[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6EVQN8P2DFKVSEYP0H61GF4":3,"skill-same:01M6EVQN8P2DFKVSEYP0H61GF4":111},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":63,"commitSha":64,"skillDirectory":65,"forksCount":14,"repositoryHtmlUrl":66,"repositoryHomepageUrl":67,"ownerHtmlUrl":68,"ownerBlogUrl":6,"ownerDescription":69,"updatedAt":70,"install":71,"resources":84},"01M6EVQN8P2DFKVSEYP0H61GF4","performing-cloud-native-threat-hunting-with-aws-detective",null,"Hunt for threats in AWS environments using Detective behavior graphs, entity investigation timelines, GuardDuty finding correlation, and automated entity profiling across IAM users, EC2 instances, and IP addresses.","henriquescastilho\u002Fmy-claude","henriquescastilho","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153296945?v=4","01M6ESH7EXPXTH9CVQ4K16SRG8","Henrique Scheer","01M6ESH7JHEK2PTNNH4HEH787Z",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-cloud-native-threat-hunting-with-aws-detective\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"threat","hunting","with","native","performing cloud native threat hunting with aws detective","aws","cloud","cloud native","threat hunting","iam","guardduty","t1078","incident-investigation","cybersecurity","cm","instances","incident","across","ip","de","2026-11-10 10:12:30",false,"---\nname: performing-cloud-native-threat-hunting-with-aws-detective\ndescription: Hunt for threats in AWS environments using Detective behavior graphs,\n  entity investigation timelines, GuardDuty finding correlation, and automated entity\n  profiling across IAM users, EC2 instances, and IP addresses.\ndomain: cybersecurity\nsubdomain: cloud-security\ntags:\n- aws-detective\n- threat-hunting\n- cloud-security\n- guardduty\n- behavior-graph\n- aws\n- iam\n- ec2\n- incident-investigation\nversion: '1.0'\nauthor: juliosuas\nlicense: Apache-2.0\nnist_csf:\n- PR.IR-01\n- ID.AM-08\n- GV.SC-06\n- DE.CM-01\nmitre_attack:\n- T1078.004\n- T1530\n- T1537\n- T1580\n- T1071\n---\n\n# Performing Cloud-Native Threat Hunting with AWS Detective\n\n## Overview\n\nAWS Detective automatically collects and analyzes log data from AWS CloudTrail, VPC Flow Logs, GuardDuty findings, and EKS audit logs to build interactive behavior graphs. These graphs enable security analysts to investigate entities (IAM users, roles, IP addresses, EC2 instances) across time, identify anomalous API calls, detect lateral movement between accounts, and correlate GuardDuty findings into coherent attack narratives — all without manual log parsing.\n\n## Prerequisites\n\n- AWS account with Detective enabled (requires GuardDuty active for 48+ hours)\n- AWS CLI v2 configured with appropriate IAM permissions (`detective:*`, `guardduty:List*`)\n- Python 3.9+ with boto3\n- IAM policy: `AmazonDetectiveFullAccess` or custom policy with `detective:SearchGraph`, `detective:GetInvestigation`, `detective:ListIndicators`\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| **Behavior Graph** | Data structure linking CloudTrail, VPC Flow, GuardDuty, and EKS logs for an account\u002Fregion |\n| **Entity** | Investigable object: IAM user, IAM role, EC2 instance, IP address, S3 bucket, EKS cluster |\n| **Finding Group** | Correlated set of GuardDuty findings linked to the same attack campaign |\n| **Entity Profile** | Timeline of API calls, network connections, and resource access for a specific entity |\n| **Scope Time** | Investigation window (default 24h, max 1 year) for behavioral analysis |\n\n## Steps\n\n### Step 1: List Available Behavior Graphs\n\n```bash\naws detective list-graphs --output table\n```\n\n### Step 2: Investigate a Suspicious IAM User\n\n```bash\n# Get entity profile for an IAM user\naws detective get-investigation \\\n  --graph-arn arn:aws:detective:us-east-1:123456789012:graph:a1b2c3d4 \\\n  --investigation-id 000000000000000000001\n```\n\n### Step 3: Search Entities Programmatically\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Search AWS Detective for suspicious entities.\"\"\"\nimport boto3\nimport json\nfrom datetime import datetime, timedelta\n\ndetective = boto3.client('detective')\n\ndef list_behavior_graphs():\n    \"\"\"List all Detective behavior graphs.\"\"\"\n    response = detective.list_graphs()\n    return response.get('GraphList', [])\n\ndef get_investigation_indicators(graph_arn, investigation_id, max_results=50):\n    \"\"\"Get indicators for a specific investigation.\"\"\"\n    response = detective.list_indicators(\n        GraphArn=graph_arn,\n        InvestigationId=investigation_id,\n        MaxResults=max_results\n    )\n    return response.get('Indicators', [])\n\ndef investigate_guardduty_findings(graph_arn):\n    \"\"\"List high-severity investigations correlated by Detective.\"\"\"\n    response = detective.list_investigations(\n        GraphArn=graph_arn,\n        FilterCriteria={\n            'Severity': {'Value': 'CRITICAL'},\n            'Status': {'Value': 'RUNNING'}\n        },\n        MaxResults=20\n    )\n\n    for investigation in response.get('InvestigationDetails', []):\n        print(f\"Investigation: {investigation['InvestigationId']}\")\n        print(f\"  Entity: {investigation['EntityArn']}\")\n        print(f\"  Status: {investigation['Status']}\")\n        print(f\"  Severity: {investigation['Severity']}\")\n        print(f\"  Created: {investigation['CreatedTime']}\")\n        print()\n\nif __name__ == \"__main__\":\n    graphs = list_behavior_graphs()\n    for graph in graphs:\n        print(f\"Graph: {graph['Arn']}\")\n        investigate_guardduty_findings(graph['Arn'])\n```\n\n### Step 4: Analyze Finding Groups for Attack Campaigns\n\n```bash\n# List investigations with high severity\naws detective list-investigations \\\n  --graph-arn arn:aws:detective:us-east-1:123456789012:graph:a1b2c3d4 \\\n  --filter-criteria '{\"Severity\":{\"Value\":\"HIGH\"}}' \\\n  --max-results 10\n```\n\n### Step 5: Check Entity Indicators\n\n```bash\n# Get indicators for a specific investigation\naws detective list-indicators \\\n  --graph-arn arn:aws:detective:us-east-1:123456789012:graph:a1b2c3d4 \\\n  --investigation-id 000000000000000000001 \\\n  --max-results 50\n```\n\n## Expected Output\n\nThe `list-investigations` command returns investigation metadata:\n\n```json\n{\n  \"InvestigationDetails\": [\n    {\n      \"InvestigationId\": \"000000000000000000001\",\n      \"Severity\": \"CRITICAL\",\n      \"Status\": \"RUNNING\",\n      \"State\": \"ACTIVE\",\n      \"EntityArn\": \"arn:aws:iam::123456789012:user\u002Fsuspicious-user\",\n      \"EntityType\": \"IAM_USER\",\n      \"CreatedTime\": \"2026-03-15T14:30:00Z\"\n    }\n  ]\n}\n```\n\nIndicators are retrieved separately via `list-indicators` and include types such as `TTP_OBSERVED`, `IMPOSSIBLE_TRAVEL`, `FLAGGED_IP_ADDRESS`, `NEW_GEOLOCATION`, `NEW_ASO`, `NEW_USER_AGENT`, `RELATED_FINDING`, and `RELATED_FINDING_GROUP`.\n\n## Verification\n\n1. Confirm behavior graph has data: `aws detective list-graphs` returns non-empty list\n2. Validate investigation results contain entity timelines with API call sequences\n3. Cross-reference Detective findings with raw CloudTrail logs for accuracy\n4. Verify finding group correlations match manual investigation conclusions\n5. Confirm automated alerts trigger for HIGH\u002FCRITICAL severity investigations\n","# Performing Cloud-Native Threat Hunting with AWS Detective\n\n## Overview\n\nAWS Detective automatically collects and analyzes log data from AWS CloudTrail, VPC Flow Logs, GuardDuty findings, and EKS audit logs to build interactive behavior graphs. These graphs enable security analysts to investigate entities (IAM users, roles, IP addresses, EC2 instances) across time, identify anomalous API calls, detect lateral movement between accounts, and correlate GuardDuty findings into coherent attack narratives — all without manual log parsing.\n\n## Prerequisites\n\n- AWS account with Detective enabled (requires GuardDuty active for 48+ hours)\n- AWS CLI v2 configured with appropriate IAM permissions (`detective:*`, `guardduty:List*`)\n- Python 3.9+ with boto3\n- IAM policy: `AmazonDetectiveFullAccess` or custom policy with `detective:SearchGraph`, `detective:GetInvestigation`, `detective:ListIndicators`\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| **Behavior Graph** | Data structure linking CloudTrail, VPC Flow, GuardDuty, and EKS logs for an account\u002Fregion |\n| **Entity** | Investigable object: IAM user, IAM role, EC2 instance, IP address, S3 bucket, EKS cluster |\n| **Finding Group** | Correlated set of GuardDuty findings linked to the same attack campaign |\n| **Entity Profile** | Timeline of API calls, network connections, and resource access for a specific entity |\n| **Scope Time** | Investigation window (default 24h, max 1 year) for behavioral analysis |\n\n## Steps\n\n### Step 1: List Available Behavior Graphs\n\n```bash\naws detective list-graphs --output table\n```\n\n### Step 2: Investigate a Suspicious IAM User\n\n```bash\n# Get entity profile for an IAM user\naws detective get-investigation \\\n  --graph-arn arn:aws:detective:us-east-1:123456789012:graph:a1b2c3d4 \\\n  --investigation-id 000000000000000000001\n```\n\n### Step 3: Search Entities Programmatically\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Search AWS Detective for suspicious entities.\"\"\"\nimport boto3\nimport json\nfrom datetime import datetime, timedelta\n\ndetective = boto3.client('detective')\n\ndef list_behavior_graphs():\n    \"\"\"List all Detective behavior graphs.\"\"\"\n    response = detective.list_graphs()\n    return response.get('GraphList', [])\n\ndef get_investigation_indicators(graph_arn, investigation_id, max_results=50):\n    \"\"\"Get indicators for a specific investigation.\"\"\"\n    response = detective.list_indicators(\n        GraphArn=graph_arn,\n        InvestigationId=investigation_id,\n        MaxResults=max_results\n    )\n    return response.get('Indicators', [])\n\ndef investigate_guardduty_findings(graph_arn):\n    \"\"\"List high-severity investigations correlated by Detective.\"\"\"\n    response = detective.list_investigations(\n        GraphArn=graph_arn,\n        FilterCriteria={\n            'Severity': {'Value': 'CRITICAL'},\n            'Status': {'Value': 'RUNNING'}\n        },\n        MaxResults=20\n    )\n\n    for investigation in response.get('InvestigationDetails', []):\n        print(f\"Investigation: {investigation['InvestigationId']}\")\n        print(f\"  Entity: {investigation['EntityArn']}\")\n        print(f\"  Status: {investigation['Status']}\")\n        print(f\"  Severity: {investigation['Severity']}\")\n        print(f\"  Created: {investigation['CreatedTime']}\")\n        print()\n\nif __name__ == \"__main__\":\n    graphs = list_behavior_graphs()\n    for graph in graphs:\n        print(f\"Graph: {graph['Arn']}\")\n        investigate_guardduty_findings(graph['Arn'])\n```\n\n### Step 4: Analyze Finding Groups for Attack Campaigns\n\n```bash\n# List investigations with high severity\naws detective list-investigations \\\n  --graph-arn arn:aws:detective:us-east-1:123456789012:graph:a1b2c3d4 \\\n  --filter-criteria '{\"Severity\":{\"Value\":\"HIGH\"}}' \\\n  --max-results 10\n```\n\n### Step 5: Check Entity Indicators\n\n```bash\n# Get indicators for a specific investigation\naws detective list-indicators \\\n  --graph-arn arn:aws:detective:us-east-1:123456789012:graph:a1b2c3d4 \\\n  --investigation-id 000000000000000000001 \\\n  --max-results 50\n```\n\n## Expected Output\n\nThe `list-investigations` command returns investigation metadata:\n\n```json\n{\n  \"InvestigationDetails\": [\n    {\n      \"InvestigationId\": \"000000000000000000001\",\n      \"Severity\": \"CRITICAL\",\n      \"Status\": \"RUNNING\",\n      \"State\": \"ACTIVE\",\n      \"EntityArn\": \"arn:aws:iam::123456789012:user\u002Fsuspicious-user\",\n      \"EntityType\": \"IAM_USER\",\n      \"CreatedTime\": \"2026-03-15T14:30:00Z\"\n    }\n  ]\n}\n```\n\nIndicators are retrieved separately via `list-indicators` and include types such as `TTP_OBSERVED`, `IMPOSSIBLE_TRAVEL`, `FLAGGED_IP_ADDRESS`, `NEW_GEOLOCATION`, `NEW_ASO`, `NEW_USER_AGENT`, `RELATED_FINDING`, and `RELATED_FINDING_GROUP`.\n\n## Verification\n\n1. Confirm behavior graph has data: `aws detective list-graphs` returns non-empty list\n2. Validate investigation results contain entity timelines with API call sequences\n3. Cross-reference Detective findings with raw CloudTrail logs for accuracy\n4. Verify finding group correlations match manual investigation conclusions\n5. Confirm automated alerts trigger for HIGH\u002FCRITICAL severity investigations\n",{"name":5,"tags":44,"author":50,"domain":32,"license":15,"version":51,"nist_csf":52,"subdomain":47,"description":7,"mitre_attack":57},[45,46,47,29,48,24,28,49,31],"aws-detective","threat-hunting","cloud-security","behavior-graph","ec2","juliosuas","1.0",[53,54,55,56],"PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01",[58,59,60,61,62],"T1078.004","T1530","T1537","T1580","T1071","main","7925716f065257435fdb12e97f7e52842147d5ad",".claude\u002Fskills\u002Fperforming-cloud-native-threat-hunting-with-aws-detective","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude","https:\u002F\u002Fclaude.com\u002Fclaude-code","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho","Software · Applied AI · Quantitative Modeling · Building with Claude.","2026-06-10 12:24:46",{"source":8,"skillName":5,"commands":72,"prompt":82,"zipAvailable":83},[73,76,79],{"tool":74,"command":75},"npx","npx skills add henriquescastilho\u002Fmy-claude --skill performing-cloud-native-threat-hunting-with-aws-detective",{"tool":77,"command":78},"bunx","bunx skills add henriquescastilho\u002Fmy-claude --skill performing-cloud-native-threat-hunting-with-aws-detective",{"tool":80,"command":81},"pnpm","pnpm dlx skills add henriquescastilho\u002Fmy-claude --skill performing-cloud-native-threat-hunting-with-aws-detective","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-cloud-native-threat-hunting-with-aws-detective\u002FSKILL.md",true,[85,91,97,101,105],{"path":86,"resourceType":87,"resourceTypeDesc":88,"sizeBytes":89,"sourceHtmlUrl":90},"assets\u002Ftemplate.md","ASSET","资产文件",1116,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-cloud-native-threat-hunting-with-aws-detective\u002Fassets\u002Ftemplate.md",{"path":92,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"references\u002Fapi-reference.md","REFERENCE","参考文档",8716,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-cloud-native-threat-hunting-with-aws-detective\u002Freferences\u002Fapi-reference.md",{"path":98,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":99,"sourceHtmlUrl":100},"references\u002Fstandards.md",1084,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-cloud-native-threat-hunting-with-aws-detective\u002Freferences\u002Fstandards.md",{"path":102,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":103,"sourceHtmlUrl":104},"references\u002Fworkflows.md",1115,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-cloud-native-threat-hunting-with-aws-detective\u002Freferences\u002Fworkflows.md",{"path":106,"resourceType":107,"resourceTypeDesc":108,"sizeBytes":109,"sourceHtmlUrl":110},"scripts\u002Fprocess.py","SCRIPT","脚本",7027,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-cloud-native-threat-hunting-with-aws-detective\u002Fscripts\u002Fprocess.py",[112,154,163,172,193,221],{"skillNo":113,"name":114,"nameZh":6,"description":115,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":116,"licenseFileUrl":6,"sourceHtmlUrl":117,"categories":118,"keywords":135,"publishedAt":39},"01M6F0B6XPQ65AX2X0DWK8KT3E","markitdown","Convert files and office documents to Markdown. Supports PDF, DOCX, PPTX, XLSX, images (with OCR), audio (with transcription), HTML, CSV, JSON, XML, ZIP, YouTube URLs, EPubs and more.","MIT","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[119,124,127,130],{"categoryNo":120,"categoryName":121,"taxonomyType":122,"taxonomyTypeDesc":123},"01JBSEEDCAT000000000000002","文档处理","SCENARIO","使用场景",{"categoryNo":125,"categoryName":126,"taxonomyType":122,"taxonomyTypeDesc":123},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":128,"categoryName":129,"taxonomyType":122,"taxonomyTypeDesc":123},"01JBSEEDCAT000000000000004","电子表格",{"categoryNo":131,"categoryName":132,"taxonomyType":133,"taxonomyTypeDesc":134},"01JBSEEDCAT000000000000034","行政与办公人员","PROFESSION","适用职业",[114,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,21],"docx","PDF","pptx","xlsx","documents","csv","ocr","Audio","Bash","markdown","convert","read","write","edit","html","images","files","youtube",{"skillNo":155,"name":114,"nameZh":6,"description":115,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":116,"licenseFileUrl":6,"sourceHtmlUrl":156,"categories":157,"keywords":162,"publishedAt":39},"01M6F06SBHR9F0SDWE282Y8075","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fscientific_writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[158,159,160,161],{"categoryNo":120,"categoryName":121,"taxonomyType":122,"taxonomyTypeDesc":123},{"categoryNo":125,"categoryName":126,"taxonomyType":122,"taxonomyTypeDesc":123},{"categoryNo":128,"categoryName":129,"taxonomyType":122,"taxonomyTypeDesc":123},{"categoryNo":131,"categoryName":132,"taxonomyType":133,"taxonomyTypeDesc":134},[114,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,21],{"skillNo":164,"name":114,"nameZh":6,"description":115,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":116,"licenseFileUrl":6,"sourceHtmlUrl":165,"categories":166,"keywords":171,"publishedAt":39},"01M6F02D4R14EJAPBWVDF9J9VQ","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[167,168,169,170],{"categoryNo":120,"categoryName":121,"taxonomyType":122,"taxonomyTypeDesc":123},{"categoryNo":125,"categoryName":126,"taxonomyType":122,"taxonomyTypeDesc":123},{"categoryNo":128,"categoryName":129,"taxonomyType":122,"taxonomyTypeDesc":123},{"categoryNo":131,"categoryName":132,"taxonomyType":133,"taxonomyTypeDesc":134},[114,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,21],{"skillNo":173,"name":174,"nameZh":6,"description":175,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":116,"licenseFileUrl":6,"sourceHtmlUrl":176,"categories":177,"keywords":178,"publishedAt":39},"01M6F000KS6YB4MKS774G4R8ND","zarr-python","Chunked N-D arrays for cloud storage. Compressed arrays, parallel I\u002FO, S3\u002FGCS integration, NumPy\u002FDask\u002FXarray compatible, for large-scale scientific computing pipelines.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fzarr-python\u002FSKILL.md",[],[179,180,181,182,183,184,25,185,186,187,188,189,190,191,192],"python","zarr python","storage","integration","s3","gcs","dask","parallel","pipelines","arrays","numpy","scientific computing","scale","scientific",{"skillNo":194,"name":195,"nameZh":6,"description":196,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":116,"licenseFileUrl":6,"sourceHtmlUrl":197,"categories":198,"keywords":202,"publishedAt":39},"01M6EZZJWFXM1GR78KTW6J0DN8","what-if-oracle","Run structured What-If scenario analysis with multi-branch possibility exploration. Use this skill when the user asks speculative questions like \"what if...\", \"what would happen if...\", \"what are the possibilities\", \"explore scenarios\", \"scenario analysis\", \"possibility space\", \"what could go wrong\", \"best case \u002F worst case\", \"risk analysis\", \"contingency planning\", \"strategic options\", or any question about uncertain futures. Also trigger when the user faces a fork-in-the-road decision, wants to stress-test an idea, or needs to think through consequences before committing.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fwhat-if-oracle\u002FSKILL.md",[199],{"categoryNo":200,"categoryName":201,"taxonomyType":122,"taxonomyTypeDesc":123},"01JBSEEDCAT000000000000023","Skill与智能体开发",[203,204,205,206,207,208,209,210,211,212,213,147,148,214,215,216,217,218,219,220],"oracle","what if oracle","go","run","ux","futures","analysis","explore","decision","branch","question","idea","exploration","options","stress-test","strategies","scenario","stress",{"skillNo":222,"name":223,"nameZh":6,"description":224,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":116,"licenseFileUrl":6,"sourceHtmlUrl":225,"categories":226,"keywords":237,"publishedAt":39},"01M6EZZCXAEB49RXGQCJX5E8GB","venue-templates","Access comprehensive LaTeX templates, formatting requirements, and submission guidelines for major scientific publication venues (Nature, Science, PLOS, IEEE, ACM), academic conferences (NeurIPS, ICML, CVPR, CHI), research posters, and grant proposals (NSF, NIH, DOE, DARPA). This skill should be used when preparing manuscripts for journal submission, conference papers, research posters, or grant proposals and need venue-specific formatting requirements and templates.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fvenue-templates\u002FSKILL.md",[227,230,233,234],{"categoryNo":228,"categoryName":229,"taxonomyType":122,"taxonomyTypeDesc":123},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":231,"categoryName":232,"taxonomyType":122,"taxonomyTypeDesc":123},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":200,"categoryName":201,"taxonomyType":122,"taxonomyTypeDesc":123},{"categoryNo":235,"categoryName":236,"taxonomyType":133,"taxonomyTypeDesc":134},"01JBSEEDCAT000000000000036","内容创作者",[238,239,240,241,242,243,244,245,144,246,147,148,149,247,248,249,250,251,192,252],"templates","venue templates","research","guidelines","NeurIPS","ICML","LaTeX","science","access","proposals","Academic","requirements","formatting","journal","chi"]