[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6EVEVC0HAJAFGPK6EGQF334":3,"skill-same:01M6EVEVC0HAJAFGPK6EGQF334":107},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":50,"commitSha":51,"skillDirectory":52,"forksCount":53,"repositoryHtmlUrl":54,"repositoryHomepageUrl":6,"ownerHtmlUrl":55,"ownerBlogUrl":6,"ownerDescription":56,"updatedAt":57,"install":58,"resources":71},"01M6EVEVC0HAJAFGPK6EGQF334","hunting-for-dns-tunneling-with-zeek",null,"Detect DNS tunneling and data exfiltration by analyzing Zeek dns.log for high-entropy subdomain queries, excessive query volume, long query lengths, and unusual DNS record types indicating covert channel communication.","luokai0\u002Fai-agent-skills-by-luo-kai","luokai0","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F266954973?v=4","01M6E16VNT42JB8B3X3254QWJ7","luo kai","01M6E16VTFVP6S5XJF1V1MPV90",14,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fhunting-for-dns-tunneling-with-zeek\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"hunting","dns","with","Zeek","tunneling","hunting for dns tunneling with zeek","mitre-t1071-004","types","long","volume","query","queries","log","cybersecurity","covert-channel","entropy","network-monitoring","dns-tunneling","exfiltration","monitoring","2026-11-10 10:12:30",false,"---\nname: hunting-for-dns-tunneling-with-zeek\ndescription: Detect DNS tunneling and data exfiltration by analyzing Zeek dns.log for high-entropy subdomain queries, excessive query volume, long query lengths, and unusual DNS record types indicating covert channel communication.\ndomain: cybersecurity\nsubdomain: threat-hunting\ntags: [threat-hunting, dns-tunneling, zeek, data-exfiltration, covert-channel, mitre-t1071-004, network-monitoring]\nversion: \"1.0\"\nauthor: mahipal\nlicense: Apache-2.0\n---\n\n# Hunting for DNS Tunneling with Zeek\n\n## When to Use\n\n- When hunting for data exfiltration over DNS covert channels\n- After threat intelligence indicates DNS-based C2 frameworks targeting your industry\n- When dns.log shows unusually high query volumes to specific domains\n- During investigation of suspected data theft where no HTTP\u002FS exfiltration is found\n- When monitoring for tools like iodine, dnscat2, DNSExfiltrator, or DNS-over-HTTPS tunneling\n\n## Prerequisites\n\n- Zeek deployed on network tap or SPAN port capturing DNS traffic\n- Zeek dns.log with full query and response fields\n- SIEM platform for dns.log analysis (Splunk, Elastic)\n- RITA (Real Intelligence Threat Analytics) for automated DNS analysis\n- Passive DNS data for historical domain resolution context\n\n## Workflow\n\n1. **Analyze Query Length Distribution**: DNS tunneling encodes data in subdomain labels, producing queries significantly longer than normal. Normal DNS queries average 20-30 characters; tunneling queries often exceed 50+ characters. Calculate mean and standard deviation of query lengths per domain.\n2. **Calculate Subdomain Entropy**: Tunneling encodes data using Base32\u002FBase64, producing high-entropy subdomain strings. Calculate Shannon entropy of subdomain labels -- values above 3.5 bits\u002Fcharacter strongly suggest encoded data.\n3. **Count Unique Subdomains Per Domain**: Legitimate domains have relatively few unique subdomains. DNS tunneling generates hundreds or thousands of unique subdomains under a single parent domain.\n4. **Monitor DNS Record Type Distribution**: TXT, NULL, CNAME, and MX records can carry more data than A records. Excessive TXT queries to a single domain indicate data transfer via DNS.\n5. **Detect High Query Volume**: Flag domains receiving more than 100 queries per hour from a single source, especially when combined with high subdomain uniqueness.\n6. **Analyze Query Timing**: DNS tunneling tools produce regular query patterns (beaconing) or burst patterns (data transfer). Apply frequency analysis to DNS query timestamps.\n7. **Cross-Reference with conn.log**: Correlate DNS queries with connection metadata to identify the process or endpoint generating suspicious queries.\n8. **Validate with Domain Intelligence**: Check suspicious domains against WHOIS data, certificate transparency, and threat intelligence feeds.\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| T1071.004 | Application Layer Protocol: DNS |\n| T1048.003 | Exfiltration Over Alternative Protocol: DNS |\n| T1572 | Protocol Tunneling |\n| Shannon Entropy | Measure of randomness in subdomain strings |\n| Zeek dns.log | DNS query\u002Fresponse metadata |\n| RITA | Automated DNS tunneling detection from Zeek logs |\n| iodine | IPv4-over-DNS tunneling tool |\n| dnscat2 | DNS-based command-and-control tool |\n| DNSExfiltrator | Data exfiltration tool using DNS requests |\n\n## Detection Queries\n\n### Zeek Script -- DNS Tunnel Detection\n```zeek\n@load base\u002Fprotocols\u002Fdns\nmodule DNSTunnel;\n\nexport {\n    redef enum Notice::Type += { DNSTunnel::Long_DNS_Query };\n    const query_length_threshold = 50 &redef;\n    const query_count_threshold = 100 &redef;\n}\n\nevent dns_request(c: connection, msg: dns_msg, query: string, qtype: count, qclass: count) {\n    if ( |query| > query_length_threshold ) {\n        NOTICE([$note=DNSTunnel::Long_DNS_Query,\n                $msg=fmt(\"Long DNS query detected: %s (%d chars)\", query, |query|),\n                $conn=c]);\n    }\n}\n```\n\n### Splunk -- DNS Tunneling Indicators from Zeek\n```spl\nindex=zeek sourcetype=bro_dns\n| rex field=query \"(?\u003Csubdomain>[^.]+)\\.(?\u003Cbasedomain>[^.]+\\.[^.]+)$\"\n| stats count dc(subdomain) as unique_subs avg(len(query)) as avg_len max(len(query)) as max_len by src basedomain\n| where count > 100 AND (unique_subs > 50 OR avg_len > 40)\n| sort -unique_subs\n```\n\n### Splunk -- High Entropy Subdomain Detection\n```spl\nindex=zeek sourcetype=bro_dns\n| rex field=query \"^(?\u003Csubdomain>[^.]+)\"\n| where len(subdomain) > 20\n| eval char_count=len(subdomain)\n| stats count dc(query) as unique_queries avg(char_count) as avg_sub_len by src query_type_name basedomain\n| where unique_queries > 30 AND avg_sub_len > 25\n| sort -unique_queries\n```\n\n### RITA Analysis\n```bash\nrita import \u002Fpath\u002Fto\u002Fzeek\u002Flogs dataset_name\nrita show-dns-fqdn-ips-long dataset_name\nrita show-exploded-dns dataset_name\nrita show-dns-tunneling dataset_name --csv > dns_tunnel_results.csv\n```\n\n## Common Scenarios\n\n1. **dnscat2 C2**: Encodes command-and-control traffic in DNS CNAME\u002FTXT queries with Base64-encoded subdomain labels. Produces high query volumes with long, high-entropy subdomains.\n2. **iodine IPv4 Tunnel**: Creates a virtual network interface tunneling all IP traffic through DNS. Generates massive DNS query volumes with NULL record types.\n3. **Data Exfiltration via DNS**: Sensitive data encoded in subdomain labels (e.g., `aGVsbG8gd29ybGQ.exfil.attacker.com`), sent as A or TXT queries. Each query carries ~63 bytes of data.\n4. **DNS-over-HTTPS Tunneling**: Bypasses traditional DNS monitoring by sending DNS queries over HTTPS to public resolvers (8.8.8.8, 1.1.1.1), requiring TLS inspection for detection.\n5. **Cobalt Strike DNS Beacon**: Uses DNS A\u002FTXT records for C2 communication with configurable subdomain encoding schemes.\n\n## Output Format\n\n```\nHunt ID: TH-DNSTUNNEL-[DATE]-[SEQ]\nSource IP: [Internal IP]\nSource Host: [Hostname]\nTarget Domain: [Base domain]\nQuery Count: [Total queries in window]\nUnique Subdomains: [Count]\nAvg Query Length: [Characters]\nMax Query Length: [Characters]\nSubdomain Entropy: [Bits per character]\nPrimary Record Type: [A\u002FTXT\u002FCNAME\u002FNULL]\nData Volume Estimate: [Bytes exfiltrated]\nRisk Level: [Critical\u002FHigh\u002FMedium\u002FLow]\n```\n","# Hunting for DNS Tunneling with Zeek\n\n## When to Use\n\n- When hunting for data exfiltration over DNS covert channels\n- After threat intelligence indicates DNS-based C2 frameworks targeting your industry\n- When dns.log shows unusually high query volumes to specific domains\n- During investigation of suspected data theft where no HTTP\u002FS exfiltration is found\n- When monitoring for tools like iodine, dnscat2, DNSExfiltrator, or DNS-over-HTTPS tunneling\n\n## Prerequisites\n\n- Zeek deployed on network tap or SPAN port capturing DNS traffic\n- Zeek dns.log with full query and response fields\n- SIEM platform for dns.log analysis (Splunk, Elastic)\n- RITA (Real Intelligence Threat Analytics) for automated DNS analysis\n- Passive DNS data for historical domain resolution context\n\n## Workflow\n\n1. **Analyze Query Length Distribution**: DNS tunneling encodes data in subdomain labels, producing queries significantly longer than normal. Normal DNS queries average 20-30 characters; tunneling queries often exceed 50+ characters. Calculate mean and standard deviation of query lengths per domain.\n2. **Calculate Subdomain Entropy**: Tunneling encodes data using Base32\u002FBase64, producing high-entropy subdomain strings. Calculate Shannon entropy of subdomain labels -- values above 3.5 bits\u002Fcharacter strongly suggest encoded data.\n3. **Count Unique Subdomains Per Domain**: Legitimate domains have relatively few unique subdomains. DNS tunneling generates hundreds or thousands of unique subdomains under a single parent domain.\n4. **Monitor DNS Record Type Distribution**: TXT, NULL, CNAME, and MX records can carry more data than A records. Excessive TXT queries to a single domain indicate data transfer via DNS.\n5. **Detect High Query Volume**: Flag domains receiving more than 100 queries per hour from a single source, especially when combined with high subdomain uniqueness.\n6. **Analyze Query Timing**: DNS tunneling tools produce regular query patterns (beaconing) or burst patterns (data transfer). Apply frequency analysis to DNS query timestamps.\n7. **Cross-Reference with conn.log**: Correlate DNS queries with connection metadata to identify the process or endpoint generating suspicious queries.\n8. **Validate with Domain Intelligence**: Check suspicious domains against WHOIS data, certificate transparency, and threat intelligence feeds.\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| T1071.004 | Application Layer Protocol: DNS |\n| T1048.003 | Exfiltration Over Alternative Protocol: DNS |\n| T1572 | Protocol Tunneling |\n| Shannon Entropy | Measure of randomness in subdomain strings |\n| Zeek dns.log | DNS query\u002Fresponse metadata |\n| RITA | Automated DNS tunneling detection from Zeek logs |\n| iodine | IPv4-over-DNS tunneling tool |\n| dnscat2 | DNS-based command-and-control tool |\n| DNSExfiltrator | Data exfiltration tool using DNS requests |\n\n## Detection Queries\n\n### Zeek Script -- DNS Tunnel Detection\n```zeek\n@load base\u002Fprotocols\u002Fdns\nmodule DNSTunnel;\n\nexport {\n    redef enum Notice::Type += { DNSTunnel::Long_DNS_Query };\n    const query_length_threshold = 50 &redef;\n    const query_count_threshold = 100 &redef;\n}\n\nevent dns_request(c: connection, msg: dns_msg, query: string, qtype: count, qclass: count) {\n    if ( |query| > query_length_threshold ) {\n        NOTICE([$note=DNSTunnel::Long_DNS_Query,\n                $msg=fmt(\"Long DNS query detected: %s (%d chars)\", query, |query|),\n                $conn=c]);\n    }\n}\n```\n\n### Splunk -- DNS Tunneling Indicators from Zeek\n```spl\nindex=zeek sourcetype=bro_dns\n| rex field=query \"(?\u003Csubdomain>[^.]+)\\.(?\u003Cbasedomain>[^.]+\\.[^.]+)$\"\n| stats count dc(subdomain) as unique_subs avg(len(query)) as avg_len max(len(query)) as max_len by src basedomain\n| where count > 100 AND (unique_subs > 50 OR avg_len > 40)\n| sort -unique_subs\n```\n\n### Splunk -- High Entropy Subdomain Detection\n```spl\nindex=zeek sourcetype=bro_dns\n| rex field=query \"^(?\u003Csubdomain>[^.]+)\"\n| where len(subdomain) > 20\n| eval char_count=len(subdomain)\n| stats count dc(query) as unique_queries avg(char_count) as avg_sub_len by src query_type_name basedomain\n| where unique_queries > 30 AND avg_sub_len > 25\n| sort -unique_queries\n```\n\n### RITA Analysis\n```bash\nrita import \u002Fpath\u002Fto\u002Fzeek\u002Flogs dataset_name\nrita show-dns-fqdn-ips-long dataset_name\nrita show-exploded-dns dataset_name\nrita show-dns-tunneling dataset_name --csv > dns_tunnel_results.csv\n```\n\n## Common Scenarios\n\n1. **dnscat2 C2**: Encodes command-and-control traffic in DNS CNAME\u002FTXT queries with Base64-encoded subdomain labels. Produces high query volumes with long, high-entropy subdomains.\n2. **iodine IPv4 Tunnel**: Creates a virtual network interface tunneling all IP traffic through DNS. Generates massive DNS query volumes with NULL record types.\n3. **Data Exfiltration via DNS**: Sensitive data encoded in subdomain labels (e.g., `aGVsbG8gd29ybGQ.exfil.attacker.com`), sent as A or TXT queries. Each query carries ~63 bytes of data.\n4. **DNS-over-HTTPS Tunneling**: Bypasses traditional DNS monitoring by sending DNS queries over HTTPS to public resolvers (8.8.8.8, 1.1.1.1), requiring TLS inspection for detection.\n5. **Cobalt Strike DNS Beacon**: Uses DNS A\u002FTXT records for C2 communication with configurable subdomain encoding schemes.\n\n## Output Format\n\n```\nHunt ID: TH-DNSTUNNEL-[DATE]-[SEQ]\nSource IP: [Internal IP]\nSource Host: [Hostname]\nTarget Domain: [Base domain]\nQuery Count: [Total queries in window]\nUnique Subdomains: [Count]\nAvg Query Length: [Characters]\nMax Query Length: [Characters]\nSubdomain Entropy: [Bits per character]\nPrimary Record Type: [A\u002FTXT\u002FCNAME\u002FNULL]\nData Volume Estimate: [Bytes exfiltrated]\nRisk Level: [Critical\u002FHigh\u002FMedium\u002FLow]\n```\n",{"name":5,"tags":44,"author":48,"domain":32,"license":15,"version":49,"subdomain":45,"description":7},[45,36,46,47,33,25,35],"threat-hunting","zeek","data-exfiltration","mahipal","1.0","main","4d2fb89cdfb75f3f6fd3c6c5ec9ad90ea129eb3c","ai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fhunting-for-dns-tunneling-with-zeek",1,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai","https:\u002F\u002Fgithub.com\u002Fluokai0","a solo builder.","2026-05-06 04:29:04",{"source":8,"skillName":5,"commands":59,"prompt":69,"zipAvailable":70},[60,63,66],{"tool":61,"command":62},"npx","npx skills add luokai0\u002Fai-agent-skills-by-luo-kai --skill hunting-for-dns-tunneling-with-zeek",{"tool":64,"command":65},"bunx","bunx skills add luokai0\u002Fai-agent-skills-by-luo-kai --skill hunting-for-dns-tunneling-with-zeek",{"tool":67,"command":68},"pnpm","pnpm dlx skills add luokai0\u002Fai-agent-skills-by-luo-kai --skill hunting-for-dns-tunneling-with-zeek","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fhunting-for-dns-tunneling-with-zeek\u002FSKILL.md",true,[72,78,83,89,93,97,103],{"path":73,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":76,"sourceHtmlUrl":77},"assets\u002Ftemplate.md","ASSET","资产文件",1046,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fhunting-for-dns-tunneling-with-zeek\u002Fassets\u002Ftemplate.md",{"path":79,"resourceType":79,"resourceTypeDesc":80,"sizeBytes":81,"sourceHtmlUrl":82},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fhunting-for-dns-tunneling-with-zeek\u002FLICENSE",{"path":84,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":87,"sourceHtmlUrl":88},"references\u002Fapi-reference.md","REFERENCE","参考文档",1567,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fhunting-for-dns-tunneling-with-zeek\u002Freferences\u002Fapi-reference.md",{"path":90,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":91,"sourceHtmlUrl":92},"references\u002Fstandards.md",2256,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fhunting-for-dns-tunneling-with-zeek\u002Freferences\u002Fstandards.md",{"path":94,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":95,"sourceHtmlUrl":96},"references\u002Fworkflows.md",2508,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fhunting-for-dns-tunneling-with-zeek\u002Freferences\u002Fworkflows.md",{"path":98,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"scripts\u002Fagent.py","SCRIPT","脚本",5605,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fhunting-for-dns-tunneling-with-zeek\u002Fscripts\u002Fagent.py",{"path":104,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":105,"sourceHtmlUrl":106},"scripts\u002Fprocess.py",6010,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fhunting-for-dns-tunneling-with-zeek\u002Fscripts\u002Fprocess.py",[108,136,153,182,214,251],{"skillNo":109,"name":110,"nameZh":6,"description":111,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":112,"licenseFileUrl":6,"sourceHtmlUrl":113,"categories":114,"keywords":115,"publishedAt":39},"01M6F2SKTE208174C7S7JJCZC7","write-contracts","Generates secure Aptos Move V2 smart contracts with Object model, Digital Asset integration, security patterns, and storage type guidance. Includes comprehensive storage decision framework for optimal data structure selection. Triggers on: 'write contract', 'create NFT collection', 'build marketplace', 'implement minting', 'generate Move module', 'create token contract', 'build DAO', 'implement staking'. Ask storage questions when: 'store', 'track', 'registry', 'mapping', 'list', 'collection'.","MIT","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fwrite-contracts\u002FSKILL.md",[],[116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135],"write","contracts","write contracts","storage","secure","create","generate","collection","model","decision","ask","smart-contracts","selection","objects","structure","nft","token","aptos","critical","move",{"skillNo":137,"name":138,"nameZh":6,"description":139,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":112,"licenseFileUrl":6,"sourceHtmlUrl":140,"categories":141,"keywords":142,"publishedAt":39},"01M6F2RFXJ6T9MKW0A7N7GM45B","web-search","通用网络搜索技能，支持多引擎搜索（百度、必应、DuckDuckGo），无需API密钥即可获取实时信息","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fweb-search-ex-skill\u002FSKILL.md",[],[143,144,145,146,147,148,149,150,151,152],"web","search","web search","搜索","baidu","bing","duckduckgo","百度","多引擎","internet",{"skillNo":154,"name":155,"nameZh":6,"description":156,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":112,"licenseFileUrl":6,"sourceHtmlUrl":157,"categories":158,"keywords":164,"publishedAt":39},"01M6F2K968G1FZEZFPW2E6B222","solo-build","Execute implementation plan tasks with TDD workflow, auto-commit, and phase gates. Use when user says \"build it\", \"start building\", \"execute plan\", \"implement tasks\", \"ship it\", or references a track ID. Do NOT use for planning (use \u002Fplan) or scaffolding (use \u002Fscaffold).","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fsolo-build\u002FSKILL.md",[159],{"categoryNo":160,"categoryName":161,"taxonomyType":162,"taxonomyTypeDesc":163},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[165,166,167,168,169,170,171,172,144,173,174,175,116,176,177,178,29,179,180,181],"build","solo","solo build","MCP","workflow","commit","tasks","code","Bash","plan","read","auto","references","context7","scaffolding","ship it","project",{"skillNo":183,"name":184,"nameZh":6,"description":185,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":112,"licenseFileUrl":6,"sourceHtmlUrl":186,"categories":187,"keywords":194,"publishedAt":39},"01M6F2GKN39SGHSPWYB3662YC8","react-email","Use when building HTML email templates with React components, adding a visual email editor to an application using the React Email visual editor, rendering emails to HTML, or sending emails with Resend. Covers welcome emails, password resets, notifications, order confirmations, newsletters, transactional emails, and the embeddable email editor component.","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Freact-email-skills\u002FSKILL.md",[188,191],{"categoryNo":189,"categoryName":190,"taxonomyType":162,"taxonomyTypeDesc":163},"01JBSEEDCAT000000000000005","邮件与沟通",{"categoryNo":192,"categoryName":193,"taxonomyType":162,"taxonomyTypeDesc":163},"01JBSEEDCAT000000000000009","前端开发",[195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,21],"react","email","react email","github","editor","components","react components","component","welcome","https","notifications","password","node","use","html","resend","visual","emails","rendering",{"skillNo":215,"name":216,"nameZh":6,"description":217,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":112,"licenseFileUrl":6,"sourceHtmlUrl":218,"categories":219,"keywords":232,"publishedAt":39},"01M6F2FBVGVDFSG8SSFJGXA40C","APITester Agent-Driven API Testing","Test API endpoints and document responses. Define tests in plain English, run them, get formatted results. Agent-driven Postman alternative.","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fopenclaw-api-tester\u002FSKILL.md",[220,223,226,227],{"categoryNo":221,"categoryName":222,"taxonomyType":162,"taxonomyTypeDesc":163},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":224,"categoryName":225,"taxonomyType":162,"taxonomyTypeDesc":163},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":160,"categoryName":161,"taxonomyType":162,"taxonomyTypeDesc":163},{"categoryNo":228,"categoryName":229,"taxonomyType":230,"taxonomyTypeDesc":231},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250],"testing","api","api testing","driven","APITester Agent Driven API Testing","test","run","postman","results","plain english","tester","endpoints","document","get","define","tests","english","api-tester",{"skillNo":252,"name":253,"nameZh":6,"description":254,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":112,"licenseFileUrl":6,"sourceHtmlUrl":255,"categories":256,"keywords":257,"publishedAt":39},"01M6F273Y3NGAPVJZ608BC0G9G","hubspot-implementation-plan","Generate a phased implementation plan from a HubSpot audit report. Creates prioritized, sequenced cleanup processes with effort estimates, dependencies, and automation feasibility. Use after running \u002Fhubspot-audit.","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fhubspot-implementation-plan\u002FSKILL.md",[],[174,258,259,260,261,262,263,122,264,265,266,267,268,208,269,270,21,271],"implementation","hubspot","hubspot implementation plan","automation","feasibility","cleanup","planning","report","audit","audit report","phased implementation","dependencies","processes","hubspot audit"]