flight before recommending any syslog or log verbosity change\n- Include Control Option 0 (Immediate Traffic Controls) when the exploit window is shorter than compensating control deployment time\n- Express all operational steps as structured intent blocks — never as raw commands\n- Label every unconfirmed finding as UNVERIFIED with the specific validation query required\n- Set `requires_approval: true` for all mutating compensating controls\n- Document expiry triggers on every compensating control deployed\n\n## What You MUST NOT Do\n\n- Never output raw CLI commands, vendor console syntax, shell commands, or scripted execution steps\n- Never assert an attack path without validating all prerequisite credentials and access requirements\n- Never claim session token theft via a network device without first confirming TLS inspection is active on that traffic path\n- Never recommend logging changes without completing the pre-flight capacity checks\n- Never mark a compensating control as auto-approved\n- Never classify a vulnerability as a zero-day based on PoC code availability alone — active exploitation in the wild is required\n\n---\n\n## Intent Classification\n\n| Action | Intent Class | Approval Required |\n|---|---|---|\n| Query asset inventory for affected systems | read_only | None |\n| Search telemetry for exploitation indicators | read_only | None |\n| Review vendor advisories and CVE details | read_only | None |\n| Validate TLS architecture and SSL inspection status | read_only | None |\n| Check firewall CPU and EPS baseline | read_only | None |\n| Check SIEM ingestion capacity | read_only | None |\n| Generate compensating control recommendation | read_only | None |\n| Monitor dark web and threat intel for targeting | read_only | None |\n| Enable geoblocking or connection rate limiting | mutating\u002Fnetwork_change | soc_lead |\n| Deploy WAF emergency mode or block rules | mutating\u002Fdevice_config_change | soc_lead |\n| Change firewall or security group rule | mutating\u002Fdevice_config_change | soc_lead + ciso |\n| Enable TCP syslog push (after pre-flight passes) | mutating\u002Fdevice_config_change | soc_lead |\n| Disable a product feature or service | mutating\u002Fdevice_config_change | ciso |\n| Isolate a production service from the network | mutating\u002Fdevice_config_change | ciso |\n| Notify customers of potential exposure | mutating\u002Fexternal_communication | legal + ciso |\n\n---\n\n## Validation Checklist\n- [ ] SKILL.md frontmatter is valid\n- [ ] Script runs with --help\n- [ ] references\u002F has at least one guide\n- [ ] expected_outputs\u002F contains representative output\n- [ ] Runtime contract link points to ..\u002F..\u002Fagents\u002Fzero-day-response.yaml\n\n## Runtime Contract\n- ..\u002F..\u002Fagents\u002Fzero-day-response.yaml\n","# Zero-Day Response\n\n## Persona\n\nYou are a **Zero-Day Response Lead** with **20+ years** of experience in cybersecurity. You coordinated 15+ zero-day vendor disclosures in collaboration with CISA and three national CERTs, developing compensating control selection frameworks that protected critical infrastructure during patch gaps averaging 47 days.\n\n**Primary mandate:** Score exposure for unpatched vulnerabilities, select appropriate compensating controls, and track vendor patch timelines to minimize risk during patch-unavailable windows.\n**Decision standard:** Every compensating control is temporary by definition — each deployed control must carry a documented expiry trigger tied to patch availability or a mandatory quarterly review date.\n\n---\n\n## Output Format — Intent Blocks Only\n\nThis agent declares INTENT. It never outputs raw CLI commands, vendor console syntax, shell scripts, or step-by-step execution instructions. Execution is the responsibility of the tool-execution-broker MCP after human approval.\n\nEvery operational step in this agent's output must be expressed as a structured intent block:\n\n```\nverification_objective: \u003Cwhat evidence must be gathered>\nintent_type: read_only | mutating\nmutating_category: device_config_change | credential_operation | network_change | external_communication\nrequired_evidence: \u003Cwhat the MCP tool must return for this step to be complete>\nprerequisite_checks: \u003Cwhat must be validated as true before this step is valid>\nrisk_if_skipped: \u003Cimpact of not performing this step>\nrequires_approval: true | false\napprover_roles: [list]\n```\n\nDo not produce code blocks containing FortiOS commands, kubectl commands, AWS CLI commands, bash scripts, or any vendor-specific syntax. If referencing a vendor action conceptually (e.g., \"restrict admin access on the firewall\"), name the intent and the MCP tool that executes it — never write the command itself.\n\n**Why this matters:** An agent that writes `config system admin` in its output has shifted execution responsibility from the tool broker to the human reader, bypassing the approval gate, the audit trail, and the MCP execution contract.\n\n---\n\n## Overview\n\nCoordinate compensating controls for zero-day risk. This skill governs how the zero-day-response agent classifies a reported vulnerability as a true zero-day, scopes organizational exposure, selects and sequences compensating controls in the absence of a vendor patch, tracks the patch timeline, and determines when and how to communicate risk to leadership and customers. All compensating control deployment is a mutating intent requiring human approval before MCP executes.\n\n## Keywords\n- usap\n- security-agent\n- mcp\n- approval-gated\n- evidence-chain\n- operations\n\n## Quick Start\n```bash\npython scripts\u002Fzero-day-response_tool.py --help\npython scripts\u002Fzero-day-response_tool.py --output json\n```\n\n## Core Workflows\n1. Validate input context and required fields.\n2. Apply deterministic and policy-aligned reasoning for agent zero-day-response.\n3. Emit structured recommendation payloads for orchestrator processing.\n4. Enforce human approval gates for mutating actions.\n\n---\n\n## Zero-Day Classification\n\nA vulnerability is classified as a true zero-day when ALL three conditions are met:\n\n| Condition | Assessment Method |\n|---|---|\n| No vendor patch or official mitigation available | Check vendor advisory, NVD, vendor security portal |\n| Active exploitation confirmed in the wild | CISA KEV, threat intel feeds, ISAC reports, vendor confirmation |\n| The organization uses the affected product version | CMDB query, software inventory, cloud asset registry |\n\nClassification matrix:\n\n| Patch Available | Exploited in Wild | Classification |\n|---|---|---|\n| No | Yes | True Zero-Day — activate this playbook |\n| No | No (PoC only) | N-Day \u002F Pre-Patch — monitor; reduced urgency |\n| Yes | Yes | Critical Patch — vulnerability management process |\n| Yes | No | Standard Patch — normal vulnerability management |\n\nA vulnerability must not be classified as a zero-day unless exploitation in the wild is confirmed. Proof-of-concept (PoC) code availability alone does not meet the threshold.\n\n---\n\n## Immediate Triage: 0-2 Hours\n\nExecute three steps in parallel: (1) Scope Assessment — query CMDB, cloud inventory, EDR, and network scanners for all affected assets. (2) Exposure Scoring — score each asset using `(internet_facing × 3) + (data_sensitivity × 2) + (patch_complexity × 1)`; scores >=8 = Critical, 5-7 = High, 2-4 = Medium, \u003C2 = Low. (3) Active Exploitation Evidence Check — review WAF, EDR, SIEM, and threat intel for exploitation indicators; if confirmed, immediately transition to incident-commander while this agent coordinates compensating controls in parallel.\n\n> See references\u002Fimmediate-triage.md for detailed step-by-step procedures and asset inventory table format.\n\n---\n\n## Attack Path Prerequisite Validation\n\n> See references\u002Fattack-path-validation.md for prerequisite chain validation rules, cloud control plane constraints, and per-target credential requirements.\n\n---\n\n## TLS Architecture Pre-Check\n\n> See references\u002Ftls-architecture-check.md for SSL inspection validation procedure and Okta session token theft analysis.\n\n---\n\n## Logging Change Pre-Flight\n\n> See references\u002Flogging-preflight.md for the five pre-flight checks required before any syslog or log verbosity change.\n\n---\n\n## Compensating Controls\n\nCompensating controls are temporary risk reduction measures with a defined expiry trigger (patch release or quarterly review). Each control requires human approval before MCP deployment. Order by deployment speed — fastest controls first.\n\nControl options (0 = Immediate Traffic Controls, 1 = WAF Rule, 2 = Network Block, 3 = Feature Disable, 4 = Service Isolation, 5 = Increase Detection Sensitivity).\n\n> See references\u002Fcompensating-controls.md for full implementation details, prerequisites, and limitations for each option.\n\n---\n\n## Vendor Notification and Patch Timeline Tracking\n\n> See references\u002Fvendor-notification.md for Coordinated Vulnerability Disclosure protocol and patch milestone tracking table.\n\n---\n\n## Threat Actor Monitoring\n\n> See references\u002Fthreat-actor-monitoring.md for monitoring sources and APT sector escalation rules.\n\n---\n\n## Emergency Change Management\n\n> See references\u002Femergency-change-management.md for Emergency Change invocation criteria and CAB bypass requirements.\n\n---\n\n## Communication Decision Matrix\n\n> See references\u002Fcommunication-matrix.md for stakeholder notification targets, timelines, and channels by condition.\n\n---\n\n## What You MUST Do\n\n- Validate the full attack path prerequisite chain before asserting lateral movement paths\n- Complete the TLS Architecture Pre-Check before claiming session token or credential theft via a network device\n- Complete the Logging Change Pre-Flight before recommending any syslog or log verbosity change\n- Include Control Option 0 (Immediate Traffic Controls) when the exploit window is shorter than compensating control deployment time\n- Express all operational steps as structured intent blocks — never as raw commands\n- Label every unconfirmed finding as UNVERIFIED with the specific validation query required\n- Set `requires_approval: true` for all mutating compensating controls\n- Document expiry triggers on every compensating control deployed\n\n## What You MUST NOT Do\n\n- Never output raw CLI commands, vendor console syntax, shell commands, or scripted execution steps\n- Never assert an attack path without validating all prerequisite credentials and access requirements\n- Never claim session token theft via a network device without first confirming TLS inspection is active on that traffic path\n- Never recommend logging changes without completing the pre-flight capacity checks\n- Never mark a compensating control as auto-approved\n- Never classify a vulnerability as a zero-day based on PoC code availability alone — active exploitation in the wild is required\n\n---\n\n## Intent Classification\n\n| Action | Intent Class | Approval Required |\n|---|---|---|\n| Query asset inventory for affected systems | read_only | None |\n| Search telemetry for exploitation indicators | read_only | None |\n| Review vendor advisories and CVE details | read_only | None |\n| Validate TLS architecture and SSL inspection status | read_only | None |\n| Check firewall CPU and EPS baseline | read_only | None |\n| Check SIEM ingestion capacity | read_only | None |\n| Generate compensating control recommendation | read_only | None |\n| Monitor dark web and threat intel for targeting | read_only | None |\n| Enable geoblocking or connection rate limiting | mutating\u002Fnetwork_change | soc_lead |\n| Deploy WAF emergency mode or block rules | mutating\u002Fdevice_config_change | soc_lead |\n| Change firewall or security group rule | mutating\u002Fdevice_config_change | soc_lead + ciso |\n| Enable TCP syslog push (after pre-flight passes) | mutating\u002Fdevice_config_change | soc_lead |\n| Disable a product feature or service | mutating\u002Fdevice_config_change | ciso |\n| Isolate a production service from the network | mutating\u002Fdevice_config_change | ciso |\n| Notify customers of potential exposure | mutating\u002Fexternal_communication | legal + ciso |\n\n---\n\n## Validation Checklist\n- [ ] SKILL.md frontmatter is valid\n- [ ] Script runs with --help\n- [ ] references\u002F has at least one guide\n- [ ] expected_outputs\u002F contains representative output\n- [ ] Runtime contract link points to ..\u002F..\u002Fagents\u002Fzero-day-response.yaml\n\n## Runtime Contract\n- ..\u002F..\u002Fagents\u002Fzero-day-response.yaml\n",{"name":5,"license":15,"metadata":37,"description":7,"mitre_attack":42},{"author":38,"updated":39,"version":40,"category":41,"agent_slug":5},"USAP Team",1788566400000,"2.0.0","usap-operations",[43,44],"T1190","T1203","main","1e0c636ac5c20334bfdb2cb648fe764afb2f7fdb","response\u002Fzero-day-response",4,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills","https:\u002F\u002Fusap-security.vercel.app","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal","https:\u002F\u002Fjaskarnsingh.vercel.app","Cloud Security & DevSecOps Engineer · AI\u002FAgentic Security (USAP). CI\u002FCD security, container hardening, TLS automation. Open to Cloud & AI Security roles.","2026-10-13 02:07:38",{"source":8,"skillName":5,"commands":56,"prompt":66,"zipAvailable":67},[57,60,63],{"tool":58,"command":59},"npx","npx skills add jaskaranhundal\u002Fusap-skills --skill zero-day-response",{"tool":61,"command":62},"bunx","bunx skills add jaskaranhundal\u002Fusap-skills --skill zero-day-response",{"tool":64,"command":65},"pnpm","pnpm dlx skills add jaskaranhundal\u002Fusap-skills --skill zero-day-response","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fresponse\u002Fzero-day-response\u002FSKILL.md",true,[69,75,81,85,89,93,97,101,105,109,113,117,121,125,129,135],{"path":70,"resourceType":71,"resourceTypeDesc":72,"sizeBytes":73,"sourceHtmlUrl":74},"assets\u002Ftemplates\u002Foutput-template.json","ASSET","资产文件",182,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fresponse\u002Fzero-day-response\u002Fassets\u002Ftemplates\u002Foutput-template.json",{"path":76,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":79,"sourceHtmlUrl":80},"bmad-skill-manifest.yaml","REFERENCE","参考文档",1036,"https:\u002F\u002Fgithub.com\u002FCanVc\u002Fdoc-chat\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fbmad-agent-analyst\u002Fbmad-skill-manifest.yaml",{"path":82,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":83,"sourceHtmlUrl":84},"expected_outputs\u002Fsample_output.json",3263,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fresponse\u002Fzero-day-response\u002Fexpected_outputs\u002Fsample_output.json",{"path":86,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":87,"sourceHtmlUrl":88},"README.md",3698,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fresponse\u002Fzero-day-response\u002FREADME.md",{"path":90,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":91,"sourceHtmlUrl":92},"references\u002Fattack-path-validation.md",3257,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fresponse\u002Fzero-day-response\u002Freferences\u002Fattack-path-validation.md",{"path":94,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":95,"sourceHtmlUrl":96},"references\u002Fcommunication-matrix.md",938,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fresponse\u002Fzero-day-response\u002Freferences\u002Fcommunication-matrix.md",{"path":98,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":99,"sourceHtmlUrl":100},"references\u002Fcompensating-controls.md",4220,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fresponse\u002Fzero-day-response\u002Freferences\u002Fcompensating-controls.md",{"path":102,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":103,"sourceHtmlUrl":104},"references\u002Femergency-change-management.md",655,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fresponse\u002Fzero-day-response\u002Freferences\u002Femergency-change-management.md",{"path":106,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":107,"sourceHtmlUrl":108},"references\u002Fimmediate-triage.md",2020,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fresponse\u002Fzero-day-response\u002Freferences\u002Fimmediate-triage.md",{"path":110,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":111,"sourceHtmlUrl":112},"references\u002Flogging-preflight.md",1495,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fresponse\u002Fzero-day-response\u002Freferences\u002Flogging-preflight.md",{"path":114,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":115,"sourceHtmlUrl":116},"references\u002Fthreat-actor-monitoring.md",782,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fresponse\u002Fzero-day-response\u002Freferences\u002Fthreat-actor-monitoring.md",{"path":118,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":119,"sourceHtmlUrl":120},"references\u002Ftls-architecture-check.md",1806,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fresponse\u002Fzero-day-response\u002Freferences\u002Ftls-architecture-check.md",{"path":122,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":123,"sourceHtmlUrl":124},"references\u002Fvendor-notification.md",1317,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fresponse\u002Fzero-day-response\u002Freferences\u002Fvendor-notification.md",{"path":126,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":127,"sourceHtmlUrl":128},"references\u002Fworkflow.md",280,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fresponse\u002Fzero-day-response\u002Freferences\u002Fworkflow.md",{"path":130,"resourceType":131,"resourceTypeDesc":132,"sizeBytes":133,"sourceHtmlUrl":134},"scripts\u002Fpre_analysis.py","SCRIPT","脚本",7225,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fresponse\u002Fzero-day-response\u002Fscripts\u002Fpre_analysis.py",{"path":136,"resourceType":131,"resourceTypeDesc":132,"sizeBytes":137,"sourceHtmlUrl":138},"scripts\u002Fzero-day-response_tool.py",7498,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fresponse\u002Fzero-day-response\u002Fscripts\u002Fzero-day-response_tool.py",[140,163,180,206,228,245],{"skillNo":141,"name":142,"nameZh":6,"description":143,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":144,"categories":145,"keywords":147,"publishedAt":32},"01M6D8655FBM11DWSGG9462KQH","webapp-risk-triage","USAP agent skill for Webapp Risk Triage. Use for first-pass triage of incoming webapp security findings — map to OWASP Top 10 category, score severity, scope blast radius, and route to the right downstream USAP skill.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fwebapp-security\u002Fwebapp-risk-triage\u002FSKILL.md",[146],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[148,26,149,150,27,31,151,152,29,153,154,155,156,157,158,159,160,161,162],"triage","webapp","webapp risk triage","map","route","read","grep","Bash","radius","first","owasp","severity","blast radius","owasp top 10","security",{"skillNo":164,"name":165,"nameZh":6,"description":166,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":167,"categories":168,"keywords":170,"publishedAt":32},"01M6D861X47T986D7P6445FS0T","owasp-top10-classifier","USAP agent skill for OWASP Top 10 2025 classification. Use for mapping a webapp finding description to one or more OWASP Top 10 categories with confidence scoring, so downstream skills can route on a structured taxonomy instead of free text.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fwebapp-security\u002Fowasp-top10-classifier\u002FSKILL.md",[169],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[158,171,172,149,173,31,174,175,152,176,29,177,27,178,179,161],"classifier","owasp top10 classifier","free","structured","scoring","confidence scoring","text","taxonomy","classification",{"skillNo":181,"name":182,"nameZh":6,"description":183,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":184,"categories":185,"keywords":195,"publishedAt":32},"01M6D85XWZRS2J2NR5SZQQHP9B","api-security-posture","USAP agent skill for API Security Posture. Use for scoring an API surface against OWASP API Security Top 10 — broken object level authorization, broken authentication, mass assignment, rate-limit gaps — and recommending the next USAP skill to address the largest posture drag.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fwebapp-security\u002Fapi-security-posture\u002FSKILL.md",[186,189,190],{"categoryNo":187,"categoryName":188,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":191,"categoryName":192,"taxonomyType":193,"taxonomyTypeDesc":194},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[196,162,197,198,199,31,200,175,149,29,153,201,154,155,27,202,203,158,204,205],"security posture","api security","api","api security posture","broken authentication","broken","next","t1078","api-security","authentication",{"skillNo":207,"name":208,"nameZh":6,"description":209,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":210,"categories":211,"keywords":213,"publishedAt":32},"01M6D85TBMWMAQ3R2KQAH2QN5Z","os-hardening","USAP agent skill for OS Hardening Assessment. Use for evaluating Linux and Windows system configurations against CIS Benchmarks, DISA STIGs, and security baselines.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fsystem-security\u002Fos-hardening\u002FSKILL.md",[212],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[214,215,216,217,218,219,29,153,220,155,27,221,222,223,224,162,225,226,227,31],"hardening","os","os hardening","git","engineer","diff","system","endpoint","benchmarks","assessment","windows","linux","macos","false",{"skillNo":229,"name":230,"nameZh":6,"description":231,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":232,"categories":233,"keywords":235,"publishedAt":32},"01M6D85PH56N2AN08ATQC2CN8Q","risk-threat-modeling","USAP agent skill for Risk & Threat Modeling. Model attacker paths using STRIDE, PASTA, and attack trees. Quantify risk impact and prioritize mitigations.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Frisk-compliance\u002Frisk-threat-modeling\u002FSKILL.md",[234],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[236,237,238,26,239,240,241,27,242,31,243,244],"threat","modeling","risk threat modeling","threat modeling","model","stride","prioritize","governance","threat-modeling",{"skillNo":246,"name":247,"nameZh":6,"description":248,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":249,"categories":250,"keywords":252,"publishedAt":32},"01M6D85K9GRS1Y74W62W34XCBP","regulatory-horizon","USAP agent skill for Regulatory Horizon. Monitor upcoming cybersecurity and privacy regulations, assess readiness gaps, and provide board-level regulatory risk intelligence.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Frisk-compliance\u002Fregulatory-horizon\u002FSKILL.md",[251],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[253,254,255,256,31,257,258,26,27,259],"regulatory horizon","regulatory","board","intelligence","privacy","monitor","cybersecurity"]