[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ETFTMJ2P54CFXF10DCE4G9":3,"skill-same:01M6ETFTMJ2P54CFXF10DCE4G9":89},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":50,"commitSha":51,"skillDirectory":52,"forksCount":53,"repositoryHtmlUrl":54,"repositoryHomepageUrl":6,"ownerHtmlUrl":55,"ownerBlogUrl":6,"ownerDescription":56,"updatedAt":57,"install":58,"resources":71},"01M6ETFTMJ2P54CFXF10DCE4G9","detecting-attacks-on-historian-servers",null,"Detect cyber attacks targeting OT historian servers (OSIsoft PI, Ignition, Wonderware) that sit at the IT\u002FOT boundary and serve as pivot points for lateral movement between enterprise and control networks, including data manipulation, unauthorized queries, and exploitation of historian-specific vulnerabilities.","luokai0\u002Fai-agent-skills-by-luo-kai","luokai0","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F266954973?v=4","01M6E16VNT42JB8B3X3254QWJ7","luo kai","01M6E16VTFVP6S5XJF1V1MPV90",14,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fdetecting-attacks-on-historian-servers\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"historian","detecting attacks on historian servers","serve","cybersecurity","detect","as","control","data manipulation","queries","pi","boundary","networks","data-integrity","pivot-point","ignition","osisoft-pi","ics","ot-security","exploitation","Enterprise","2026-11-10 10:12:30",false,"---\nname: detecting-attacks-on-historian-servers\ndescription: >\n  Detect cyber attacks targeting OT historian servers (OSIsoft PI, Ignition,\n  Wonderware) that sit at the IT\u002FOT boundary and serve as pivot points for\n  lateral movement between enterprise and control networks, including data\n  manipulation, unauthorized queries, and exploitation of historian-specific\n  vulnerabilities.\ndomain: cybersecurity\nsubdomain: ot-ics-security\ntags: [ot-security, ics, historian, osisoft-pi, ignition, pivot-point, data-integrity, lateral-movement]\nversion: \"1.0\"\nauthor: mahipal\nlicense: Apache-2.0\n---\n\n# Detecting Attacks on Historian Servers\n\n## When to Use\n\n- When monitoring historian servers that bridge IT and OT networks for compromise indicators\n- When detecting unauthorized queries or data manipulation in process historian databases\n- When investigating lateral movement through historian servers between IT and OT zones\n- When responding to alerts about exploitation of historian-specific vulnerabilities (CVE-2025-0921)\n- When validating historian data integrity after a suspected OT security incident\n\n**Do not use** for general database security monitoring (see database security skills), for historian deployment and configuration, or for IT-only data warehouse security.\n\n## Prerequisites\n\n- Historian server inventory (OSIsoft PI, Ignition, GE Proficy, Wonderware InSQL)\n- Network monitoring on historian network segments (both IT-facing and OT-facing interfaces)\n- Historian API access for data integrity validation\n- Baseline of normal historian query patterns (which applications query which tags)\n- Understanding of historian architecture (data sources, interfaces, client connections)\n\n## Workflow\n\n### Step 1: Monitor Historian for Attack Indicators\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"OT Historian Attack Detector.\n\nMonitors historian servers for unauthorized access, data manipulation,\nlateral movement indicators, and exploitation of historian-specific\nvulnerabilities. Supports OSIsoft PI and Ignition platforms.\n\"\"\"\n\nimport json\nimport sys\nfrom collections import defaultdict\nfrom datetime import datetime, timedelta\nfrom typing import Dict, List, Optional\n\ntry:\n    import requests\nexcept ImportError:\n    print(\"Install requests: pip install requests\")\n    sys.exit(1)\n\n\nclass HistorianAttackDetector:\n    \"\"\"Detects attacks targeting OT historian servers.\"\"\"\n\n    def __init__(self, historian_type: str, historian_url: str,\n                 api_credentials: dict, verify_ssl: bool = False):\n        self.historian_type = historian_type\n        self.historian_url = historian_url.rstrip(\"\u002F\")\n        self.credentials = api_credentials\n        self.verify_ssl = verify_ssl\n        self.alerts = []\n        self.authorized_clients = set()\n        self.authorized_queries = {}\n\n    def set_baseline(self, authorized_clients: List[str],\n                     authorized_query_patterns: Dict[str, List[str]]):\n        \"\"\"Set baseline of authorized historian clients and query patterns.\"\"\"\n        self.authorized_clients = set(authorized_clients)\n        self.authorized_queries = authorized_query_patterns\n\n    def check_active_connections(self) -> List[dict]:\n        \"\"\"Check for unauthorized connections to historian.\"\"\"\n        connections = []\n\n        if self.historian_type == \"osisoft_pi\":\n            try:\n                resp = requests.get(\n                    f\"{self.historian_url}\u002Fpiwebapi\u002Fsystem\u002Fstatus\",\n                    auth=(self.credentials.get(\"username\"), self.credentials.get(\"password\")),\n                    verify=self.verify_ssl,\n                    timeout=10,\n                )\n                if resp.status_code == 200:\n                    data = resp.json()\n                    connections = data.get(\"ConnectedClients\", [])\n            except requests.RequestException as e:\n                print(f\"[!] PI Web API error: {e}\")\n\n        elif self.historian_type == \"ignition\":\n            try:\n                resp = requests.get(\n                    f\"{self.historian_url}\u002Fdata\u002Fstatus\u002Fconnections\",\n                    headers={\"Authorization\": f\"Bearer {self.credentials.get('token')}\"},\n                    verify=self.verify_ssl,\n                    timeout=10,\n                )\n                if resp.status_code == 200:\n                    connections = resp.json().get(\"connections\", [])\n            except requests.RequestException as e:\n                print(f\"[!] Ignition API error: {e}\")\n\n        # Check for unauthorized clients\n        for conn in connections:\n            client_ip = conn.get(\"client_ip\", conn.get(\"address\", \"\"))\n            if self.authorized_clients and client_ip not in self.authorized_clients:\n                self.alerts.append({\n                    \"severity\": \"HIGH\",\n                    \"type\": \"UNAUTHORIZED_HISTORIAN_CLIENT\",\n                    \"timestamp\": datetime.now().isoformat(),\n                    \"source_ip\": client_ip,\n                    \"details\": f\"Unauthorized client {client_ip} connected to {self.historian_type} historian\",\n                    \"mitre\": \"T0802 - Automated Collection\",\n                })\n\n        return connections\n\n    def check_data_integrity(self, tags: List[str], hours_back: int = 24):\n        \"\"\"Check historian data for manipulation indicators.\"\"\"\n        print(f\"[*] Checking data integrity for {len(tags)} tags over last {hours_back}h\")\n\n        integrity_issues = []\n        for tag in tags:\n            try:\n                if self.historian_type == \"osisoft_pi\":\n                    resp = requests.get(\n                        f\"{self.historian_url}\u002Fpiwebapi\u002Fstreams\u002F{tag}\u002Frecorded\",\n                        params={\"startTime\": f\"*-{hours_back}h\", \"endTime\": \"*\"},\n                        auth=(self.credentials.get(\"username\"), self.credentials.get(\"password\")),\n                        verify=self.verify_ssl,\n                        timeout=15,\n                    )\n                    if resp.status_code == 200:\n                        items = resp.json().get(\"Items\", [])\n                        # Check for suspicious patterns\n                        if len(items) == 0:\n                            integrity_issues.append({\n                                \"tag\": tag, \"issue\": \"NO_DATA\",\n                                \"detail\": \"No data points in expected timeframe - possible deletion\",\n                            })\n                        else:\n                            values = [i.get(\"Value\", 0) for i in items if isinstance(i.get(\"Value\"), (int, float))]\n                            if values and len(set(values)) == 1 and len(values) > 100:\n                                integrity_issues.append({\n                                    \"tag\": tag, \"issue\": \"FLATLINE\",\n                                    \"detail\": f\"Constant value {values[0]} for {len(values)} points - possible replay\u002Fspoofing\",\n                                })\n            except requests.RequestException:\n                pass\n\n        for issue in integrity_issues:\n            self.alerts.append({\n                \"severity\": \"HIGH\",\n                \"type\": f\"DATA_INTEGRITY_{issue['issue']}\",\n                \"timestamp\": datetime.now().isoformat(),\n                \"tag\": issue[\"tag\"],\n                \"details\": issue[\"detail\"],\n                \"mitre\": \"T0809 - Data Destruction\" if issue[\"issue\"] == \"NO_DATA\" else \"T0832 - Manipulation of View\",\n            })\n\n        return integrity_issues\n\n    def check_lateral_movement_indicators(self):\n        \"\"\"Check for indicators of historian being used as pivot point.\"\"\"\n        indicators = []\n\n        # Check 1: Historian making outbound connections to Level 1 devices\n        # (Historian should receive data, not initiate connections to PLCs)\n        indicators.append({\n            \"check\": \"Outbound connections to PLC subnets\",\n            \"description\": \"Historian initiating connections to Level 1 devices may indicate compromise\",\n            \"detection\": \"Monitor firewall logs for historian IP connecting to PLC ports (502, 102, 44818)\",\n        })\n\n        # Check 2: New processes or services on historian\n        indicators.append({\n            \"check\": \"Unauthorized processes on historian server\",\n            \"description\": \"Attackers may install tools on historian for lateral movement\",\n            \"detection\": \"Monitor process creation events (Sysmon EventID 1) on historian\",\n        })\n\n        # Check 3: Unusual authentication to historian\n        indicators.append({\n            \"check\": \"Authentication from unexpected sources\",\n            \"description\": \"Compromised IT systems authenticating to historian for pivoting\",\n            \"detection\": \"Monitor Windows Security Event 4624 for logons from non-baseline sources\",\n        })\n\n        return indicators\n\n    def generate_report(self):\n        \"\"\"Generate historian attack detection report.\"\"\"\n        print(f\"\\n{'='*70}\")\n        print(\"HISTORIAN ATTACK DETECTION REPORT\")\n        print(f\"{'='*70}\")\n        print(f\"Historian Type: {self.historian_type}\")\n        print(f\"Historian URL: {self.historian_url}\")\n        print(f\"Report Time: {datetime.now().isoformat()}\")\n        print(f\"Total Alerts: {len(self.alerts)}\")\n\n        if self.alerts:\n            print(f\"\\n--- ALERTS ---\")\n            for alert in self.alerts:\n                print(f\"\\n  [{alert['severity']}] {alert['type']}\")\n                print(f\"    Time: {alert['timestamp']}\")\n                print(f\"    Detail: {alert['details']}\")\n                print(f\"    MITRE ICS: {alert.get('mitre', 'N\u002FA')}\")\n\n        print(f\"\\n--- LATERAL MOVEMENT CHECKS ---\")\n        for indicator in self.check_lateral_movement_indicators():\n            print(f\"\\n  Check: {indicator['check']}\")\n            print(f\"    Risk: {indicator['description']}\")\n            print(f\"    Detection: {indicator['detection']}\")\n\n\nif __name__ == \"__main__\":\n    detector = HistorianAttackDetector(\n        historian_type=\"osisoft_pi\",\n        historian_url=\"https:\u002F\u002Fpi-server.plant.local\",\n        api_credentials={\"username\": \"pi_reader\", \"password\": \"api_key_here\"},\n    )\n\n    detector.set_baseline(\n        authorized_clients=[\"10.10.2.10\", \"10.10.2.20\", \"10.10.3.50\", \"10.10.150.10\"],\n        authorized_query_patterns={},\n    )\n\n    detector.check_active_connections()\n    detector.check_data_integrity(tags=[\"REACTOR_01.TEMP\", \"PUMP_03.FLOW\"], hours_back=24)\n    detector.generate_report()\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| OT Historian | Database server (OSIsoft PI, Ignition, Wonderware) storing time-series process data from SCADA\u002FDCS systems |\n| Pivot Point | Historian's position between IT and OT networks makes it a prime target for attackers to move between zones |\n| Data Replay Attack | Feeding historical data to an HMI to mask real-time process manipulation (Stuxnet technique) |\n| OSIsoft PI | Most widely deployed OT historian, used by 65% of Global 500 process companies |\n| Ignition | Inductive Automation SCADA platform with historian module, increasingly targeted due to Python scripting capabilities |\n| CVE-2025-0921 | Ignition SCADA privileged file system vulnerability allowing escalation through malicious project files |\n\n## Output Format\n\n```\nHISTORIAN ATTACK DETECTION REPORT\n====================================\nHistorian: [type and hostname]\nDate: YYYY-MM-DD\n\nCONNECTION ANALYSIS:\n  Authorized Clients: [count]\n  Unauthorized Clients Detected: [count with IPs]\n\nDATA INTEGRITY:\n  Tags Checked: [count]\n  Integrity Issues: [count]\n  Flatline Detections: [count]\n  Data Gaps: [count]\n\nLATERAL MOVEMENT INDICATORS:\n  Outbound PLC Connections: [found\u002Fnot found]\n  Unauthorized Processes: [found\u002Fnot found]\n  Anomalous Authentication: [found\u002Fnot found]\n```\n","# Detecting Attacks on Historian Servers\n\n## When to Use\n\n- When monitoring historian servers that bridge IT and OT networks for compromise indicators\n- When detecting unauthorized queries or data manipulation in process historian databases\n- When investigating lateral movement through historian servers between IT and OT zones\n- When responding to alerts about exploitation of historian-specific vulnerabilities (CVE-2025-0921)\n- When validating historian data integrity after a suspected OT security incident\n\n**Do not use** for general database security monitoring (see database security skills), for historian deployment and configuration, or for IT-only data warehouse security.\n\n## Prerequisites\n\n- Historian server inventory (OSIsoft PI, Ignition, GE Proficy, Wonderware InSQL)\n- Network monitoring on historian network segments (both IT-facing and OT-facing interfaces)\n- Historian API access for data integrity validation\n- Baseline of normal historian query patterns (which applications query which tags)\n- Understanding of historian architecture (data sources, interfaces, client connections)\n\n## Workflow\n\n### Step 1: Monitor Historian for Attack Indicators\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"OT Historian Attack Detector.\n\nMonitors historian servers for unauthorized access, data manipulation,\nlateral movement indicators, and exploitation of historian-specific\nvulnerabilities. Supports OSIsoft PI and Ignition platforms.\n\"\"\"\n\nimport json\nimport sys\nfrom collections import defaultdict\nfrom datetime import datetime, timedelta\nfrom typing import Dict, List, Optional\n\ntry:\n    import requests\nexcept ImportError:\n    print(\"Install requests: pip install requests\")\n    sys.exit(1)\n\n\nclass HistorianAttackDetector:\n    \"\"\"Detects attacks targeting OT historian servers.\"\"\"\n\n    def __init__(self, historian_type: str, historian_url: str,\n                 api_credentials: dict, verify_ssl: bool = False):\n        self.historian_type = historian_type\n        self.historian_url = historian_url.rstrip(\"\u002F\")\n        self.credentials = api_credentials\n        self.verify_ssl = verify_ssl\n        self.alerts = []\n        self.authorized_clients = set()\n        self.authorized_queries = {}\n\n    def set_baseline(self, authorized_clients: List[str],\n                     authorized_query_patterns: Dict[str, List[str]]):\n        \"\"\"Set baseline of authorized historian clients and query patterns.\"\"\"\n        self.authorized_clients = set(authorized_clients)\n        self.authorized_queries = authorized_query_patterns\n\n    def check_active_connections(self) -> List[dict]:\n        \"\"\"Check for unauthorized connections to historian.\"\"\"\n        connections = []\n\n        if self.historian_type == \"osisoft_pi\":\n            try:\n                resp = requests.get(\n                    f\"{self.historian_url}\u002Fpiwebapi\u002Fsystem\u002Fstatus\",\n                    auth=(self.credentials.get(\"username\"), self.credentials.get(\"password\")),\n                    verify=self.verify_ssl,\n                    timeout=10,\n                )\n                if resp.status_code == 200:\n                    data = resp.json()\n                    connections = data.get(\"ConnectedClients\", [])\n            except requests.RequestException as e:\n                print(f\"[!] PI Web API error: {e}\")\n\n        elif self.historian_type == \"ignition\":\n            try:\n                resp = requests.get(\n                    f\"{self.historian_url}\u002Fdata\u002Fstatus\u002Fconnections\",\n                    headers={\"Authorization\": f\"Bearer {self.credentials.get('token')}\"},\n                    verify=self.verify_ssl,\n                    timeout=10,\n                )\n                if resp.status_code == 200:\n                    connections = resp.json().get(\"connections\", [])\n            except requests.RequestException as e:\n                print(f\"[!] Ignition API error: {e}\")\n\n        # Check for unauthorized clients\n        for conn in connections:\n            client_ip = conn.get(\"client_ip\", conn.get(\"address\", \"\"))\n            if self.authorized_clients and client_ip not in self.authorized_clients:\n                self.alerts.append({\n                    \"severity\": \"HIGH\",\n                    \"type\": \"UNAUTHORIZED_HISTORIAN_CLIENT\",\n                    \"timestamp\": datetime.now().isoformat(),\n                    \"source_ip\": client_ip,\n                    \"details\": f\"Unauthorized client {client_ip} connected to {self.historian_type} historian\",\n                    \"mitre\": \"T0802 - Automated Collection\",\n                })\n\n        return connections\n\n    def check_data_integrity(self, tags: List[str], hours_back: int = 24):\n        \"\"\"Check historian data for manipulation indicators.\"\"\"\n        print(f\"[*] Checking data integrity for {len(tags)} tags over last {hours_back}h\")\n\n        integrity_issues = []\n        for tag in tags:\n            try:\n                if self.historian_type == \"osisoft_pi\":\n                    resp = requests.get(\n                        f\"{self.historian_url}\u002Fpiwebapi\u002Fstreams\u002F{tag}\u002Frecorded\",\n                        params={\"startTime\": f\"*-{hours_back}h\", \"endTime\": \"*\"},\n                        auth=(self.credentials.get(\"username\"), self.credentials.get(\"password\")),\n                        verify=self.verify_ssl,\n                        timeout=15,\n                    )\n                    if resp.status_code == 200:\n                        items = resp.json().get(\"Items\", [])\n                        # Check for suspicious patterns\n                        if len(items) == 0:\n                            integrity_issues.append({\n                                \"tag\": tag, \"issue\": \"NO_DATA\",\n                                \"detail\": \"No data points in expected timeframe - possible deletion\",\n                            })\n                        else:\n                            values = [i.get(\"Value\", 0) for i in items if isinstance(i.get(\"Value\"), (int, float))]\n                            if values and len(set(values)) == 1 and len(values) > 100:\n                                integrity_issues.append({\n                                    \"tag\": tag, \"issue\": \"FLATLINE\",\n                                    \"detail\": f\"Constant value {values[0]} for {len(values)} points - possible replay\u002Fspoofing\",\n                                })\n            except requests.RequestException:\n                pass\n\n        for issue in integrity_issues:\n            self.alerts.append({\n                \"severity\": \"HIGH\",\n                \"type\": f\"DATA_INTEGRITY_{issue['issue']}\",\n                \"timestamp\": datetime.now().isoformat(),\n                \"tag\": issue[\"tag\"],\n                \"details\": issue[\"detail\"],\n                \"mitre\": \"T0809 - Data Destruction\" if issue[\"issue\"] == \"NO_DATA\" else \"T0832 - Manipulation of View\",\n            })\n\n        return integrity_issues\n\n    def check_lateral_movement_indicators(self):\n        \"\"\"Check for indicators of historian being used as pivot point.\"\"\"\n        indicators = []\n\n        # Check 1: Historian making outbound connections to Level 1 devices\n        # (Historian should receive data, not initiate connections to PLCs)\n        indicators.append({\n            \"check\": \"Outbound connections to PLC subnets\",\n            \"description\": \"Historian initiating connections to Level 1 devices may indicate compromise\",\n            \"detection\": \"Monitor firewall logs for historian IP connecting to PLC ports (502, 102, 44818)\",\n        })\n\n        # Check 2: New processes or services on historian\n        indicators.append({\n            \"check\": \"Unauthorized processes on historian server\",\n            \"description\": \"Attackers may install tools on historian for lateral movement\",\n            \"detection\": \"Monitor process creation events (Sysmon EventID 1) on historian\",\n        })\n\n        # Check 3: Unusual authentication to historian\n        indicators.append({\n            \"check\": \"Authentication from unexpected sources\",\n            \"description\": \"Compromised IT systems authenticating to historian for pivoting\",\n            \"detection\": \"Monitor Windows Security Event 4624 for logons from non-baseline sources\",\n        })\n\n        return indicators\n\n    def generate_report(self):\n        \"\"\"Generate historian attack detection report.\"\"\"\n        print(f\"\\n{'='*70}\")\n        print(\"HISTORIAN ATTACK DETECTION REPORT\")\n        print(f\"{'='*70}\")\n        print(f\"Historian Type: {self.historian_type}\")\n        print(f\"Historian URL: {self.historian_url}\")\n        print(f\"Report Time: {datetime.now().isoformat()}\")\n        print(f\"Total Alerts: {len(self.alerts)}\")\n\n        if self.alerts:\n            print(f\"\\n--- ALERTS ---\")\n            for alert in self.alerts:\n                print(f\"\\n  [{alert['severity']}] {alert['type']}\")\n                print(f\"    Time: {alert['timestamp']}\")\n                print(f\"    Detail: {alert['details']}\")\n                print(f\"    MITRE ICS: {alert.get('mitre', 'N\u002FA')}\")\n\n        print(f\"\\n--- LATERAL MOVEMENT CHECKS ---\")\n        for indicator in self.check_lateral_movement_indicators():\n            print(f\"\\n  Check: {indicator['check']}\")\n            print(f\"    Risk: {indicator['description']}\")\n            print(f\"    Detection: {indicator['detection']}\")\n\n\nif __name__ == \"__main__\":\n    detector = HistorianAttackDetector(\n        historian_type=\"osisoft_pi\",\n        historian_url=\"https:\u002F\u002Fpi-server.plant.local\",\n        api_credentials={\"username\": \"pi_reader\", \"password\": \"api_key_here\"},\n    )\n\n    detector.set_baseline(\n        authorized_clients=[\"10.10.2.10\", \"10.10.2.20\", \"10.10.3.50\", \"10.10.150.10\"],\n        authorized_query_patterns={},\n    )\n\n    detector.check_active_connections()\n    detector.check_data_integrity(tags=[\"REACTOR_01.TEMP\", \"PUMP_03.FLOW\"], hours_back=24)\n    detector.generate_report()\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| OT Historian | Database server (OSIsoft PI, Ignition, Wonderware) storing time-series process data from SCADA\u002FDCS systems |\n| Pivot Point | Historian's position between IT and OT networks makes it a prime target for attackers to move between zones |\n| Data Replay Attack | Feeding historical data to an HMI to mask real-time process manipulation (Stuxnet technique) |\n| OSIsoft PI | Most widely deployed OT historian, used by 65% of Global 500 process companies |\n| Ignition | Inductive Automation SCADA platform with historian module, increasingly targeted due to Python scripting capabilities |\n| CVE-2025-0921 | Ignition SCADA privileged file system vulnerability allowing escalation through malicious project files |\n\n## Output Format\n\n```\nHISTORIAN ATTACK DETECTION REPORT\n====================================\nHistorian: [type and hostname]\nDate: YYYY-MM-DD\n\nCONNECTION ANALYSIS:\n  Authorized Clients: [count]\n  Unauthorized Clients Detected: [count with IPs]\n\nDATA INTEGRITY:\n  Tags Checked: [count]\n  Integrity Issues: [count]\n  Flatline Detections: [count]\n  Data Gaps: [count]\n\nLATERAL MOVEMENT INDICATORS:\n  Outbound PLC Connections: [found\u002Fnot found]\n  Unauthorized Processes: [found\u002Fnot found]\n  Anomalous Authentication: [found\u002Fnot found]\n```\n",{"name":5,"tags":44,"author":46,"domain":22,"license":15,"version":47,"subdomain":48,"description":49},[36,35,19,34,33,32,31,45],"lateral-movement","mahipal","1.0","ot-ics-security","Detect cyber attacks targeting OT historian servers (OSIsoft PI, Ignition, Wonderware) that sit at the IT\u002FOT boundary and serve as pivot points for lateral movement between enterprise and control networks, including data manipulation, unauthorized queries, and exploitation of historian-specific vulnerabilities.\n","main","4d2fb89cdfb75f3f6fd3c6c5ec9ad90ea129eb3c","ai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fdetecting-attacks-on-historian-servers",1,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai","https:\u002F\u002Fgithub.com\u002Fluokai0","a solo builder.","2026-05-06 04:29:04",{"source":8,"skillName":5,"commands":59,"prompt":69,"zipAvailable":70},[60,63,66],{"tool":61,"command":62},"npx","npx skills add luokai0\u002Fai-agent-skills-by-luo-kai --skill detecting-attacks-on-historian-servers",{"tool":64,"command":65},"bunx","bunx skills add luokai0\u002Fai-agent-skills-by-luo-kai --skill detecting-attacks-on-historian-servers",{"tool":67,"command":68},"pnpm","pnpm dlx skills add luokai0\u002Fai-agent-skills-by-luo-kai --skill detecting-attacks-on-historian-servers","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fdetecting-attacks-on-historian-servers\u002FSKILL.md",true,[72,77,83],{"path":73,"resourceType":73,"resourceTypeDesc":74,"sizeBytes":75,"sourceHtmlUrl":76},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fdetecting-attacks-on-historian-servers\u002FLICENSE",{"path":78,"resourceType":79,"resourceTypeDesc":80,"sizeBytes":81,"sourceHtmlUrl":82},"references\u002Fapi-reference.md","REFERENCE","参考文档",1954,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fdetecting-attacks-on-historian-servers\u002Freferences\u002Fapi-reference.md",{"path":84,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":87,"sourceHtmlUrl":88},"scripts\u002Fagent.py","SCRIPT","脚本",7180,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fdetecting-attacks-on-historian-servers\u002Fscripts\u002Fagent.py",[90,118,135,165,198,235],{"skillNo":91,"name":92,"nameZh":6,"description":93,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":94,"licenseFileUrl":6,"sourceHtmlUrl":95,"categories":96,"keywords":97,"publishedAt":39},"01M6F2SKTE208174C7S7JJCZC7","write-contracts","Generates secure Aptos Move V2 smart contracts with Object model, Digital Asset integration, security patterns, and storage type guidance. Includes comprehensive storage decision framework for optimal data structure selection. Triggers on: 'write contract', 'create NFT collection', 'build marketplace', 'implement minting', 'generate Move module', 'create token contract', 'build DAO', 'implement staking'. Ask storage questions when: 'store', 'track', 'registry', 'mapping', 'list', 'collection'.","MIT","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fwrite-contracts\u002FSKILL.md",[],[98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117],"write","contracts","write contracts","storage","secure","create","generate","collection","model","decision","ask","smart-contracts","selection","objects","structure","nft","token","aptos","critical","move",{"skillNo":119,"name":120,"nameZh":6,"description":121,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":94,"licenseFileUrl":6,"sourceHtmlUrl":122,"categories":123,"keywords":124,"publishedAt":39},"01M6F2RFXJ6T9MKW0A7N7GM45B","web-search","通用网络搜索技能，支持多引擎搜索（百度、必应、DuckDuckGo），无需API密钥即可获取实时信息","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fweb-search-ex-skill\u002FSKILL.md",[],[125,126,127,128,129,130,131,132,133,134],"web","search","web search","搜索","baidu","bing","duckduckgo","百度","多引擎","internet",{"skillNo":136,"name":137,"nameZh":6,"description":138,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":94,"licenseFileUrl":6,"sourceHtmlUrl":139,"categories":140,"keywords":146,"publishedAt":39},"01M6F2K968G1FZEZFPW2E6B222","solo-build","Execute implementation plan tasks with TDD workflow, auto-commit, and phase gates. Use when user says \"build it\", \"start building\", \"execute plan\", \"implement tasks\", \"ship it\", or references a track ID. Do NOT use for planning (use \u002Fplan) or scaffolding (use \u002Fscaffold).","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fsolo-build\u002FSKILL.md",[141],{"categoryNo":142,"categoryName":143,"taxonomyType":144,"taxonomyTypeDesc":145},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[147,148,149,150,151,152,153,154,126,155,156,157,98,158,159,160,161,162,163,164],"build","solo","solo build","MCP","workflow","commit","tasks","code","Bash","plan","read","auto","references","context7","query","scaffolding","ship it","project",{"skillNo":166,"name":167,"nameZh":6,"description":168,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":94,"licenseFileUrl":6,"sourceHtmlUrl":169,"categories":170,"keywords":177,"publishedAt":39},"01M6F2GKN39SGHSPWYB3662YC8","react-email","Use when building HTML email templates with React components, adding a visual email editor to an application using the React Email visual editor, rendering emails to HTML, or sending emails with Resend. Covers welcome emails, password resets, notifications, order confirmations, newsletters, transactional emails, and the embeddable email editor component.","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Freact-email-skills\u002FSKILL.md",[171,174],{"categoryNo":172,"categoryName":173,"taxonomyType":144,"taxonomyTypeDesc":145},"01JBSEEDCAT000000000000005","邮件与沟通",{"categoryNo":175,"categoryName":176,"taxonomyType":144,"taxonomyTypeDesc":145},"01JBSEEDCAT000000000000009","前端开发",[178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197],"react","email","react email","github","editor","components","react components","component","welcome","https","notifications","password","node","use","html","resend","visual","emails","rendering","with",{"skillNo":199,"name":200,"nameZh":6,"description":201,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":94,"licenseFileUrl":6,"sourceHtmlUrl":202,"categories":203,"keywords":216,"publishedAt":39},"01M6F2FBVGVDFSG8SSFJGXA40C","APITester Agent-Driven API Testing","Test API endpoints and document responses. Define tests in plain English, run them, get formatted results. Agent-driven Postman alternative.","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fopenclaw-api-tester\u002FSKILL.md",[204,207,210,211],{"categoryNo":205,"categoryName":206,"taxonomyType":144,"taxonomyTypeDesc":145},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":208,"categoryName":209,"taxonomyType":144,"taxonomyTypeDesc":145},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":142,"categoryName":143,"taxonomyType":144,"taxonomyTypeDesc":145},{"categoryNo":212,"categoryName":213,"taxonomyType":214,"taxonomyTypeDesc":215},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234],"testing","api","api testing","driven","APITester Agent Driven API Testing","test","run","postman","results","plain english","tester","endpoints","document","get","define","tests","english","api-tester",{"skillNo":236,"name":237,"nameZh":6,"description":238,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":94,"licenseFileUrl":6,"sourceHtmlUrl":239,"categories":240,"keywords":241,"publishedAt":39},"01M6F273Y3NGAPVJZ608BC0G9G","hubspot-implementation-plan","Generate a phased implementation plan from a HubSpot audit report. Creates prioritized, sequenced cleanup processes with effort estimates, dependencies, and automation feasibility. Use after running \u002Fhubspot-audit.","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fhubspot-implementation-plan\u002FSKILL.md",[],[156,242,243,244,245,246,247,104,248,249,250,251,252,191,253,254,197,255],"implementation","hubspot","hubspot implementation plan","automation","feasibility","cleanup","planning","report","audit","audit report","phased implementation","dependencies","processes","hubspot audit"]