[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ET660CSYYWSVEZ2DPS83J2":3,"skill-same:01M6ET660CSYYWSVEZ2DPS83J2":118},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":31,"publishedAt":52,"linkOnly":53,"markdownContent":54,"markdownBody":55,"frontMatter":56,"refName":79,"commitSha":80,"skillDirectory":81,"forksCount":14,"repositoryHtmlUrl":82,"repositoryHomepageUrl":83,"ownerHtmlUrl":84,"ownerBlogUrl":6,"ownerDescription":85,"updatedAt":86,"install":87,"resources":100},"01M6ET660CSYYWSVEZ2DPS83J2","correlating-threat-campaigns",null,"Correlates disparate security incidents, IOCs, and adversary behaviors across time and organizations to identify unified threat campaigns, attribute them to common threat actors, and extract shared indicators for improved detection. Use when multiple incidents exhibit overlapping indicators, when sector-wide attack campaigns require cross-organizational analysis, or when building campaign-level intelligence products. Activates for requests involving campaign analysis, incident clustering, cross-organizational IOC correlation, or MISP correlation engine.","henriquescastilho\u002Fmy-claude","henriquescastilho","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153296945?v=4","01M6ESH7EXPXTH9CVQ4K16SRG8","Henrique Scheer","01M6ESH7JHEK2PTNNH4HEH787Z",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fcorrelating-threat-campaigns\u002FSKILL.md",[18,23,26],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000019","营销推广","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000035","市场营销","PROFESSION","适用职业",[32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51],"campaigns","correlating threat campaigns","threat","de","security","shared","across","time","incident","intelligence","cm","campaign","common","team","analysis","t1566","SET","threat-intelligence","threat-actor","cybersecurity","2026-11-10 10:12:30",false,"---\nname: correlating-threat-campaigns\ndescription: 'Correlates disparate security incidents, IOCs, and adversary behaviors\n  across time and organizations to identify unified threat campaigns, attribute them\n  to common threat actors, and extract shared indicators for improved detection. Use\n  when multiple incidents exhibit overlapping indicators, when sector-wide attack\n  campaigns require cross-organizational analysis, or when building campaign-level\n  intelligence products. Activates for requests involving campaign analysis, incident\n  clustering, cross-organizational IOC correlation, or MISP correlation engine.\n\n  '\ndomain: cybersecurity\nsubdomain: threat-intelligence\ntags:\n- campaign-analysis\n- correlation\n- MISP\n- ATT&CK\n- threat-actor\n- intrusion-set\n- clustering\n- CTI\nversion: 1.0.0\nauthor: team-cybersecurity\nlicense: Apache-2.0\nnist_csf:\n- ID.RA-01\n- ID.RA-05\n- DE.CM-01\n- DE.AE-02\nmitre_attack:\n- T1566\n- T1071.001\n- T1587.001\n- T1583.001\n- T1588.002\n---\n# Correlating Threat Campaigns\n\n## When to Use\n\nUse this skill when:\n- Multiple unrelated-appearing incidents share IOCs (same C2 IP, same malware hash, similar TTPs)\n- An ISAC partner shares indicators from an incident that match your own historical events\n- Building a campaign report linking adversary activity over weeks or months to a single operation\n\n**Do not use** this skill to force correlation based on weak signals — false campaign attribution misleads defenders and wastes resources on incorrect threat models.\n\n## Prerequisites\n\n- TIP or SIEM with historical indicator and event data (90+ days recommended)\n- MISP correlation engine enabled with event sharing configured\n- Graph analysis tool (Maltego, Neo4j, or OpenCTI) for relationship visualization\n- Reference to MITRE ATT&CK intrusion set and campaign objects for structuring output\n\n## Workflow\n\n### Step 1: Collect and Normalize Events\n\nGather all candidate events for correlation from:\n- Internal SIEM (raw events, alert history)\n- TIP (historical indicators and events)\n- ISAC sharing (partner-submitted events in MISP or TAXII)\n- Commercial intelligence (Recorded Future, Mandiant, CrowdStrike reports)\n\nNormalize all events to STIX 2.1 schema with consistent timestamp (UTC), indicator types, and confidence scores. Ensure all indicators have source attribution and collection date.\n\n### Step 2: Identify Correlation Pivot Points\n\nApply systematic pivot analysis across four dimensions:\n\n**Infrastructure pivots**:\n- Same IP address or \u002F24 subnet across events\n- Same domain registrant email or WHOIS organization\n- Same ASN or hosting provider with same account fingerprint\n- Same SSL certificate fingerprint or serial number across C2 domains\n\n**Capability pivots**:\n- Same malware hash or YARA signature match\n- Same C2 communication protocol (Cobalt Strike beacon config, Sliver implant parameters)\n- Same exploit code or weaponized document template\n- Same obfuscation method or packer fingerprint\n\n**Temporal pivots**:\n- Events occurring within same time window (operational hours suggesting same timezone)\n- Sequential events with logical kill chain progression\n- Malware compilation timestamps clustering in same date range\n\n**Victimology pivots**:\n- Same target sector (healthcare, energy, financial)\n- Same target geography\n- Same targeted technology (specific ERP vendor, VPN appliance brand)\n\n### Step 3: Calculate Correlation Confidence\n\nApply weighted scoring for campaign attribution:\n```python\ndef calculate_campaign_confidence(events: list) -> float:\n    scores = []\n\n    # Infrastructure overlap (highest weight — most discriminating)\n    infra_overlap = count_shared_infra(events) \u002F len(events)\n    scores.append(infra_overlap * 40)\n\n    # Capability overlap (high weight — TTPs are durable)\n    capability_overlap = count_shared_ttps(events) \u002F len(events)\n    scores.append(capability_overlap * 35)\n\n    # Temporal proximity (moderate weight)\n    temporal_score = assess_temporal_clustering(events)\n    scores.append(temporal_score * 15)\n\n    # Victimology alignment (lower weight — many actors target same sector)\n    victim_score = assess_victim_pattern(events)\n    scores.append(victim_score * 10)\n\n    total = sum(scores)\n    if total >= 70: return \"HIGH\"\n    elif total >= 45: return \"MEDIUM\"\n    else: return \"LOW\"\n```\n\n### Step 4: Build Campaign Graph\n\nIn OpenCTI or Maltego, construct campaign graph:\n- Campaign object (STIX) as central node\n- Intrusion Set → uses → Malware objects\n- Intrusion Set → uses → Infrastructure objects\n- Intrusion Set → targets → Identity objects (victim organizations\u002Fsectors)\n- Campaign → attributed-to → Threat Actor (if attribution achieved)\n- Indicators → indicates → Malware (linking technical observables to capabilities)\n\nLabel each relationship with evidence reference and confidence.\n\n### Step 5: Produce Campaign Intelligence Report\n\nStructure the campaign report:\n1. **Campaign name**: Assign descriptive codename based on targeting theme or tooling\n2. **Timeline**: First\u002Flast observed dates with activity phases\n3. **Attribution**: Suspected threat actor with confidence level\n4. **Target profile**: Industry verticals, geographies, organization sizes\n5. **TTPs summary**: ATT&CK Navigator heatmap for campaign-specific techniques\n6. **Shared indicators**: IOCs that span multiple incidents (highest confidence for blocking)\n7. **Detection guidance**: Sigma\u002FYARA rules specific to this campaign\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **Campaign** | STIX object representing a grouping of adversarial behaviors with common objectives over a defined time period |\n| **Intrusion Set** | STIX object grouping related intrusion activity by common objectives, even when actor identity is uncertain |\n| **Pivot** | Using a single data point (IOC, infrastructure, TTP) to discover related events or adversary artifacts |\n| **Clustering** | Machine learning or manual grouping of incidents based on feature similarity to identify campaign boundaries |\n| **False Correlation** | Incorrect linking of unrelated incidents due to shared infrastructure (CDNs, shared hosting) or common tools |\n\n## Tools & Systems\n\n- **MISP Correlation Engine**: Automatic correlation of events sharing attribute values across the MISP instance and federated instances\n- **OpenCTI Graph**: Interactive relationship graph for visualizing campaign linkages with STIX object types\n- **Maltego**: Link analysis for infrastructure and capability pivoting across multiple data sources\n- **Neo4j**: Graph database with Cypher queries for large-scale campaign correlation (millions of events)\n\n## Common Pitfalls\n\n- **CDN\u002FShared hosting false positives**: Cloudflare, AWS CloudFront, and bulletproof hosters serve multiple threat actors. Shared IP alone does not establish campaign linkage.\n- **Common malware conflation**: Multiple threat actors use Cobalt Strike. Shared capability does not indicate same actor without additional corroboration.\n- **Premature attribution**: Forcing campaign-to-actor attribution before evidence threshold is reached produces incorrect intelligence that persists in reports.\n- **Missing temporal analysis**: Events from different years may share infrastructure that was recycled by a different actor, not the same campaign.\n","# Correlating Threat Campaigns\n\n## When to Use\n\nUse this skill when:\n- Multiple unrelated-appearing incidents share IOCs (same C2 IP, same malware hash, similar TTPs)\n- An ISAC partner shares indicators from an incident that match your own historical events\n- Building a campaign report linking adversary activity over weeks or months to a single operation\n\n**Do not use** this skill to force correlation based on weak signals — false campaign attribution misleads defenders and wastes resources on incorrect threat models.\n\n## Prerequisites\n\n- TIP or SIEM with historical indicator and event data (90+ days recommended)\n- MISP correlation engine enabled with event sharing configured\n- Graph analysis tool (Maltego, Neo4j, or OpenCTI) for relationship visualization\n- Reference to MITRE ATT&CK intrusion set and campaign objects for structuring output\n\n## Workflow\n\n### Step 1: Collect and Normalize Events\n\nGather all candidate events for correlation from:\n- Internal SIEM (raw events, alert history)\n- TIP (historical indicators and events)\n- ISAC sharing (partner-submitted events in MISP or TAXII)\n- Commercial intelligence (Recorded Future, Mandiant, CrowdStrike reports)\n\nNormalize all events to STIX 2.1 schema with consistent timestamp (UTC), indicator types, and confidence scores. Ensure all indicators have source attribution and collection date.\n\n### Step 2: Identify Correlation Pivot Points\n\nApply systematic pivot analysis across four dimensions:\n\n**Infrastructure pivots**:\n- Same IP address or \u002F24 subnet across events\n- Same domain registrant email or WHOIS organization\n- Same ASN or hosting provider with same account fingerprint\n- Same SSL certificate fingerprint or serial number across C2 domains\n\n**Capability pivots**:\n- Same malware hash or YARA signature match\n- Same C2 communication protocol (Cobalt Strike beacon config, Sliver implant parameters)\n- Same exploit code or weaponized document template\n- Same obfuscation method or packer fingerprint\n\n**Temporal pivots**:\n- Events occurring within same time window (operational hours suggesting same timezone)\n- Sequential events with logical kill chain progression\n- Malware compilation timestamps clustering in same date range\n\n**Victimology pivots**:\n- Same target sector (healthcare, energy, financial)\n- Same target geography\n- Same targeted technology (specific ERP vendor, VPN appliance brand)\n\n### Step 3: Calculate Correlation Confidence\n\nApply weighted scoring for campaign attribution:\n```python\ndef calculate_campaign_confidence(events: list) -> float:\n    scores = []\n\n    # Infrastructure overlap (highest weight — most discriminating)\n    infra_overlap = count_shared_infra(events) \u002F len(events)\n    scores.append(infra_overlap * 40)\n\n    # Capability overlap (high weight — TTPs are durable)\n    capability_overlap = count_shared_ttps(events) \u002F len(events)\n    scores.append(capability_overlap * 35)\n\n    # Temporal proximity (moderate weight)\n    temporal_score = assess_temporal_clustering(events)\n    scores.append(temporal_score * 15)\n\n    # Victimology alignment (lower weight — many actors target same sector)\n    victim_score = assess_victim_pattern(events)\n    scores.append(victim_score * 10)\n\n    total = sum(scores)\n    if total >= 70: return \"HIGH\"\n    elif total >= 45: return \"MEDIUM\"\n    else: return \"LOW\"\n```\n\n### Step 4: Build Campaign Graph\n\nIn OpenCTI or Maltego, construct campaign graph:\n- Campaign object (STIX) as central node\n- Intrusion Set → uses → Malware objects\n- Intrusion Set → uses → Infrastructure objects\n- Intrusion Set → targets → Identity objects (victim organizations\u002Fsectors)\n- Campaign → attributed-to → Threat Actor (if attribution achieved)\n- Indicators → indicates → Malware (linking technical observables to capabilities)\n\nLabel each relationship with evidence reference and confidence.\n\n### Step 5: Produce Campaign Intelligence Report\n\nStructure the campaign report:\n1. **Campaign name**: Assign descriptive codename based on targeting theme or tooling\n2. **Timeline**: First\u002Flast observed dates with activity phases\n3. **Attribution**: Suspected threat actor with confidence level\n4. **Target profile**: Industry verticals, geographies, organization sizes\n5. **TTPs summary**: ATT&CK Navigator heatmap for campaign-specific techniques\n6. **Shared indicators**: IOCs that span multiple incidents (highest confidence for blocking)\n7. **Detection guidance**: Sigma\u002FYARA rules specific to this campaign\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **Campaign** | STIX object representing a grouping of adversarial behaviors with common objectives over a defined time period |\n| **Intrusion Set** | STIX object grouping related intrusion activity by common objectives, even when actor identity is uncertain |\n| **Pivot** | Using a single data point (IOC, infrastructure, TTP) to discover related events or adversary artifacts |\n| **Clustering** | Machine learning or manual grouping of incidents based on feature similarity to identify campaign boundaries |\n| **False Correlation** | Incorrect linking of unrelated incidents due to shared infrastructure (CDNs, shared hosting) or common tools |\n\n## Tools & Systems\n\n- **MISP Correlation Engine**: Automatic correlation of events sharing attribute values across the MISP instance and federated instances\n- **OpenCTI Graph**: Interactive relationship graph for visualizing campaign linkages with STIX object types\n- **Maltego**: Link analysis for infrastructure and capability pivoting across multiple data sources\n- **Neo4j**: Graph database with Cypher queries for large-scale campaign correlation (millions of events)\n\n## Common Pitfalls\n\n- **CDN\u002FShared hosting false positives**: Cloudflare, AWS CloudFront, and bulletproof hosters serve multiple threat actors. Shared IP alone does not establish campaign linkage.\n- **Common malware conflation**: Multiple threat actors use Cobalt Strike. Shared capability does not indicate same actor without additional corroboration.\n- **Premature attribution**: Forcing campaign-to-actor attribution before evidence threshold is reached produces incorrect intelligence that persists in reports.\n- **Missing temporal analysis**: Events from different years may share infrastructure that was recycled by a different actor, not the same campaign.\n",{"name":5,"tags":57,"author":65,"domain":51,"license":15,"version":66,"nist_csf":67,"subdomain":49,"description":72,"mitre_attack":73},[58,59,60,61,50,62,63,64],"campaign-analysis","correlation","MISP","ATT&CK","intrusion-set","clustering","CTI","team-cybersecurity","1.0.0",[68,69,70,71],"ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02","Correlates disparate security incidents, IOCs, and adversary behaviors across time and organizations to identify unified threat campaigns, attribute them to common threat actors, and extract shared indicators for improved detection. Use when multiple incidents exhibit overlapping indicators, when sector-wide attack campaigns require cross-organizational analysis, or when building campaign-level intelligence products. Activates for requests involving campaign analysis, incident clustering, cross-organizational IOC correlation, or MISP correlation engine.\n",[74,75,76,77,78],"T1566","T1071.001","T1587.001","T1583.001","T1588.002","main","7925716f065257435fdb12e97f7e52842147d5ad",".claude\u002Fskills\u002Fcorrelating-threat-campaigns","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude","https:\u002F\u002Fclaude.com\u002Fclaude-code","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho","Software · Applied AI · Quantitative Modeling · Building with Claude.","2026-06-10 12:24:46",{"source":8,"skillName":5,"commands":88,"prompt":98,"zipAvailable":99},[89,92,95],{"tool":90,"command":91},"npx","npx skills add henriquescastilho\u002Fmy-claude --skill correlating-threat-campaigns",{"tool":93,"command":94},"bunx","bunx skills add henriquescastilho\u002Fmy-claude --skill correlating-threat-campaigns",{"tool":96,"command":97},"pnpm","pnpm dlx skills add henriquescastilho\u002Fmy-claude --skill correlating-threat-campaigns","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fcorrelating-threat-campaigns\u002FSKILL.md",true,[101,106,112],{"path":102,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":104,"sourceHtmlUrl":105},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fcorrelating-threat-campaigns\u002FLICENSE",{"path":107,"resourceType":108,"resourceTypeDesc":109,"sizeBytes":110,"sourceHtmlUrl":111},"references\u002Fapi-reference.md","REFERENCE","参考文档",2192,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fcorrelating-threat-campaigns\u002Freferences\u002Fapi-reference.md",{"path":113,"resourceType":114,"resourceTypeDesc":115,"sizeBytes":116,"sourceHtmlUrl":117},"scripts\u002Fagent.py","SCRIPT","脚本",7498,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fcorrelating-threat-campaigns\u002Fscripts\u002Fagent.py",[119,158,167,176,198,223],{"skillNo":120,"name":121,"nameZh":6,"description":122,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":123,"licenseFileUrl":6,"sourceHtmlUrl":124,"categories":125,"keywords":138,"publishedAt":52},"01M6F0B6XPQ65AX2X0DWK8KT3E","markitdown","Convert files and office documents to Markdown. Supports PDF, DOCX, PPTX, XLSX, images (with OCR), audio (with transcription), HTML, CSV, JSON, XML, ZIP, YouTube URLs, EPubs and more.","MIT","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[126,129,132,135],{"categoryNo":127,"categoryName":128,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000002","文档处理",{"categoryNo":130,"categoryName":131,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":133,"categoryName":134,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000004","电子表格",{"categoryNo":136,"categoryName":137,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000034","行政与办公人员",[121,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157],"docx","PDF","pptx","xlsx","documents","csv","ocr","Audio","Bash","markdown","convert","read","write","edit","html","images","files","youtube","with",{"skillNo":159,"name":121,"nameZh":6,"description":122,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":123,"licenseFileUrl":6,"sourceHtmlUrl":160,"categories":161,"keywords":166,"publishedAt":52},"01M6F06SBHR9F0SDWE282Y8075","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fscientific_writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[162,163,164,165],{"categoryNo":127,"categoryName":128,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":130,"categoryName":131,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":133,"categoryName":134,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":136,"categoryName":137,"taxonomyType":29,"taxonomyTypeDesc":30},[121,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157],{"skillNo":168,"name":121,"nameZh":6,"description":122,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":123,"licenseFileUrl":6,"sourceHtmlUrl":169,"categories":170,"keywords":175,"publishedAt":52},"01M6F02D4R14EJAPBWVDF9J9VQ","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[171,172,173,174],{"categoryNo":127,"categoryName":128,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":130,"categoryName":131,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":133,"categoryName":134,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":136,"categoryName":137,"taxonomyType":29,"taxonomyTypeDesc":30},[121,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157],{"skillNo":177,"name":178,"nameZh":6,"description":179,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":123,"licenseFileUrl":6,"sourceHtmlUrl":180,"categories":181,"keywords":182,"publishedAt":52},"01M6F000KS6YB4MKS774G4R8ND","zarr-python","Chunked N-D arrays for cloud storage. Compressed arrays, parallel I\u002FO, S3\u002FGCS integration, NumPy\u002FDask\u002FXarray compatible, for large-scale scientific computing pipelines.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fzarr-python\u002FSKILL.md",[],[183,184,185,186,187,188,189,190,191,192,193,194,195,196,197],"python","zarr python","storage","integration","s3","gcs","cloud","dask","parallel","pipelines","arrays","numpy","scientific computing","scale","scientific",{"skillNo":199,"name":200,"nameZh":6,"description":201,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":123,"licenseFileUrl":6,"sourceHtmlUrl":202,"categories":203,"keywords":205,"publishedAt":52},"01M6EZZJWFXM1GR78KTW6J0DN8","what-if-oracle","Run structured What-If scenario analysis with multi-branch possibility exploration. Use this skill when the user asks speculative questions like \"what if...\", \"what would happen if...\", \"what are the possibilities\", \"explore scenarios\", \"scenario analysis\", \"possibility space\", \"what could go wrong\", \"best case \u002F worst case\", \"risk analysis\", \"contingency planning\", \"strategic options\", or any question about uncertain futures. Also trigger when the user faces a fork-in-the-road decision, wants to stress-test an idea, or needs to think through consequences before committing.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fwhat-if-oracle\u002FSKILL.md",[204],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[206,207,208,209,210,211,46,212,213,214,215,150,151,216,217,218,219,220,221,222],"oracle","what if oracle","go","run","ux","futures","explore","decision","branch","question","idea","exploration","options","stress-test","strategies","scenario","stress",{"skillNo":224,"name":225,"nameZh":6,"description":226,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":123,"licenseFileUrl":6,"sourceHtmlUrl":227,"categories":228,"keywords":239,"publishedAt":52},"01M6EZZCXAEB49RXGQCJX5E8GB","venue-templates","Access comprehensive LaTeX templates, formatting requirements, and submission guidelines for major scientific publication venues (Nature, Science, PLOS, IEEE, ACM), academic conferences (NeurIPS, ICML, CVPR, CHI), research posters, and grant proposals (NSF, NIH, DOE, DARPA). This skill should be used when preparing manuscripts for journal submission, conference papers, research posters, or grant proposals and need venue-specific formatting requirements and templates.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fvenue-templates\u002FSKILL.md",[229,232,235,236],{"categoryNo":230,"categoryName":231,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":233,"categoryName":234,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":237,"categoryName":238,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000036","内容创作者",[240,241,242,243,244,245,246,247,147,248,150,151,152,249,250,251,252,253,197,254],"templates","venue templates","research","guidelines","NeurIPS","ICML","LaTeX","science","access","proposals","Academic","requirements","formatting","journal","chi"]