[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ESJCNQ345552TSGHG20WCS":3,"skill-same:01M6ESJCNQ345552TSGHG20WCS":127},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":31,"publishedAt":52,"linkOnly":53,"markdownContent":54,"markdownBody":55,"frontMatter":56,"refName":70,"commitSha":71,"skillDirectory":72,"forksCount":14,"repositoryHtmlUrl":73,"repositoryHomepageUrl":74,"ownerHtmlUrl":75,"ownerBlogUrl":6,"ownerDescription":76,"updatedAt":77,"install":78,"resources":91},"01M6ESJCNQ345552TSGHG20WCS","analyzing-campaign-attribution-evidence",null,"Campaign attribution analysis involves systematically evaluating evidence to determine which threat actor or group is responsible for a cyber operation. This skill covers collecting and weighting attr","henriquescastilho\u002Fmy-claude","henriquescastilho","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153296945?v=4","01M6ESH7EXPXTH9CVQ4K16SRG8","Henrique Scheer","01M6ESH7JHEK2PTNNH4HEH787Z",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-campaign-attribution-evidence\u002FSKILL.md",[18,23,26],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000019","营销推广","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000035","市场营销","PROFESSION","适用职业",[32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51],"campaign attribution","campaign","evidence","analyzing","analyzing campaign attribution evidence","attribution","stix","ioc","campaign-analysis","cti","threat-intelligence","analysis","threat","mitre-attack","cybersecurity","cm","intelligence","id","de","operation","2026-11-10 10:12:30",false,"---\nname: analyzing-campaign-attribution-evidence\ndescription: Campaign attribution analysis involves systematically evaluating evidence\n  to determine which threat actor or group is responsible for a cyber operation. This\n  skill covers collecting and weighting attr\ndomain: cybersecurity\nsubdomain: threat-intelligence\ntags:\n- threat-intelligence\n- cti\n- ioc\n- mitre-attack\n- stix\n- attribution\n- campaign-analysis\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- ID.RA-01\n- ID.RA-05\n- DE.CM-01\n- DE.AE-02\nmitre_attack:\n- T1587.001\n- T1583.001\n- T1588.002\n- T1071.001\n---\n# Analyzing Campaign Attribution Evidence\n\n## Overview\n\nCampaign attribution analysis involves systematically evaluating evidence to determine which threat actor or group is responsible for a cyber operation. This skill covers collecting and weighting attribution indicators using the Diamond Model and ACH (Analysis of Competing Hypotheses), analyzing infrastructure overlaps, TTP consistency, malware code similarities, operational timing patterns, and language artifacts to build confidence-weighted attribution assessments.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing campaign attribution evidence\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Python 3.9+ with `attackcti`, `stix2`, `networkx` libraries\n- Access to threat intelligence platforms (MISP, OpenCTI)\n- Understanding of Diamond Model of Intrusion Analysis\n- Familiarity with MITRE ATT&CK threat group profiles\n- Knowledge of malware analysis and infrastructure tracking techniques\n\n## Key Concepts\n\n### Attribution Evidence Categories\n1. **Infrastructure Overlap**: Shared C2 servers, domains, IP ranges, hosting providers\n2. **TTP Consistency**: Matching ATT&CK techniques and sub-techniques across campaigns\n3. **Malware Code Similarity**: Shared code bases, compilers, PDB paths, encryption routines\n4. **Operational Patterns**: Timing (working hours, time zones), targeting patterns, operational tempo\n5. **Language Artifacts**: Embedded strings, variable names, error messages in specific languages\n6. **Victimology**: Target sector, geography, and organizational profile consistency\n\n### Confidence Levels\n- **High Confidence**: Multiple independent evidence categories converge on same actor\n- **Moderate Confidence**: Several evidence categories match, some ambiguity remains\n- **Low Confidence**: Limited evidence, possible false flags or shared tooling\n\n### Analysis of Competing Hypotheses (ACH)\nStructured analytical method that evaluates evidence against multiple competing hypotheses. Each piece of evidence is scored as consistent, inconsistent, or neutral with respect to each hypothesis. The hypothesis with the least inconsistent evidence is favored.\n\n## Workflow\n\n### Step 1: Collect Attribution Evidence\n\n```python\nfrom stix2 import MemoryStore, Filter\nfrom collections import defaultdict\n\nclass AttributionAnalyzer:\n    def __init__(self):\n        self.evidence = []\n        self.hypotheses = {}\n\n    def add_evidence(self, category, description, value, confidence):\n        self.evidence.append({\n            \"category\": category,\n            \"description\": description,\n            \"value\": value,\n            \"confidence\": confidence,\n            \"timestamp\": None,\n        })\n\n    def add_hypothesis(self, actor_name, actor_id=\"\"):\n        self.hypotheses[actor_name] = {\n            \"actor_id\": actor_id,\n            \"consistent_evidence\": [],\n            \"inconsistent_evidence\": [],\n            \"neutral_evidence\": [],\n            \"score\": 0,\n        }\n\n    def evaluate_evidence(self, evidence_idx, actor_name, assessment):\n        \"\"\"Assess evidence against a hypothesis: consistent\u002Finconsistent\u002Fneutral.\"\"\"\n        if assessment == \"consistent\":\n            self.hypotheses[actor_name][\"consistent_evidence\"].append(evidence_idx)\n            self.hypotheses[actor_name][\"score\"] += self.evidence[evidence_idx][\"confidence\"]\n        elif assessment == \"inconsistent\":\n            self.hypotheses[actor_name][\"inconsistent_evidence\"].append(evidence_idx)\n            self.hypotheses[actor_name][\"score\"] -= self.evidence[evidence_idx][\"confidence\"] * 2\n        else:\n            self.hypotheses[actor_name][\"neutral_evidence\"].append(evidence_idx)\n\n    def rank_hypotheses(self):\n        \"\"\"Rank hypotheses by attribution score.\"\"\"\n        ranked = sorted(\n            self.hypotheses.items(),\n            key=lambda x: x[1][\"score\"],\n            reverse=True,\n        )\n        return [\n            {\n                \"actor\": name,\n                \"score\": data[\"score\"],\n                \"consistent\": len(data[\"consistent_evidence\"]),\n                \"inconsistent\": len(data[\"inconsistent_evidence\"]),\n                \"confidence\": self._score_to_confidence(data[\"score\"]),\n            }\n            for name, data in ranked\n        ]\n\n    def _score_to_confidence(self, score):\n        if score >= 80:\n            return \"HIGH\"\n        elif score >= 40:\n            return \"MODERATE\"\n        else:\n            return \"LOW\"\n```\n\n### Step 2: Infrastructure Overlap Analysis\n\n```python\ndef analyze_infrastructure_overlap(campaign_a_infra, campaign_b_infra):\n    \"\"\"Compare infrastructure between two campaigns for attribution.\"\"\"\n    overlap = {\n        \"shared_ips\": set(campaign_a_infra.get(\"ips\", [])).intersection(\n            campaign_b_infra.get(\"ips\", [])\n        ),\n        \"shared_domains\": set(campaign_a_infra.get(\"domains\", [])).intersection(\n            campaign_b_infra.get(\"domains\", [])\n        ),\n        \"shared_asns\": set(campaign_a_infra.get(\"asns\", [])).intersection(\n            campaign_b_infra.get(\"asns\", [])\n        ),\n        \"shared_registrars\": set(campaign_a_infra.get(\"registrars\", [])).intersection(\n            campaign_b_infra.get(\"registrars\", [])\n        ),\n    }\n\n    overlap_score = 0\n    if overlap[\"shared_ips\"]:\n        overlap_score += 30\n    if overlap[\"shared_domains\"]:\n        overlap_score += 25\n    if overlap[\"shared_asns\"]:\n        overlap_score += 15\n    if overlap[\"shared_registrars\"]:\n        overlap_score += 10\n\n    return {\n        \"overlap\": {k: list(v) for k, v in overlap.items()},\n        \"overlap_score\": overlap_score,\n        \"assessment\": \"STRONG\" if overlap_score >= 40 else \"MODERATE\" if overlap_score >= 20 else \"WEAK\",\n    }\n```\n\n### Step 3: TTP Comparison Across Campaigns\n\n```python\nfrom attackcti import attack_client\n\ndef compare_campaign_ttps(campaign_techniques, known_actor_techniques):\n    \"\"\"Compare campaign TTPs against known threat actor profiles.\"\"\"\n    campaign_set = set(campaign_techniques)\n    actor_set = set(known_actor_techniques)\n\n    common = campaign_set.intersection(actor_set)\n    unique_campaign = campaign_set - actor_set\n    unique_actor = actor_set - campaign_set\n\n    jaccard = len(common) \u002F len(campaign_set.union(actor_set)) if campaign_set.union(actor_set) else 0\n\n    return {\n        \"common_techniques\": sorted(common),\n        \"common_count\": len(common),\n        \"unique_to_campaign\": sorted(unique_campaign),\n        \"unique_to_actor\": sorted(unique_actor),\n        \"jaccard_similarity\": round(jaccard, 3),\n        \"overlap_percentage\": round(len(common) \u002F len(campaign_set) * 100, 1) if campaign_set else 0,\n    }\n```\n\n### Step 4: Generate Attribution Report\n\n```python\ndef generate_attribution_report(analyzer):\n    \"\"\"Generate structured attribution assessment report.\"\"\"\n    rankings = analyzer.rank_hypotheses()\n\n    report = {\n        \"assessment_date\": \"2026-02-23\",\n        \"total_evidence_items\": len(analyzer.evidence),\n        \"hypotheses_evaluated\": len(analyzer.hypotheses),\n        \"rankings\": rankings,\n        \"primary_attribution\": rankings[0] if rankings else None,\n        \"evidence_summary\": [\n            {\n                \"index\": i,\n                \"category\": e[\"category\"],\n                \"description\": e[\"description\"],\n                \"confidence\": e[\"confidence\"],\n            }\n            for i, e in enumerate(analyzer.evidence)\n        ],\n    }\n\n    return report\n```\n\n## Validation Criteria\n\n- Evidence collection covers all six attribution categories\n- ACH matrix properly evaluates evidence against competing hypotheses\n- Infrastructure overlap analysis identifies shared indicators\n- TTP comparison uses ATT&CK technique IDs for precision\n- Attribution confidence levels are properly justified\n- Report includes alternative hypotheses and false flag considerations\n\n## References\n\n- [Diamond Model of Intrusion Analysis](https:\u002F\u002Fwww.activeresponse.org\u002Fwp-content\u002Fuploads\u002F2013\u002F07\u002Fdiamond.pdf)\n- [MITRE ATT&CK Groups](https:\u002F\u002Fattack.mitre.org\u002Fgroups\u002F)\n- [Analysis of Competing Hypotheses](https:\u002F\u002Fwww.cia.gov\u002Fstatic\u002F9a5f1162fd0932c29e985f0159f56c07\u002FTradecraft-Primer-apr09.pdf)\n- [Threat Attribution Framework](https:\u002F\u002Fwww.mandiant.com\u002Fresources\u002Freports)\n","# Analyzing Campaign Attribution Evidence\n\n## Overview\n\nCampaign attribution analysis involves systematically evaluating evidence to determine which threat actor or group is responsible for a cyber operation. This skill covers collecting and weighting attribution indicators using the Diamond Model and ACH (Analysis of Competing Hypotheses), analyzing infrastructure overlaps, TTP consistency, malware code similarities, operational timing patterns, and language artifacts to build confidence-weighted attribution assessments.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing campaign attribution evidence\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Python 3.9+ with `attackcti`, `stix2`, `networkx` libraries\n- Access to threat intelligence platforms (MISP, OpenCTI)\n- Understanding of Diamond Model of Intrusion Analysis\n- Familiarity with MITRE ATT&CK threat group profiles\n- Knowledge of malware analysis and infrastructure tracking techniques\n\n## Key Concepts\n\n### Attribution Evidence Categories\n1. **Infrastructure Overlap**: Shared C2 servers, domains, IP ranges, hosting providers\n2. **TTP Consistency**: Matching ATT&CK techniques and sub-techniques across campaigns\n3. **Malware Code Similarity**: Shared code bases, compilers, PDB paths, encryption routines\n4. **Operational Patterns**: Timing (working hours, time zones), targeting patterns, operational tempo\n5. **Language Artifacts**: Embedded strings, variable names, error messages in specific languages\n6. **Victimology**: Target sector, geography, and organizational profile consistency\n\n### Confidence Levels\n- **High Confidence**: Multiple independent evidence categories converge on same actor\n- **Moderate Confidence**: Several evidence categories match, some ambiguity remains\n- **Low Confidence**: Limited evidence, possible false flags or shared tooling\n\n### Analysis of Competing Hypotheses (ACH)\nStructured analytical method that evaluates evidence against multiple competing hypotheses. Each piece of evidence is scored as consistent, inconsistent, or neutral with respect to each hypothesis. The hypothesis with the least inconsistent evidence is favored.\n\n## Workflow\n\n### Step 1: Collect Attribution Evidence\n\n```python\nfrom stix2 import MemoryStore, Filter\nfrom collections import defaultdict\n\nclass AttributionAnalyzer:\n    def __init__(self):\n        self.evidence = []\n        self.hypotheses = {}\n\n    def add_evidence(self, category, description, value, confidence):\n        self.evidence.append({\n            \"category\": category,\n            \"description\": description,\n            \"value\": value,\n            \"confidence\": confidence,\n            \"timestamp\": None,\n        })\n\n    def add_hypothesis(self, actor_name, actor_id=\"\"):\n        self.hypotheses[actor_name] = {\n            \"actor_id\": actor_id,\n            \"consistent_evidence\": [],\n            \"inconsistent_evidence\": [],\n            \"neutral_evidence\": [],\n            \"score\": 0,\n        }\n\n    def evaluate_evidence(self, evidence_idx, actor_name, assessment):\n        \"\"\"Assess evidence against a hypothesis: consistent\u002Finconsistent\u002Fneutral.\"\"\"\n        if assessment == \"consistent\":\n            self.hypotheses[actor_name][\"consistent_evidence\"].append(evidence_idx)\n            self.hypotheses[actor_name][\"score\"] += self.evidence[evidence_idx][\"confidence\"]\n        elif assessment == \"inconsistent\":\n            self.hypotheses[actor_name][\"inconsistent_evidence\"].append(evidence_idx)\n            self.hypotheses[actor_name][\"score\"] -= self.evidence[evidence_idx][\"confidence\"] * 2\n        else:\n            self.hypotheses[actor_name][\"neutral_evidence\"].append(evidence_idx)\n\n    def rank_hypotheses(self):\n        \"\"\"Rank hypotheses by attribution score.\"\"\"\n        ranked = sorted(\n            self.hypotheses.items(),\n            key=lambda x: x[1][\"score\"],\n            reverse=True,\n        )\n        return [\n            {\n                \"actor\": name,\n                \"score\": data[\"score\"],\n                \"consistent\": len(data[\"consistent_evidence\"]),\n                \"inconsistent\": len(data[\"inconsistent_evidence\"]),\n                \"confidence\": self._score_to_confidence(data[\"score\"]),\n            }\n            for name, data in ranked\n        ]\n\n    def _score_to_confidence(self, score):\n        if score >= 80:\n            return \"HIGH\"\n        elif score >= 40:\n            return \"MODERATE\"\n        else:\n            return \"LOW\"\n```\n\n### Step 2: Infrastructure Overlap Analysis\n\n```python\ndef analyze_infrastructure_overlap(campaign_a_infra, campaign_b_infra):\n    \"\"\"Compare infrastructure between two campaigns for attribution.\"\"\"\n    overlap = {\n        \"shared_ips\": set(campaign_a_infra.get(\"ips\", [])).intersection(\n            campaign_b_infra.get(\"ips\", [])\n        ),\n        \"shared_domains\": set(campaign_a_infra.get(\"domains\", [])).intersection(\n            campaign_b_infra.get(\"domains\", [])\n        ),\n        \"shared_asns\": set(campaign_a_infra.get(\"asns\", [])).intersection(\n            campaign_b_infra.get(\"asns\", [])\n        ),\n        \"shared_registrars\": set(campaign_a_infra.get(\"registrars\", [])).intersection(\n            campaign_b_infra.get(\"registrars\", [])\n        ),\n    }\n\n    overlap_score = 0\n    if overlap[\"shared_ips\"]:\n        overlap_score += 30\n    if overlap[\"shared_domains\"]:\n        overlap_score += 25\n    if overlap[\"shared_asns\"]:\n        overlap_score += 15\n    if overlap[\"shared_registrars\"]:\n        overlap_score += 10\n\n    return {\n        \"overlap\": {k: list(v) for k, v in overlap.items()},\n        \"overlap_score\": overlap_score,\n        \"assessment\": \"STRONG\" if overlap_score >= 40 else \"MODERATE\" if overlap_score >= 20 else \"WEAK\",\n    }\n```\n\n### Step 3: TTP Comparison Across Campaigns\n\n```python\nfrom attackcti import attack_client\n\ndef compare_campaign_ttps(campaign_techniques, known_actor_techniques):\n    \"\"\"Compare campaign TTPs against known threat actor profiles.\"\"\"\n    campaign_set = set(campaign_techniques)\n    actor_set = set(known_actor_techniques)\n\n    common = campaign_set.intersection(actor_set)\n    unique_campaign = campaign_set - actor_set\n    unique_actor = actor_set - campaign_set\n\n    jaccard = len(common) \u002F len(campaign_set.union(actor_set)) if campaign_set.union(actor_set) else 0\n\n    return {\n        \"common_techniques\": sorted(common),\n        \"common_count\": len(common),\n        \"unique_to_campaign\": sorted(unique_campaign),\n        \"unique_to_actor\": sorted(unique_actor),\n        \"jaccard_similarity\": round(jaccard, 3),\n        \"overlap_percentage\": round(len(common) \u002F len(campaign_set) * 100, 1) if campaign_set else 0,\n    }\n```\n\n### Step 4: Generate Attribution Report\n\n```python\ndef generate_attribution_report(analyzer):\n    \"\"\"Generate structured attribution assessment report.\"\"\"\n    rankings = analyzer.rank_hypotheses()\n\n    report = {\n        \"assessment_date\": \"2026-02-23\",\n        \"total_evidence_items\": len(analyzer.evidence),\n        \"hypotheses_evaluated\": len(analyzer.hypotheses),\n        \"rankings\": rankings,\n        \"primary_attribution\": rankings[0] if rankings else None,\n        \"evidence_summary\": [\n            {\n                \"index\": i,\n                \"category\": e[\"category\"],\n                \"description\": e[\"description\"],\n                \"confidence\": e[\"confidence\"],\n            }\n            for i, e in enumerate(analyzer.evidence)\n        ],\n    }\n\n    return report\n```\n\n## Validation Criteria\n\n- Evidence collection covers all six attribution categories\n- ACH matrix properly evaluates evidence against competing hypotheses\n- Infrastructure overlap analysis identifies shared indicators\n- TTP comparison uses ATT&CK technique IDs for precision\n- Attribution confidence levels are properly justified\n- Report includes alternative hypotheses and false flag considerations\n\n## References\n\n- [Diamond Model of Intrusion Analysis](https:\u002F\u002Fwww.activeresponse.org\u002Fwp-content\u002Fuploads\u002F2013\u002F07\u002Fdiamond.pdf)\n- [MITRE ATT&CK Groups](https:\u002F\u002Fattack.mitre.org\u002Fgroups\u002F)\n- [Analysis of Competing Hypotheses](https:\u002F\u002Fwww.cia.gov\u002Fstatic\u002F9a5f1162fd0932c29e985f0159f56c07\u002FTradecraft-Primer-apr09.pdf)\n- [Threat Attribution Framework](https:\u002F\u002Fwww.mandiant.com\u002Fresources\u002Freports)\n",{"name":5,"tags":57,"author":58,"domain":46,"license":15,"version":59,"nist_csf":60,"subdomain":42,"description":7,"mitre_attack":65},[42,41,39,45,38,37,40],"mahipal","1.0",[61,62,63,64],"ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02",[66,67,68,69],"T1587.001","T1583.001","T1588.002","T1071.001","main","7925716f065257435fdb12e97f7e52842147d5ad",".claude\u002Fskills\u002Fanalyzing-campaign-attribution-evidence","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude","https:\u002F\u002Fclaude.com\u002Fclaude-code","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho","Software · Applied AI · Quantitative Modeling · Building with Claude.","2026-06-10 12:24:46",{"source":8,"skillName":5,"commands":79,"prompt":89,"zipAvailable":90},[80,83,86],{"tool":81,"command":82},"npx","npx skills add henriquescastilho\u002Fmy-claude --skill analyzing-campaign-attribution-evidence",{"tool":84,"command":85},"bunx","bunx skills add henriquescastilho\u002Fmy-claude --skill analyzing-campaign-attribution-evidence",{"tool":87,"command":88},"pnpm","pnpm dlx skills add henriquescastilho\u002Fmy-claude --skill analyzing-campaign-attribution-evidence","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-campaign-attribution-evidence\u002FSKILL.md",true,[92,98,103,109,113,117,123],{"path":93,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":96,"sourceHtmlUrl":97},"assets\u002Ftemplate.md","ASSET","资产文件",1003,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-campaign-attribution-evidence\u002Fassets\u002Ftemplate.md",{"path":99,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-campaign-attribution-evidence\u002FLICENSE",{"path":104,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":107,"sourceHtmlUrl":108},"references\u002Fapi-reference.md","REFERENCE","参考文档",3153,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-campaign-attribution-evidence\u002Freferences\u002Fapi-reference.md",{"path":110,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":111,"sourceHtmlUrl":112},"references\u002Fstandards.md",1156,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-campaign-attribution-evidence\u002Freferences\u002Fstandards.md",{"path":114,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":115,"sourceHtmlUrl":116},"references\u002Fworkflows.md",1408,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-campaign-attribution-evidence\u002Freferences\u002Fworkflows.md",{"path":118,"resourceType":119,"resourceTypeDesc":120,"sizeBytes":121,"sourceHtmlUrl":122},"scripts\u002Fagent.py","SCRIPT","脚本",10177,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-campaign-attribution-evidence\u002Fscripts\u002Fagent.py",{"path":124,"resourceType":119,"resourceTypeDesc":120,"sizeBytes":125,"sourceHtmlUrl":126},"scripts\u002Fprocess.py",6076,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-campaign-attribution-evidence\u002Fscripts\u002Fprocess.py",[128,167,176,185,207,232],{"skillNo":129,"name":130,"nameZh":6,"description":131,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":132,"licenseFileUrl":6,"sourceHtmlUrl":133,"categories":134,"keywords":147,"publishedAt":52},"01M6F0B6XPQ65AX2X0DWK8KT3E","markitdown","Convert files and office documents to Markdown. Supports PDF, DOCX, PPTX, XLSX, images (with OCR), audio (with transcription), HTML, CSV, JSON, XML, ZIP, YouTube URLs, EPubs and more.","MIT","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[135,138,141,144],{"categoryNo":136,"categoryName":137,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000002","文档处理",{"categoryNo":139,"categoryName":140,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":142,"categoryName":143,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000004","电子表格",{"categoryNo":145,"categoryName":146,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000034","行政与办公人员",[130,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166],"docx","PDF","pptx","xlsx","documents","csv","ocr","Audio","Bash","markdown","convert","read","write","edit","html","images","files","youtube","with",{"skillNo":168,"name":130,"nameZh":6,"description":131,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":132,"licenseFileUrl":6,"sourceHtmlUrl":169,"categories":170,"keywords":175,"publishedAt":52},"01M6F06SBHR9F0SDWE282Y8075","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fscientific_writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[171,172,173,174],{"categoryNo":136,"categoryName":137,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":139,"categoryName":140,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":142,"categoryName":143,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":145,"categoryName":146,"taxonomyType":29,"taxonomyTypeDesc":30},[130,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166],{"skillNo":177,"name":130,"nameZh":6,"description":131,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":132,"licenseFileUrl":6,"sourceHtmlUrl":178,"categories":179,"keywords":184,"publishedAt":52},"01M6F02D4R14EJAPBWVDF9J9VQ","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[180,181,182,183],{"categoryNo":136,"categoryName":137,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":139,"categoryName":140,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":142,"categoryName":143,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":145,"categoryName":146,"taxonomyType":29,"taxonomyTypeDesc":30},[130,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166],{"skillNo":186,"name":187,"nameZh":6,"description":188,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":132,"licenseFileUrl":6,"sourceHtmlUrl":189,"categories":190,"keywords":191,"publishedAt":52},"01M6F000KS6YB4MKS774G4R8ND","zarr-python","Chunked N-D arrays for cloud storage. Compressed arrays, parallel I\u002FO, S3\u002FGCS integration, NumPy\u002FDask\u002FXarray compatible, for large-scale scientific computing pipelines.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fzarr-python\u002FSKILL.md",[],[192,193,194,195,196,197,198,199,200,201,202,203,204,205,206],"python","zarr python","storage","integration","s3","gcs","cloud","dask","parallel","pipelines","arrays","numpy","scientific computing","scale","scientific",{"skillNo":208,"name":209,"nameZh":6,"description":210,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":132,"licenseFileUrl":6,"sourceHtmlUrl":211,"categories":212,"keywords":214,"publishedAt":52},"01M6EZZJWFXM1GR78KTW6J0DN8","what-if-oracle","Run structured What-If scenario analysis with multi-branch possibility exploration. Use this skill when the user asks speculative questions like \"what if...\", \"what would happen if...\", \"what are the possibilities\", \"explore scenarios\", \"scenario analysis\", \"possibility space\", \"what could go wrong\", \"best case \u002F worst case\", \"risk analysis\", \"contingency planning\", \"strategic options\", or any question about uncertain futures. Also trigger when the user faces a fork-in-the-road decision, wants to stress-test an idea, or needs to think through consequences before committing.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fwhat-if-oracle\u002FSKILL.md",[213],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[215,216,217,218,219,220,43,221,222,223,224,159,160,225,226,227,228,229,230,231],"oracle","what if oracle","go","run","ux","futures","explore","decision","branch","question","idea","exploration","options","stress-test","strategies","scenario","stress",{"skillNo":233,"name":234,"nameZh":6,"description":235,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":132,"licenseFileUrl":6,"sourceHtmlUrl":236,"categories":237,"keywords":248,"publishedAt":52},"01M6EZZCXAEB49RXGQCJX5E8GB","venue-templates","Access comprehensive LaTeX templates, formatting requirements, and submission guidelines for major scientific publication venues (Nature, Science, PLOS, IEEE, ACM), academic conferences (NeurIPS, ICML, CVPR, CHI), research posters, and grant proposals (NSF, NIH, DOE, DARPA). This skill should be used when preparing manuscripts for journal submission, conference papers, research posters, or grant proposals and need venue-specific formatting requirements and templates.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fvenue-templates\u002FSKILL.md",[238,241,244,245],{"categoryNo":239,"categoryName":240,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":242,"categoryName":243,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":246,"categoryName":247,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000036","内容创作者",[249,250,251,252,253,254,255,256,156,257,159,160,161,258,259,260,261,262,206,263],"templates","venue templates","research","guidelines","NeurIPS","ICML","LaTeX","science","access","proposals","Academic","requirements","formatting","journal","chi"]