[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ESDVCGE58QMC2QHGH85N44":3,"skill-same:01M6ESDVCGE58QMC2QHGH85N44":110},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":53,"commitSha":54,"skillDirectory":55,"forksCount":56,"repositoryHtmlUrl":57,"repositoryHomepageUrl":6,"ownerHtmlUrl":58,"ownerBlogUrl":6,"ownerDescription":59,"updatedAt":60,"install":61,"resources":74},"01M6ESDVCGE58QMC2QHGH85N44","building-ioc-enrichment-pipeline-with-opencti",null,"OpenCTI is an open-source platform for managing cyber threat intelligence knowledge, built on STIX 2.1 as its native data model. This skill covers building an automated IOC enrichment pipeline using O","luokai0\u002Fai-agent-skills-by-luo-kai","luokai0","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F266954973?v=4","01M6E16VNT42JB8B3X3254QWJ7","luo kai","01M6E16VTFVP6S5XJF1V1MPV90",14,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fbuilding-ioc-enrichment-pipeline-with-opencti\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"opencti","with","building ioc enrichment pipeline with opencti","pipeline","enrichment","ioc","stix","VirusTotal","cti","threat-intelligence","cybersecurity","mitre-attack","open","knowledge","model","platform","as","open-source","native","threat intelligence","2026-11-10 10:12:30",false,"---\nname: building-ioc-enrichment-pipeline-with-opencti\ndescription: OpenCTI is an open-source platform for managing cyber threat intelligence knowledge, built on STIX 2.1 as its native data model. This skill covers building an automated IOC enrichment pipeline using O\ndomain: cybersecurity\nsubdomain: threat-intelligence\ntags: [threat-intelligence, cti, ioc, mitre-attack, stix, opencti, enrichment, virustotal]\nversion: \"1.0\"\nauthor: mahipal\nlicense: Apache-2.0\n---\n# Building IOC Enrichment Pipeline with OpenCTI\n\n## Overview\n\nOpenCTI is an open-source platform for managing cyber threat intelligence knowledge, built on STIX 2.1 as its native data model. This skill covers building an automated IOC enrichment pipeline using OpenCTI's connector ecosystem to enrich indicators with context from VirusTotal, Shodan, AbuseIPDB, GreyNoise, and other sources. The pipeline automatically enriches newly ingested indicators, correlates them with known threat actors and campaigns, and scores them for analyst prioritization.\n\n\n## When to Use\n\n- When deploying or configuring building ioc enrichment pipeline with opencti capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Docker and Docker Compose for OpenCTI deployment\n- Python 3.9+ with `pycti` library\n- API keys for enrichment services: VirusTotal, Shodan, AbuseIPDB, GreyNoise\n- Understanding of STIX 2.1 data model and relationships\n- ElasticSearch or OpenSearch for OpenCTI backend\n- RabbitMQ or Redis for connector messaging\n\n## Key Concepts\n\n### OpenCTI Architecture\n\nOpenCTI uses a GraphQL API frontend backed by ElasticSearch for storage and Redis\u002FRabbitMQ for connector communication. Data is natively stored as STIX 2.1 objects with relationships. Connectors are categorized as: External Import (feed ingestion), Internal Import (file parsing), Internal Enrichment (context addition), and Stream (real-time export).\n\n### Enrichment Connector Model\n\nInternal enrichment connectors are triggered automatically when new observables are created or manually by analysts. Each connector receives STIX objects, queries external services, and returns STIX 2.1 bundles that augment the original observable with additional context, labels, and relationships.\n\n### Confidence Scoring\n\nOpenCTI uses a 0-100 confidence scale for indicators. Enrichment connectors can update confidence scores based on external validation: VirusTotal detection ratios, Shodan exposure data, AbuseIPDB report counts, and GreyNoise classification results.\n\n## Workflow\n\n### Step 1: Deploy OpenCTI with Docker Compose\n\n```yaml\n# docker-compose.yml (key services)\nversion: '3'\nservices:\n  opencti:\n    image: opencti\u002Fplatform:6.4.4\n    environment:\n      - APP__PORT=8080\n      - APP__ADMIN__EMAIL=admin@opencti.io\n      - APP__ADMIN__PASSWORD=ChangeMeNow\n      - APP__ADMIN__TOKEN=your-admin-token-uuid\n      - ELASTICSEARCH__URL=http:\u002F\u002Felasticsearch:9200\n      - MINIO__ENDPOINT=minio\n      - RABBITMQ__HOSTNAME=rabbitmq\n    ports:\n      - \"8080:8080\"\n    depends_on:\n      - elasticsearch\n      - minio\n      - rabbitmq\n      - redis\n\n  connector-virustotal:\n    image: opencti\u002Fconnector-virustotal:6.4.4\n    environment:\n      - OPENCTI_URL=http:\u002F\u002Fopencti:8080\n      - OPENCTI_TOKEN=your-admin-token-uuid\n      - CONNECTOR_ID=connector-virustotal-id\n      - CONNECTOR_NAME=VirusTotal\n      - CONNECTOR_SCOPE=StixFile,Artifact,IPv4-Addr,Domain-Name,Url\n      - CONNECTOR_AUTO=true\n      - VIRUSTOTAL_TOKEN=your-vt-api-key\n      - VIRUSTOTAL_MAX_TLP=TLP:AMBER\n\n  connector-shodan:\n    image: opencti\u002Fconnector-shodan:6.4.4\n    environment:\n      - OPENCTI_URL=http:\u002F\u002Fopencti:8080\n      - OPENCTI_TOKEN=your-admin-token-uuid\n      - CONNECTOR_ID=connector-shodan-id\n      - CONNECTOR_NAME=Shodan\n      - CONNECTOR_SCOPE=IPv4-Addr\n      - CONNECTOR_AUTO=true\n      - SHODAN_TOKEN=your-shodan-api-key\n      - SHODAN_MAX_TLP=TLP:AMBER\n\n  connector-abuseipdb:\n    image: opencti\u002Fconnector-abuseipdb:6.4.4\n    environment:\n      - OPENCTI_URL=http:\u002F\u002Fopencti:8080\n      - OPENCTI_TOKEN=your-admin-token-uuid\n      - CONNECTOR_ID=connector-abuseipdb-id\n      - CONNECTOR_NAME=AbuseIPDB\n      - CONNECTOR_SCOPE=IPv4-Addr\n      - CONNECTOR_AUTO=true\n      - ABUSEIPDB_API_KEY=your-abuseipdb-key\n```\n\n### Step 2: Build Custom Enrichment Connector\n\n```python\nimport os\nfrom pycti import OpenCTIConnectorHelper, get_config_variable\nfrom stix2 import (\n    Bundle, Indicator, Note, Relationship,\n    IPv4Address, DomainName\n)\nimport requests\n\n\nclass CustomEnrichmentConnector:\n    def __init__(self):\n        config = {\n            \"opencti\": {\n                \"url\": os.environ.get(\"OPENCTI_URL\"),\n                \"token\": os.environ.get(\"OPENCTI_TOKEN\"),\n            },\n            \"connector\": {\n                \"id\": os.environ.get(\"CONNECTOR_ID\"),\n                \"name\": \"CustomEnrichment\",\n                \"scope\": \"IPv4-Addr,Domain-Name,Url\",\n                \"auto\": True,\n                \"type\": \"INTERNAL_ENRICHMENT\",\n            },\n        }\n        self.helper = OpenCTIConnectorHelper(config)\n        self.helper.listen(self._process_message)\n\n    def _process_message(self, data):\n        entity_id = data[\"entity_id\"]\n        stix_object = self.helper.api.stix_cyber_observable.read(id=entity_id)\n\n        if not stix_object:\n            return \"Observable not found\"\n\n        observable_type = stix_object[\"entity_type\"]\n        observable_value = stix_object.get(\"value\", \"\")\n\n        enrichment_results = []\n\n        if observable_type == \"IPv4-Addr\":\n            enrichment_results = self._enrich_ip(observable_value, entity_id)\n        elif observable_type == \"Domain-Name\":\n            enrichment_results = self._enrich_domain(observable_value, entity_id)\n\n        if enrichment_results:\n            bundle = Bundle(objects=enrichment_results, allow_custom=True)\n            self.helper.send_stix2_bundle(bundle.serialize())\n\n        return \"Enrichment completed\"\n\n    def _enrich_ip(self, ip_address, entity_id):\n        \"\"\"Enrich IP address with GreyNoise, AbuseIPDB context.\"\"\"\n        objects = []\n\n        # GreyNoise Community API\n        try:\n            gn_response = requests.get(\n                f\"https:\u002F\u002Fapi.greynoise.io\u002Fv3\u002Fcommunity\u002F{ip_address}\",\n                headers={\"key\": os.environ.get(\"GREYNOISE_API_KEY\")},\n                timeout=30,\n            )\n            if gn_response.status_code == 200:\n                gn_data = gn_response.json()\n                classification = gn_data.get(\"classification\", \"unknown\")\n                noise = gn_data.get(\"noise\", False)\n                riot = gn_data.get(\"riot\", False)\n\n                note_content = (\n                    f\"## GreyNoise Enrichment\\n\"\n                    f\"- Classification: {classification}\\n\"\n                    f\"- Internet Noise: {noise}\\n\"\n                    f\"- RIOT (Benign Service): {riot}\\n\"\n                    f\"- Name: {gn_data.get('name', 'N\u002FA')}\\n\"\n                    f\"- Last Seen: {gn_data.get('last_seen', 'N\u002FA')}\"\n                )\n\n                note = Note(\n                    content=note_content,\n                    object_refs=[entity_id],\n                    abstract=f\"GreyNoise: {classification}\",\n                    allow_custom=True,\n                )\n                objects.append(note)\n\n                # Add labels based on classification\n                if classification == \"malicious\":\n                    self.helper.api.stix_cyber_observable.add_label(\n                        id=entity_id, label_name=\"greynoise:malicious\"\n                    )\n                elif riot:\n                    self.helper.api.stix_cyber_observable.add_label(\n                        id=entity_id, label_name=\"greynoise:benign-service\"\n                    )\n\n        except Exception as e:\n            self.helper.log_error(f\"GreyNoise enrichment failed: {e}\")\n\n        return objects\n\n    def _enrich_domain(self, domain, entity_id):\n        \"\"\"Enrich domain with WHOIS and DNS context.\"\"\"\n        objects = []\n\n        try:\n            # Use SecurityTrails API for domain enrichment\n            st_response = requests.get(\n                f\"https:\u002F\u002Fapi.securitytrails.com\u002Fv1\u002Fdomain\u002F{domain}\",\n                headers={\"APIKEY\": os.environ.get(\"SECURITYTRAILS_API_KEY\")},\n                timeout=30,\n            )\n            if st_response.status_code == 200:\n                st_data = st_response.json()\n                current_dns = st_data.get(\"current_dns\", {})\n\n                a_records = [\n                    r.get(\"ip\") for r in current_dns.get(\"a\", {}).get(\"values\", [])\n                ]\n\n                note_content = (\n                    f\"## SecurityTrails Enrichment\\n\"\n                    f\"- A Records: {', '.join(a_records)}\\n\"\n                    f\"- Alexa Rank: {st_data.get('alexa_rank', 'N\u002FA')}\\n\"\n                    f\"- Hostname: {st_data.get('hostname', 'N\u002FA')}\"\n                )\n\n                note = Note(\n                    content=note_content,\n                    object_refs=[entity_id],\n                    abstract=f\"SecurityTrails: {domain}\",\n                    allow_custom=True,\n                )\n                objects.append(note)\n\n        except Exception as e:\n            self.helper.log_error(f\"SecurityTrails enrichment failed: {e}\")\n\n        return objects\n\n\nif __name__ == \"__main__\":\n    connector = CustomEnrichmentConnector()\n","# Building IOC Enrichment Pipeline with OpenCTI\n\n## Overview\n\nOpenCTI is an open-source platform for managing cyber threat intelligence knowledge, built on STIX 2.1 as its native data model. This skill covers building an automated IOC enrichment pipeline using OpenCTI's connector ecosystem to enrich indicators with context from VirusTotal, Shodan, AbuseIPDB, GreyNoise, and other sources. The pipeline automatically enriches newly ingested indicators, correlates them with known threat actors and campaigns, and scores them for analyst prioritization.\n\n\n## When to Use\n\n- When deploying or configuring building ioc enrichment pipeline with opencti capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Docker and Docker Compose for OpenCTI deployment\n- Python 3.9+ with `pycti` library\n- API keys for enrichment services: VirusTotal, Shodan, AbuseIPDB, GreyNoise\n- Understanding of STIX 2.1 data model and relationships\n- ElasticSearch or OpenSearch for OpenCTI backend\n- RabbitMQ or Redis for connector messaging\n\n## Key Concepts\n\n### OpenCTI Architecture\n\nOpenCTI uses a GraphQL API frontend backed by ElasticSearch for storage and Redis\u002FRabbitMQ for connector communication. Data is natively stored as STIX 2.1 objects with relationships. Connectors are categorized as: External Import (feed ingestion), Internal Import (file parsing), Internal Enrichment (context addition), and Stream (real-time export).\n\n### Enrichment Connector Model\n\nInternal enrichment connectors are triggered automatically when new observables are created or manually by analysts. Each connector receives STIX objects, queries external services, and returns STIX 2.1 bundles that augment the original observable with additional context, labels, and relationships.\n\n### Confidence Scoring\n\nOpenCTI uses a 0-100 confidence scale for indicators. Enrichment connectors can update confidence scores based on external validation: VirusTotal detection ratios, Shodan exposure data, AbuseIPDB report counts, and GreyNoise classification results.\n\n## Workflow\n\n### Step 1: Deploy OpenCTI with Docker Compose\n\n```yaml\n# docker-compose.yml (key services)\nversion: '3'\nservices:\n  opencti:\n    image: opencti\u002Fplatform:6.4.4\n    environment:\n      - APP__PORT=8080\n      - APP__ADMIN__EMAIL=admin@opencti.io\n      - APP__ADMIN__PASSWORD=ChangeMeNow\n      - APP__ADMIN__TOKEN=your-admin-token-uuid\n      - ELASTICSEARCH__URL=http:\u002F\u002Felasticsearch:9200\n      - MINIO__ENDPOINT=minio\n      - RABBITMQ__HOSTNAME=rabbitmq\n    ports:\n      - \"8080:8080\"\n    depends_on:\n      - elasticsearch\n      - minio\n      - rabbitmq\n      - redis\n\n  connector-virustotal:\n    image: opencti\u002Fconnector-virustotal:6.4.4\n    environment:\n      - OPENCTI_URL=http:\u002F\u002Fopencti:8080\n      - OPENCTI_TOKEN=your-admin-token-uuid\n      - CONNECTOR_ID=connector-virustotal-id\n      - CONNECTOR_NAME=VirusTotal\n      - CONNECTOR_SCOPE=StixFile,Artifact,IPv4-Addr,Domain-Name,Url\n      - CONNECTOR_AUTO=true\n      - VIRUSTOTAL_TOKEN=your-vt-api-key\n      - VIRUSTOTAL_MAX_TLP=TLP:AMBER\n\n  connector-shodan:\n    image: opencti\u002Fconnector-shodan:6.4.4\n    environment:\n      - OPENCTI_URL=http:\u002F\u002Fopencti:8080\n      - OPENCTI_TOKEN=your-admin-token-uuid\n      - CONNECTOR_ID=connector-shodan-id\n      - CONNECTOR_NAME=Shodan\n      - CONNECTOR_SCOPE=IPv4-Addr\n      - CONNECTOR_AUTO=true\n      - SHODAN_TOKEN=your-shodan-api-key\n      - SHODAN_MAX_TLP=TLP:AMBER\n\n  connector-abuseipdb:\n    image: opencti\u002Fconnector-abuseipdb:6.4.4\n    environment:\n      - OPENCTI_URL=http:\u002F\u002Fopencti:8080\n      - OPENCTI_TOKEN=your-admin-token-uuid\n      - CONNECTOR_ID=connector-abuseipdb-id\n      - CONNECTOR_NAME=AbuseIPDB\n      - CONNECTOR_SCOPE=IPv4-Addr\n      - CONNECTOR_AUTO=true\n      - ABUSEIPDB_API_KEY=your-abuseipdb-key\n```\n\n### Step 2: Build Custom Enrichment Connector\n\n```python\nimport os\nfrom pycti import OpenCTIConnectorHelper, get_config_variable\nfrom stix2 import (\n    Bundle, Indicator, Note, Relationship,\n    IPv4Address, DomainName\n)\nimport requests\n\n\nclass CustomEnrichmentConnector:\n    def __init__(self):\n        config = {\n            \"opencti\": {\n                \"url\": os.environ.get(\"OPENCTI_URL\"),\n                \"token\": os.environ.get(\"OPENCTI_TOKEN\"),\n            },\n            \"connector\": {\n                \"id\": os.environ.get(\"CONNECTOR_ID\"),\n                \"name\": \"CustomEnrichment\",\n                \"scope\": \"IPv4-Addr,Domain-Name,Url\",\n                \"auto\": True,\n                \"type\": \"INTERNAL_ENRICHMENT\",\n            },\n        }\n        self.helper = OpenCTIConnectorHelper(config)\n        self.helper.listen(self._process_message)\n\n    def _process_message(self, data):\n        entity_id = data[\"entity_id\"]\n        stix_object = self.helper.api.stix_cyber_observable.read(id=entity_id)\n\n        if not stix_object:\n            return \"Observable not found\"\n\n        observable_type = stix_object[\"entity_type\"]\n        observable_value = stix_object.get(\"value\", \"\")\n\n        enrichment_results = []\n\n        if observable_type == \"IPv4-Addr\":\n            enrichment_results = self._enrich_ip(observable_value, entity_id)\n        elif observable_type == \"Domain-Name\":\n            enrichment_results = self._enrich_domain(observable_value, entity_id)\n\n        if enrichment_results:\n            bundle = Bundle(objects=enrichment_results, allow_custom=True)\n            self.helper.send_stix2_bundle(bundle.serialize())\n\n        return \"Enrichment completed\"\n\n    def _enrich_ip(self, ip_address, entity_id):\n        \"\"\"Enrich IP address with GreyNoise, AbuseIPDB context.\"\"\"\n        objects = []\n\n        # GreyNoise Community API\n        try:\n            gn_response = requests.get(\n                f\"https:\u002F\u002Fapi.greynoise.io\u002Fv3\u002Fcommunity\u002F{ip_address}\",\n                headers={\"key\": os.environ.get(\"GREYNOISE_API_KEY\")},\n                timeout=30,\n            )\n            if gn_response.status_code == 200:\n                gn_data = gn_response.json()\n                classification = gn_data.get(\"classification\", \"unknown\")\n                noise = gn_data.get(\"noise\", False)\n                riot = gn_data.get(\"riot\", False)\n\n                note_content = (\n                    f\"## GreyNoise Enrichment\\n\"\n                    f\"- Classification: {classification}\\n\"\n                    f\"- Internet Noise: {noise}\\n\"\n                    f\"- RIOT (Benign Service): {riot}\\n\"\n                    f\"- Name: {gn_data.get('name', 'N\u002FA')}\\n\"\n                    f\"- Last Seen: {gn_data.get('last_seen', 'N\u002FA')}\"\n                )\n\n                note = Note(\n                    content=note_content,\n                    object_refs=[entity_id],\n                    abstract=f\"GreyNoise: {classification}\",\n                    allow_custom=True,\n                )\n                objects.append(note)\n\n                # Add labels based on classification\n                if classification == \"malicious\":\n                    self.helper.api.stix_cyber_observable.add_label(\n                        id=entity_id, label_name=\"greynoise:malicious\"\n                    )\n                elif riot:\n                    self.helper.api.stix_cyber_observable.add_label(\n                        id=entity_id, label_name=\"greynoise:benign-service\"\n                    )\n\n        except Exception as e:\n            self.helper.log_error(f\"GreyNoise enrichment failed: {e}\")\n\n        return objects\n\n    def _enrich_domain(self, domain, entity_id):\n        \"\"\"Enrich domain with WHOIS and DNS context.\"\"\"\n        objects = []\n\n        try:\n            # Use SecurityTrails API for domain enrichment\n            st_response = requests.get(\n                f\"https:\u002F\u002Fapi.securitytrails.com\u002Fv1\u002Fdomain\u002F{domain}\",\n                headers={\"APIKEY\": os.environ.get(\"SECURITYTRAILS_API_KEY\")},\n                timeout=30,\n            )\n            if st_response.status_code == 200:\n                st_data = st_response.json()\n                current_dns = st_data.get(\"current_dns\", {})\n\n                a_records = [\n                    r.get(\"ip\") for r in current_dns.get(\"a\", {}).get(\"values\", [])\n                ]\n\n                note_content = (\n                    f\"## SecurityTrails Enrichment\\n\"\n                    f\"- A Records: {', '.join(a_records)}\\n\"\n                    f\"- Alexa Rank: {st_data.get('alexa_rank', 'N\u002FA')}\\n\"\n                    f\"- Hostname: {st_data.get('hostname', 'N\u002FA')}\"\n                )\n\n                note = Note(\n                    content=note_content,\n                    object_refs=[entity_id],\n                    abstract=f\"SecurityTrails: {domain}\",\n                    allow_custom=True,\n                )\n                objects.append(note)\n\n        except Exception as e:\n            self.helper.log_error(f\"SecurityTrails enrichment failed: {e}\")\n\n        return objects\n\n\nif __name__ == \"__main__\":\n    connector = CustomEnrichmentConnector()\n",{"name":5,"tags":49,"author":51,"domain":34,"license":15,"version":52,"subdomain":33,"description":7},[33,32,29,35,30,24,28,50],"virustotal","mahipal","1.0","main","4d2fb89cdfb75f3f6fd3c6c5ec9ad90ea129eb3c","ai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fbuilding-ioc-enrichment-pipeline-with-opencti",2,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai","https:\u002F\u002Fgithub.com\u002Fluokai0","a solo builder.","2026-05-06 04:29:04",{"source":8,"skillName":5,"commands":62,"prompt":72,"zipAvailable":73},[63,66,69],{"tool":64,"command":65},"npx","npx skills add luokai0\u002Fai-agent-skills-by-luo-kai --skill building-ioc-enrichment-pipeline-with-opencti",{"tool":67,"command":68},"bunx","bunx skills add luokai0\u002Fai-agent-skills-by-luo-kai --skill building-ioc-enrichment-pipeline-with-opencti",{"tool":70,"command":71},"pnpm","pnpm dlx skills add luokai0\u002Fai-agent-skills-by-luo-kai --skill building-ioc-enrichment-pipeline-with-opencti","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fbuilding-ioc-enrichment-pipeline-with-opencti\u002FSKILL.md",true,[75,81,86,92,96,100,106],{"path":76,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":79,"sourceHtmlUrl":80},"assets\u002Ftemplate.md","ASSET","资产文件",2067,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fbuilding-ioc-enrichment-pipeline-with-opencti\u002Fassets\u002Ftemplate.md",{"path":82,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":84,"sourceHtmlUrl":85},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fbuilding-ioc-enrichment-pipeline-with-opencti\u002FLICENSE",{"path":87,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":90,"sourceHtmlUrl":91},"references\u002Fapi-reference.md","REFERENCE","参考文档",1885,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fbuilding-ioc-enrichment-pipeline-with-opencti\u002Freferences\u002Fapi-reference.md",{"path":93,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":94,"sourceHtmlUrl":95},"references\u002Fstandards.md",3180,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fbuilding-ioc-enrichment-pipeline-with-opencti\u002Freferences\u002Fstandards.md",{"path":97,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":98,"sourceHtmlUrl":99},"references\u002Fworkflows.md",5085,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fbuilding-ioc-enrichment-pipeline-with-opencti\u002Freferences\u002Fworkflows.md",{"path":101,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":104,"sourceHtmlUrl":105},"scripts\u002Fagent.py","SCRIPT","脚本",5856,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fbuilding-ioc-enrichment-pipeline-with-opencti\u002Fscripts\u002Fagent.py",{"path":107,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":108,"sourceHtmlUrl":109},"scripts\u002Fprocess.py",17734,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fbuilding-ioc-enrichment-pipeline-with-opencti\u002Fscripts\u002Fprocess.py",[111,138,155,183,215,252],{"skillNo":112,"name":113,"nameZh":6,"description":114,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":115,"licenseFileUrl":6,"sourceHtmlUrl":116,"categories":117,"keywords":118,"publishedAt":44},"01M6F2SKTE208174C7S7JJCZC7","write-contracts","Generates secure Aptos Move V2 smart contracts with Object model, Digital Asset integration, security patterns, and storage type guidance. Includes comprehensive storage decision framework for optimal data structure selection. Triggers on: 'write contract', 'create NFT collection', 'build marketplace', 'implement minting', 'generate Move module', 'create token contract', 'build DAO', 'implement staking'. Ask storage questions when: 'store', 'track', 'registry', 'mapping', 'list', 'collection'.","MIT","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fwrite-contracts\u002FSKILL.md",[],[119,120,121,122,123,124,125,126,38,127,128,129,130,131,132,133,134,135,136,137],"write","contracts","write contracts","storage","secure","create","generate","collection","decision","ask","smart-contracts","selection","objects","structure","nft","token","aptos","critical","move",{"skillNo":139,"name":140,"nameZh":6,"description":141,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":115,"licenseFileUrl":6,"sourceHtmlUrl":142,"categories":143,"keywords":144,"publishedAt":44},"01M6F2RFXJ6T9MKW0A7N7GM45B","web-search","通用网络搜索技能，支持多引擎搜索（百度、必应、DuckDuckGo），无需API密钥即可获取实时信息","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fweb-search-ex-skill\u002FSKILL.md",[],[145,146,147,148,149,150,151,152,153,154],"web","search","web search","搜索","baidu","bing","duckduckgo","百度","多引擎","internet",{"skillNo":156,"name":157,"nameZh":6,"description":158,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":115,"licenseFileUrl":6,"sourceHtmlUrl":159,"categories":160,"keywords":164,"publishedAt":44},"01M6F2K968G1FZEZFPW2E6B222","solo-build","Execute implementation plan tasks with TDD workflow, auto-commit, and phase gates. Use when user says \"build it\", \"start building\", \"execute plan\", \"implement tasks\", \"ship it\", or references a track ID. Do NOT use for planning (use \u002Fplan) or scaffolding (use \u002Fscaffold).","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fsolo-build\u002FSKILL.md",[161],{"categoryNo":162,"categoryName":163,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[165,166,167,168,169,170,171,172,146,173,174,175,119,176,177,178,179,180,181,182],"build","solo","solo build","MCP","workflow","commit","tasks","code","Bash","plan","read","auto","references","context7","query","scaffolding","ship it","project",{"skillNo":184,"name":185,"nameZh":6,"description":186,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":115,"licenseFileUrl":6,"sourceHtmlUrl":187,"categories":188,"keywords":195,"publishedAt":44},"01M6F2GKN39SGHSPWYB3662YC8","react-email","Use when building HTML email templates with React components, adding a visual email editor to an application using the React Email visual editor, rendering emails to HTML, or sending emails with Resend. Covers welcome emails, password resets, notifications, order confirmations, newsletters, transactional emails, and the embeddable email editor component.","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Freact-email-skills\u002FSKILL.md",[189,192],{"categoryNo":190,"categoryName":191,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000005","邮件与沟通",{"categoryNo":193,"categoryName":194,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000009","前端开发",[196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,25],"react","email","react email","github","editor","components","react components","component","welcome","https","notifications","password","node","use","html","resend","visual","emails","rendering",{"skillNo":216,"name":217,"nameZh":6,"description":218,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":115,"licenseFileUrl":6,"sourceHtmlUrl":219,"categories":220,"keywords":233,"publishedAt":44},"01M6F2FBVGVDFSG8SSFJGXA40C","APITester Agent-Driven API Testing","Test API endpoints and document responses. Define tests in plain English, run them, get formatted results. Agent-driven Postman alternative.","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fopenclaw-api-tester\u002FSKILL.md",[221,224,227,228],{"categoryNo":222,"categoryName":223,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":225,"categoryName":226,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":162,"categoryName":163,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":229,"categoryName":230,"taxonomyType":231,"taxonomyTypeDesc":232},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251],"testing","api","api testing","driven","APITester Agent Driven API Testing","test","run","postman","results","plain english","tester","endpoints","document","get","define","tests","english","api-tester",{"skillNo":253,"name":254,"nameZh":6,"description":255,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":115,"licenseFileUrl":6,"sourceHtmlUrl":256,"categories":257,"keywords":258,"publishedAt":44},"01M6F273Y3NGAPVJZ608BC0G9G","hubspot-implementation-plan","Generate a phased implementation plan from a HubSpot audit report. Creates prioritized, sequenced cleanup processes with effort estimates, dependencies, and automation feasibility. Use after running \u002Fhubspot-audit.","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fhubspot-implementation-plan\u002FSKILL.md",[],[174,259,260,261,262,263,264,125,265,266,267,268,269,209,270,271,25,272],"implementation","hubspot","hubspot implementation plan","automation","feasibility","cleanup","planning","report","audit","audit report","phased implementation","dependencies","processes","hubspot audit"]