[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ETMY6D6FS4278X8WRMZBGT":3,"skill-same:01M6ETMY6D6FS4278X8WRMZBGT":107},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":50,"commitSha":51,"skillDirectory":52,"forksCount":53,"repositoryHtmlUrl":54,"repositoryHomepageUrl":6,"ownerHtmlUrl":55,"ownerBlogUrl":6,"ownerDescription":56,"updatedAt":57,"install":58,"resources":71},"01M6ETMY6D6FS4278X8WRMZBGT","detecting-lateral-movement-with-zeek",null,"Detect lateral movement in network traffic using Zeek (formerly Bro) log analysis. Parses conn.log, smb_mapping.log, smb_files.log, dce_rpc.log, kerberos.log, and ntlm.log to identify SMB file transfers, NTLM account spray activity, remote service execution, and anomalous internal connections.","luokai0\u002Fai-agent-skills-by-luo-kai","luokai0","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F266954973?v=4","01M6E16VNT42JB8B3X3254QWJ7","luo kai","01M6E16VTFVP6S5XJF1V1MPV90",14,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fdetecting-lateral-movement-with-zeek\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"detecting","with","Zeek","detecting lateral movement with zeek","execution","remote","connections","files","log","log analysis","bro","analysis","cybersecurity","ntlm-spray","dce-rpc","smb","network-security","network-forensics","file","rpc","2026-11-10 10:12:30",false,"---\nname: detecting-lateral-movement-with-zeek\ndescription: >\n  Detect lateral movement in network traffic using Zeek (formerly Bro) log\n  analysis. Parses conn.log, smb_mapping.log, smb_files.log, dce_rpc.log,\n  kerberos.log, and ntlm.log to identify SMB file transfers, NTLM account\n  spray activity, remote service execution, and anomalous internal connections.\ndomain: cybersecurity\nsubdomain: network-security\ntags: [zeek, lateral-movement, smb, dce-rpc, ntlm-spray, network-forensics]\nversion: \"1.0\"\nauthor: mahipal\nlicense: Apache-2.0\n---\n\n# Detecting Lateral Movement with Zeek\n\nAnalyze Zeek network logs to identify lateral movement techniques including\nSMB admin share access, DCE\u002FRPC remote service creation, NTLM account spray,\nKerberos ticket anomalies, and large internal data transfers indicative\nof staging or exfiltration between hosts.\n\n## When to Use\n\n- Hunting for lateral movement after an initial compromise indicator is found on one endpoint\n- Investigating suspected NTLM account spray or Pass-the-Ticket attacks across the internal network\n- Monitoring SMB traffic for unauthorized file transfers to admin shares (C$, ADMIN$, IPC$)\n- Detecting remote service execution via DCE\u002FRPC (PsExec, schtasks, WMI lateral patterns)\n- Building alerting rules for internal network anomalies in a Zeek-based NSMP deployment\n- Performing post-incident timeline reconstruction using Zeek logs as a network-level evidence source\n\n**Do not use** as a standalone detection mechanism. Zeek sees network traffic only; combine with endpoint telemetry (Sysmon, EDR) for full visibility. Encrypted SMB3 traffic may limit Zeek's visibility into file-level details.\n\n## Prerequisites\n\n- Zeek 6.0+ deployed on a network tap or SPAN port monitoring internal VLAN traffic\n- Zeek SMB analyzer enabled (loaded by default: `@load base\u002Fprotocols\u002Fsmb`)\n- Zeek DCE\u002FRPC analyzer enabled (`@load base\u002Fprotocols\u002Fdce-rpc`)\n- Zeek Kerberos analyzer enabled (`@load base\u002Fprotocols\u002Fkrb`)\n- Python 3.8+ (standard library only)\n- Access to Zeek log directory (default: `\u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002F`)\n- Familiarity with Zeek TSV log format (fields separated by `\\t`, header lines prefixed with `#`)\n\n## Workflow\n\n### Step 1: Verify Zeek Log Collection\n\nConfirm that Zeek is producing the required log files for lateral movement detection:\n\n```bash\n# Check that all required analyzers are producing logs\nls -la \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fconn.log\nls -la \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fsmb_mapping.log\nls -la \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fsmb_files.log\nls -la \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fdce_rpc.log\nls -la \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fkerberos.log\nls -la \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fntlm.log\n\n# Quick field check on conn.log\nzeek-cut id.orig_h id.resp_h id.resp_p proto service \u003C \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fconn.log | head -20\n```\n\n### Step 2: Parse conn.log for Internal Lateral Patterns\n\nIdentify connections between internal hosts on lateral-movement-associated ports:\n\n```bash\n# Extract SMB connections (port 445) between internal hosts\nzeek-cut ts id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes \\\n  \u003C \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fconn.log \\\n  | awk '$5 == 445 && $7 == \"smb\"'\n\n# Extract DCE\u002FRPC connections (port 135)\nzeek-cut ts id.orig_h id.resp_h id.resp_p service \\\n  \u003C \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fconn.log \\\n  | awk '$4 == 135'\n\n# Extract WinRM connections (port 5985\u002F5986)\nzeek-cut ts id.orig_h id.resp_h id.resp_p service \\\n  \u003C \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fconn.log \\\n  | awk '$4 == 5985 || $4 == 5986'\n```\n\n### Step 3: Analyze SMB Admin Share Access\n\nDetect access to administrative shares (C$, ADMIN$, IPC$) which is the primary vector for tools like PsExec:\n\n```bash\n# Check smb_mapping.log for admin share access\nzeek-cut ts id.orig_h id.resp_h path share_type \\\n  \u003C \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fsmb_mapping.log \\\n  | grep -iE '(C\\$|ADMIN\\$|IPC\\$)'\n\n# Check smb_files.log for file writes to admin shares\nzeek-cut ts id.orig_h id.resp_h action path name size \\\n  \u003C \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fsmb_files.log \\\n  | grep -i 'SMB::FILE_WRITE'\n```\n\nDeploy the following Zeek script to generate `notice.log` alerts on admin share access:\n\n```zeek\n@load base\u002Fprotocols\u002Fsmb\n@load base\u002Fframeworks\u002Fnotice\n\nredef enum Notice::Type += {\n    Admin_Share_Access\n};\n\nevent smb1_tree_connect_andx_request(c: connection, hdr: SMB1::Header, path: string, service: string) {\n    if ( \u002F\\$\u002F in path )\n        NOTICE([$note=Admin_Share_Access,\n                $msg=fmt(\"Admin share access: %s -> %s (%s)\", c$id$orig_h, c$id$resp_h, path),\n                $conn=c]);\n}\n```\n\n### Step 4: Detect DCE\u002FRPC Remote Service Operations\n\nMonitor for remote service creation and scheduled task registration via DCE\u002FRPC:\n\n```bash\n# Look for service control manager operations (PsExec pattern)\nzeek-cut ts id.orig_h id.resp_h endpoint operation \\\n  \u003C \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fdce_rpc.log \\\n  | grep -iE '(svcctl|atsvc|ITaskSchedulerService)'\n```\n\n### Step 5: Detect NTLM Account Spray\n\nAnalyze ntlm.log for authentication anomalies indicating credential reuse.\nZeek's ntlm.log does not expose password hashes, so this detection identifies\na single account authenticating to many hosts in a short window — the network\nsignature of credential spraying tools like CrackMapExec:\n\n```bash\n# Extract NTLM authentications\nzeek-cut ts id.orig_h id.resp_h username domainname server_nb_computer_name success \\\n  \u003C \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fntlm.log\n\n# Failed NTLM authentications (brute force or credential testing)\nzeek-cut ts id.orig_h id.resp_h username success \\\n  \u003C \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fntlm.log \\\n  | awk '$5 == \"F\"'\n\n# Sort by timestamp for timeline analysis\nzeek-cut ts id.orig_h id.resp_h username success \\\n  \u003C \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fntlm.log \\\n  | sort -k1,1\n```\n\nDeploy the following Zeek script to generate `notice.log` alerts when a single\naccount touches more hosts than the threshold in a rolling window:\n\n```zeek\n@load base\u002Fprotocols\u002Fntlm\n@load base\u002Fframeworks\u002Fnotice\n\nredef enum Notice::Type += {\n    NTLM_Account_Spray\n};\n\nglobal ntlm_tracker: table[string] of set[addr] &create_expire=5min;\nconst spray_threshold = 3 &redef;\n\nevent ntlm_log(rec: NTLM::Info) {\n    if ( ! rec?$username || rec$username == \"-\" )\n        return;\n    if ( rec$username !in ntlm_tracker )\n        ntlm_tracker[rec$username] = set();\n    add ntlm_tracker[rec$username][rec$id$resp_h];\n    if ( |ntlm_tracker[rec$username]| >= spray_threshold )\n        NOTICE([$note=NTLM_Account_Spray,\n                $msg=fmt(\"NTLM account spray: %s -> %d hosts\", rec$username, |ntlm_tracker[rec$username]|),\n                $sub=rec$username,\n                $conn=rec$id]);\n}\n```\n\n### Step 6: Run the Automated Analysis Agent\n\nUse the provided agent.py for comprehensive lateral movement detection:\n\n```bash\npython3 agent.py \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002F\npython3 agent.py \u002Fopt\u002Fzeek\u002Flogs\u002F2026-03-18\u002F  # Analyze a specific date\n```\n\n## Verification\n\n- Confirm conn.log captures internal SMB (port 445) and DCE\u002FRPC (port 135) connections with correct field parsing\n- Verify smb_mapping.log correctly logs admin share paths (C$, ADMIN$, IPC$)\n- Test with a known PsExec execution in a lab: expect to see SMB FILE_WRITE of the service binary followed by DCE\u002FRPC svcctl CreateService\n- Validate NTLM log parsing by performing a test authentication and confirming username, domain, and success fields are captured; verify the NTLM Account Spray Zeek script generates a `notice.log` entry when the spray threshold is exceeded\n- Cross-reference Zeek alerts with Sysmon Event ID 1 (Process Creation) on the target host to confirm end-to-end detection\n- Verify the agent correctly handles both TSV and JSON Zeek log formats\n","# Detecting Lateral Movement with Zeek\n\nAnalyze Zeek network logs to identify lateral movement techniques including\nSMB admin share access, DCE\u002FRPC remote service creation, NTLM account spray,\nKerberos ticket anomalies, and large internal data transfers indicative\nof staging or exfiltration between hosts.\n\n## When to Use\n\n- Hunting for lateral movement after an initial compromise indicator is found on one endpoint\n- Investigating suspected NTLM account spray or Pass-the-Ticket attacks across the internal network\n- Monitoring SMB traffic for unauthorized file transfers to admin shares (C$, ADMIN$, IPC$)\n- Detecting remote service execution via DCE\u002FRPC (PsExec, schtasks, WMI lateral patterns)\n- Building alerting rules for internal network anomalies in a Zeek-based NSMP deployment\n- Performing post-incident timeline reconstruction using Zeek logs as a network-level evidence source\n\n**Do not use** as a standalone detection mechanism. Zeek sees network traffic only; combine with endpoint telemetry (Sysmon, EDR) for full visibility. Encrypted SMB3 traffic may limit Zeek's visibility into file-level details.\n\n## Prerequisites\n\n- Zeek 6.0+ deployed on a network tap or SPAN port monitoring internal VLAN traffic\n- Zeek SMB analyzer enabled (loaded by default: `@load base\u002Fprotocols\u002Fsmb`)\n- Zeek DCE\u002FRPC analyzer enabled (`@load base\u002Fprotocols\u002Fdce-rpc`)\n- Zeek Kerberos analyzer enabled (`@load base\u002Fprotocols\u002Fkrb`)\n- Python 3.8+ (standard library only)\n- Access to Zeek log directory (default: `\u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002F`)\n- Familiarity with Zeek TSV log format (fields separated by `\\t`, header lines prefixed with `#`)\n\n## Workflow\n\n### Step 1: Verify Zeek Log Collection\n\nConfirm that Zeek is producing the required log files for lateral movement detection:\n\n```bash\n# Check that all required analyzers are producing logs\nls -la \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fconn.log\nls -la \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fsmb_mapping.log\nls -la \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fsmb_files.log\nls -la \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fdce_rpc.log\nls -la \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fkerberos.log\nls -la \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fntlm.log\n\n# Quick field check on conn.log\nzeek-cut id.orig_h id.resp_h id.resp_p proto service \u003C \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fconn.log | head -20\n```\n\n### Step 2: Parse conn.log for Internal Lateral Patterns\n\nIdentify connections between internal hosts on lateral-movement-associated ports:\n\n```bash\n# Extract SMB connections (port 445) between internal hosts\nzeek-cut ts id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes \\\n  \u003C \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fconn.log \\\n  | awk '$5 == 445 && $7 == \"smb\"'\n\n# Extract DCE\u002FRPC connections (port 135)\nzeek-cut ts id.orig_h id.resp_h id.resp_p service \\\n  \u003C \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fconn.log \\\n  | awk '$4 == 135'\n\n# Extract WinRM connections (port 5985\u002F5986)\nzeek-cut ts id.orig_h id.resp_h id.resp_p service \\\n  \u003C \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fconn.log \\\n  | awk '$4 == 5985 || $4 == 5986'\n```\n\n### Step 3: Analyze SMB Admin Share Access\n\nDetect access to administrative shares (C$, ADMIN$, IPC$) which is the primary vector for tools like PsExec:\n\n```bash\n# Check smb_mapping.log for admin share access\nzeek-cut ts id.orig_h id.resp_h path share_type \\\n  \u003C \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fsmb_mapping.log \\\n  | grep -iE '(C\\$|ADMIN\\$|IPC\\$)'\n\n# Check smb_files.log for file writes to admin shares\nzeek-cut ts id.orig_h id.resp_h action path name size \\\n  \u003C \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fsmb_files.log \\\n  | grep -i 'SMB::FILE_WRITE'\n```\n\nDeploy the following Zeek script to generate `notice.log` alerts on admin share access:\n\n```zeek\n@load base\u002Fprotocols\u002Fsmb\n@load base\u002Fframeworks\u002Fnotice\n\nredef enum Notice::Type += {\n    Admin_Share_Access\n};\n\nevent smb1_tree_connect_andx_request(c: connection, hdr: SMB1::Header, path: string, service: string) {\n    if ( \u002F\\$\u002F in path )\n        NOTICE([$note=Admin_Share_Access,\n                $msg=fmt(\"Admin share access: %s -> %s (%s)\", c$id$orig_h, c$id$resp_h, path),\n                $conn=c]);\n}\n```\n\n### Step 4: Detect DCE\u002FRPC Remote Service Operations\n\nMonitor for remote service creation and scheduled task registration via DCE\u002FRPC:\n\n```bash\n# Look for service control manager operations (PsExec pattern)\nzeek-cut ts id.orig_h id.resp_h endpoint operation \\\n  \u003C \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fdce_rpc.log \\\n  | grep -iE '(svcctl|atsvc|ITaskSchedulerService)'\n```\n\n### Step 5: Detect NTLM Account Spray\n\nAnalyze ntlm.log for authentication anomalies indicating credential reuse.\nZeek's ntlm.log does not expose password hashes, so this detection identifies\na single account authenticating to many hosts in a short window — the network\nsignature of credential spraying tools like CrackMapExec:\n\n```bash\n# Extract NTLM authentications\nzeek-cut ts id.orig_h id.resp_h username domainname server_nb_computer_name success \\\n  \u003C \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fntlm.log\n\n# Failed NTLM authentications (brute force or credential testing)\nzeek-cut ts id.orig_h id.resp_h username success \\\n  \u003C \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fntlm.log \\\n  | awk '$5 == \"F\"'\n\n# Sort by timestamp for timeline analysis\nzeek-cut ts id.orig_h id.resp_h username success \\\n  \u003C \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fntlm.log \\\n  | sort -k1,1\n```\n\nDeploy the following Zeek script to generate `notice.log` alerts when a single\naccount touches more hosts than the threshold in a rolling window:\n\n```zeek\n@load base\u002Fprotocols\u002Fntlm\n@load base\u002Fframeworks\u002Fnotice\n\nredef enum Notice::Type += {\n    NTLM_Account_Spray\n};\n\nglobal ntlm_tracker: table[string] of set[addr] &create_expire=5min;\nconst spray_threshold = 3 &redef;\n\nevent ntlm_log(rec: NTLM::Info) {\n    if ( ! rec?$username || rec$username == \"-\" )\n        return;\n    if ( rec$username !in ntlm_tracker )\n        ntlm_tracker[rec$username] = set();\n    add ntlm_tracker[rec$username][rec$id$resp_h];\n    if ( |ntlm_tracker[rec$username]| >= spray_threshold )\n        NOTICE([$note=NTLM_Account_Spray,\n                $msg=fmt(\"NTLM account spray: %s -> %d hosts\", rec$username, |ntlm_tracker[rec$username]|),\n                $sub=rec$username,\n                $conn=rec$id]);\n}\n```\n\n### Step 6: Run the Automated Analysis Agent\n\nUse the provided agent.py for comprehensive lateral movement detection:\n\n```bash\npython3 agent.py \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002F\npython3 agent.py \u002Fopt\u002Fzeek\u002Flogs\u002F2026-03-18\u002F  # Analyze a specific date\n```\n\n## Verification\n\n- Confirm conn.log captures internal SMB (port 445) and DCE\u002FRPC (port 135) connections with correct field parsing\n- Verify smb_mapping.log correctly logs admin share paths (C$, ADMIN$, IPC$)\n- Test with a known PsExec execution in a lab: expect to see SMB FILE_WRITE of the service binary followed by DCE\u002FRPC svcctl CreateService\n- Validate NTLM log parsing by performing a test authentication and confirming username, domain, and success fields are captured; verify the NTLM Account Spray Zeek script generates a `notice.log` entry when the spray threshold is exceeded\n- Cross-reference Zeek alerts with Sysmon Event ID 1 (Process Creation) on the target host to confirm end-to-end detection\n- Verify the agent correctly handles both TSV and JSON Zeek log formats\n",{"name":5,"tags":44,"author":47,"domain":31,"license":15,"version":48,"subdomain":35,"description":49},[45,46,34,33,32,36],"zeek","lateral-movement","mahipal","1.0","Detect lateral movement in network traffic using Zeek (formerly Bro) log analysis. Parses conn.log, smb_mapping.log, smb_files.log, dce_rpc.log, kerberos.log, and ntlm.log to identify SMB file transfers, NTLM account spray activity, remote service execution, and anomalous internal connections.\n","main","4d2fb89cdfb75f3f6fd3c6c5ec9ad90ea129eb3c","ai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fdetecting-lateral-movement-with-zeek",2,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai","https:\u002F\u002Fgithub.com\u002Fluokai0","a solo builder.","2026-05-06 04:29:04",{"source":8,"skillName":5,"commands":59,"prompt":69,"zipAvailable":70},[60,63,66],{"tool":61,"command":62},"npx","npx skills add luokai0\u002Fai-agent-skills-by-luo-kai --skill detecting-lateral-movement-with-zeek",{"tool":64,"command":65},"bunx","bunx skills add luokai0\u002Fai-agent-skills-by-luo-kai --skill detecting-lateral-movement-with-zeek",{"tool":67,"command":68},"pnpm","pnpm dlx skills add luokai0\u002Fai-agent-skills-by-luo-kai --skill detecting-lateral-movement-with-zeek","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fdetecting-lateral-movement-with-zeek\u002FSKILL.md",true,[72,78,83,89,93,97,103],{"path":73,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":76,"sourceHtmlUrl":77},"assets\u002Ftemplate.md","ASSET","资产文件",4437,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fdetecting-lateral-movement-with-zeek\u002Fassets\u002Ftemplate.md",{"path":79,"resourceType":79,"resourceTypeDesc":80,"sizeBytes":81,"sourceHtmlUrl":82},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fdetecting-lateral-movement-with-zeek\u002FLICENSE",{"path":84,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":87,"sourceHtmlUrl":88},"references\u002Fapi-reference.md","REFERENCE","参考文档",4465,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fdetecting-lateral-movement-with-zeek\u002Freferences\u002Fapi-reference.md",{"path":90,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":91,"sourceHtmlUrl":92},"references\u002Fstandards.md",818,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fdetecting-lateral-movement-with-zeek\u002Freferences\u002Fstandards.md",{"path":94,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":95,"sourceHtmlUrl":96},"references\u002Fworkflows.md",4831,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fdetecting-lateral-movement-with-zeek\u002Freferences\u002Fworkflows.md",{"path":98,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"scripts\u002Fagent.py","SCRIPT","脚本",19431,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fdetecting-lateral-movement-with-zeek\u002Fscripts\u002Fagent.py",{"path":104,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":105,"sourceHtmlUrl":106},"scripts\u002Fprocess.py",5682,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fdetecting-lateral-movement-with-zeek\u002Fscripts\u002Fprocess.py",[108,136,153,183,215,252],{"skillNo":109,"name":110,"nameZh":6,"description":111,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":112,"licenseFileUrl":6,"sourceHtmlUrl":113,"categories":114,"keywords":115,"publishedAt":39},"01M6F2SKTE208174C7S7JJCZC7","write-contracts","Generates secure Aptos Move V2 smart contracts with Object model, Digital Asset integration, security patterns, and storage type guidance. Includes comprehensive storage decision framework for optimal data structure selection. Triggers on: 'write contract', 'create NFT collection', 'build marketplace', 'implement minting', 'generate Move module', 'create token contract', 'build DAO', 'implement staking'. Ask storage questions when: 'store', 'track', 'registry', 'mapping', 'list', 'collection'.","MIT","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fwrite-contracts\u002FSKILL.md",[],[116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135],"write","contracts","write contracts","storage","secure","create","generate","collection","model","decision","ask","smart-contracts","selection","objects","structure","nft","token","aptos","critical","move",{"skillNo":137,"name":138,"nameZh":6,"description":139,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":112,"licenseFileUrl":6,"sourceHtmlUrl":140,"categories":141,"keywords":142,"publishedAt":39},"01M6F2RFXJ6T9MKW0A7N7GM45B","web-search","通用网络搜索技能，支持多引擎搜索（百度、必应、DuckDuckGo），无需API密钥即可获取实时信息","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fweb-search-ex-skill\u002FSKILL.md",[],[143,144,145,146,147,148,149,150,151,152],"web","search","web search","搜索","baidu","bing","duckduckgo","百度","多引擎","internet",{"skillNo":154,"name":155,"nameZh":6,"description":156,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":112,"licenseFileUrl":6,"sourceHtmlUrl":157,"categories":158,"keywords":164,"publishedAt":39},"01M6F2K968G1FZEZFPW2E6B222","solo-build","Execute implementation plan tasks with TDD workflow, auto-commit, and phase gates. Use when user says \"build it\", \"start building\", \"execute plan\", \"implement tasks\", \"ship it\", or references a track ID. Do NOT use for planning (use \u002Fplan) or scaffolding (use \u002Fscaffold).","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fsolo-build\u002FSKILL.md",[159],{"categoryNo":160,"categoryName":161,"taxonomyType":162,"taxonomyTypeDesc":163},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[165,166,167,168,169,170,171,172,144,173,174,175,116,176,177,178,179,180,181,182],"build","solo","solo build","MCP","workflow","commit","tasks","code","Bash","plan","read","auto","references","context7","query","scaffolding","ship it","project",{"skillNo":184,"name":185,"nameZh":6,"description":186,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":112,"licenseFileUrl":6,"sourceHtmlUrl":187,"categories":188,"keywords":195,"publishedAt":39},"01M6F2GKN39SGHSPWYB3662YC8","react-email","Use when building HTML email templates with React components, adding a visual email editor to an application using the React Email visual editor, rendering emails to HTML, or sending emails with Resend. Covers welcome emails, password resets, notifications, order confirmations, newsletters, transactional emails, and the embeddable email editor component.","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Freact-email-skills\u002FSKILL.md",[189,192],{"categoryNo":190,"categoryName":191,"taxonomyType":162,"taxonomyTypeDesc":163},"01JBSEEDCAT000000000000005","邮件与沟通",{"categoryNo":193,"categoryName":194,"taxonomyType":162,"taxonomyTypeDesc":163},"01JBSEEDCAT000000000000009","前端开发",[196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,20],"react","email","react email","github","editor","components","react components","component","welcome","https","notifications","password","node","use","html","resend","visual","emails","rendering",{"skillNo":216,"name":217,"nameZh":6,"description":218,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":112,"licenseFileUrl":6,"sourceHtmlUrl":219,"categories":220,"keywords":233,"publishedAt":39},"01M6F2FBVGVDFSG8SSFJGXA40C","APITester Agent-Driven API Testing","Test API endpoints and document responses. Define tests in plain English, run them, get formatted results. Agent-driven Postman alternative.","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fopenclaw-api-tester\u002FSKILL.md",[221,224,227,228],{"categoryNo":222,"categoryName":223,"taxonomyType":162,"taxonomyTypeDesc":163},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":225,"categoryName":226,"taxonomyType":162,"taxonomyTypeDesc":163},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":160,"categoryName":161,"taxonomyType":162,"taxonomyTypeDesc":163},{"categoryNo":229,"categoryName":230,"taxonomyType":231,"taxonomyTypeDesc":232},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251],"testing","api","api testing","driven","APITester Agent Driven API Testing","test","run","postman","results","plain english","tester","endpoints","document","get","define","tests","english","api-tester",{"skillNo":253,"name":254,"nameZh":6,"description":255,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":112,"licenseFileUrl":6,"sourceHtmlUrl":256,"categories":257,"keywords":258,"publishedAt":39},"01M6F273Y3NGAPVJZ608BC0G9G","hubspot-implementation-plan","Generate a phased implementation plan from a HubSpot audit report. Creates prioritized, sequenced cleanup processes with effort estimates, dependencies, and automation feasibility. Use after running \u002Fhubspot-audit.","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fhubspot-implementation-plan\u002FSKILL.md",[],[174,259,260,261,262,263,264,122,265,266,267,268,269,209,270,271,20,272],"implementation","hubspot","hubspot implementation plan","automation","feasibility","cleanup","planning","report","audit","audit report","phased implementation","dependencies","processes","hubspot audit"]