[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6EVWD8PR8W92TKVRH34P4ZQ":3,"skill-same:01M6EVWD8PR8W92TKVRH34P4ZQ":116},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":34,"publishedAt":55,"linkOnly":56,"markdownContent":57,"markdownBody":58,"frontMatter":59,"refName":77,"commitSha":78,"skillDirectory":79,"forksCount":14,"repositoryHtmlUrl":80,"repositoryHomepageUrl":81,"ownerHtmlUrl":82,"ownerBlogUrl":6,"ownerDescription":83,"updatedAt":84,"install":85,"resources":98},"01M6EVWD8PR8W92TKVRH34P4ZQ","performing-insider-threat-investigation",null,"Investigates insider threat incidents involving employees, contractors, or trusted partners who misuse authorized access to steal data, sabotage systems, or violate security policies. Combines digital forensics, user behavior analytics, and HR\u002Flegal coordination to build an evidence-based case. Activates for requests involving insider threat investigation, employee data theft, privilege misuse, user behavior anomaly, or internal threat detection.","henriquescastilho\u002Fmy-claude","henriquescastilho","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153296945?v=4","01M6ESH7EXPXTH9CVQ4K16SRG8","Henrique Scheer","01M6ESH7JHEK2PTNNH4HEH787Z",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-insider-threat-investigation\u002FSKILL.md",[18,23,26,31],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000013","分析与可视化","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",{"categoryNo":32,"categoryName":33,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000037","律师与法务",[35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54],"insider","threat","performing insider threat investigation","investigation","user-behavior-analytics","hr","steal","incident","coordination","access","privilege-misuse","cybersecurity","t1490","t1078","behavior-analytics","insider-threat","data","data-exfiltration","exfiltration","analytics","2026-11-10 10:12:30",false,"---\nname: performing-insider-threat-investigation\ndescription: 'Investigates insider threat incidents involving employees, contractors,\n  or trusted partners who misuse authorized access to steal data, sabotage systems,\n  or violate security policies. Combines digital forensics, user behavior analytics,\n  and HR\u002Flegal coordination to build an evidence-based case. Activates for requests\n  involving insider threat investigation, employee data theft, privilege misuse, user\n  behavior anomaly, or internal threat detection.\n\n  '\ndomain: cybersecurity\nsubdomain: incident-response\ntags:\n- insider-threat\n- user-behavior-analytics\n- data-exfiltration\n- privilege-misuse\n- DFIR\nmitre_attack:\n- T1486\n- T1490\n- T1070\n- T1078\n- T1048\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- RS.MA-01\n- RS.MA-02\n- RS.AN-03\n- RC.RP-01\n---\n\n# Performing Insider Threat Investigation\n\n## When to Use\n\n- DLP (Data Loss Prevention) alerts on large data transfers to personal cloud storage or USB devices\n- User behavior analytics (UBA) detects anomalous access patterns for a user account\n- HR reports a departing employee suspected of taking proprietary information\n- A privileged user is observed accessing systems outside their job function\n- Whistleblower or coworker report alleges policy violations or data theft\n\n**Do not use** for external attacker investigations where compromised credentials are used without insider collusion; use standard incident response procedures instead.\n\n## Prerequisites\n\n- Legal counsel approval before initiating any monitoring or investigation of an employee\n- HR partnership with defined investigation procedures and employee privacy guidelines\n- DLP platform with content inspection and policy enforcement (Symantec DLP, Microsoft Purview, Digital Guardian)\n- User behavior analytics platform (Microsoft Sentinel UEBA, Exabeam, Securonix)\n- Forensic imaging capability for endpoint examination\n- Chain of custody procedures for evidence that may be used in legal proceedings\n- Clear authority and scope documentation approved by legal and HR\n\n## Workflow\n\n### Step 1: Receive and Validate the Allegation\n\nDocument the initial report and validate before proceeding:\n\n- Record the source of the allegation (DLP alert, UBA detection, HR referral, manager report)\n- Confirm with legal counsel that the investigation is authorized\n- Define the investigation scope: what activity is being investigated, time period, systems involved\n- Establish the investigation team: security, legal, HR (never investigate alone)\n- Create a restricted case file accessible only to the investigation team\n\n```\nInvestigation Authorization:\n━━━━━━━━━━━━━━━━━━━━━━━━━━━\nCase ID:           INV-2025-042\nSubject:           [Employee Name] - [Title] - [Department]\nAllegation:        Unauthorized transfer of proprietary data to personal cloud storage\nReported By:       DLP system alert + manager concern\nLegal Approval:    [Counsel Name] - 2025-11-15\nHR Liaison:        [HR Name]\nScope:             File access and transfer activity from 2025-10-01 to present\nSystems in Scope:  Workstation, email, cloud storage, VPN, DLP logs\n```\n\n### Step 2: Collect Evidence Covertly\n\nGather evidence without alerting the subject to the investigation:\n\n**Log-Based Evidence (non-intrusive):**\n- DLP logs: file transfers, policy violations, content matches\n- Cloud access logs: SharePoint, OneDrive, Google Drive activity\n- Email logs: messages to personal accounts, large attachments, forwarding rules\n- VPN and authentication logs: access times, locations, devices\n- Badge access logs: physical access patterns\n- Print logs: large print jobs of sensitive documents\n- USB device connection logs: device type, serial number, connection times\n\n**User Activity Monitoring (requires legal approval):**\n- Screen capture or session recording (only if legally authorized and documented)\n- Keystroke logging (jurisdiction-dependent, requires explicit legal approval)\n- Network traffic capture for the subject's workstation\n\n**Endpoint Forensics (if warranted by evidence):**\n- Create forensic image of the subject's workstation\n- Analyze browser history, download history, and installed applications\n- Examine deleted files and Recycle Bin contents\n- Review cloud sync application logs (Dropbox, Google Drive desktop client)\n\n### Step 3: Analyze User Behavior Patterns\n\nBuild a behavioral profile comparing normal vs. anomalous activity:\n\n```\nBehavioral Analysis:\n━━━━━━━━━━━━━━━━━━\nNormal Baseline (6-month average):\n- Login time: 08:30-09:00 weekdays\n- Files accessed: 15-25 per day (marketing department files)\n- Email volume: 45 sent, 80 received per day\n- Data transferred: 50MB per day average\n- USB usage: None\n\nInvestigation Period (last 30 days):\n- Login time: 22:00-02:00 (after hours, multiple occasions)\n- Files accessed: 200+ per day (finance, engineering, executive files)\n- Email volume: 120 sent per day (30% to personal gmail)\n- Data transferred: 2.5GB per day average\n- USB usage: 3 unique devices connected (Kingston DataTraveler)\n- Print jobs: 847 pages (competitor analysis, customer lists, source code)\n\nAnomaly Score: 94\u002F100 (Critical)\n```\n\n### Step 4: Reconstruct the Activity Timeline\n\nBuild a chronological timeline of the subject's actions:\n\n```\nTimeline of Activity:\n2025-10-15  Subject submits resignation (2-week notice)\n2025-10-16  First after-hours login at 23:15, accessed engineering Git repository\n2025-10-17  USB device (Kingston DT 64GB) first connected at 23:30\n2025-10-18  DLP alert: 450 files copied to USB, including CAD drawings\n2025-10-19  200+ emails forwarded to personal Gmail account\n2025-10-20  Google Drive desktop client installed, syncing corporate SharePoint\n2025-10-22  Accessed executive SharePoint site (not normally accessed)\n2025-10-25  Second USB device connected, 2.1GB transferred\n2025-10-28  Print job: 847 pages including customer contact database\n```\n\n### Step 5: Assess Impact and Determine Response\n\nEvaluate the severity and coordinate the response with HR and legal:\n\n**Impact Assessment:**\n- What data was accessed or exfiltrated (classification level, business impact)\n- Was the data shared externally (competitors, public, personal storage)\n- Regulatory implications (PII, PHI, financial data, export-controlled)\n- Contractual implications (NDA violations, IP assignment agreements)\n- Potential financial damage to the organization\n\n**Response Options (determined by legal and HR):**\n- Confront the subject with evidence during an interview (HR-led)\n- Terminate employment and revoke all access immediately\n- Pursue civil litigation for breach of NDA or trade secret theft\n- Refer to law enforcement for criminal prosecution (theft of trade secrets, CFAA violation)\n- Negotiate a settlement with return\u002Fdestruction of data\n\n### Step 6: Preserve Evidence for Legal Proceedings\n\nEnsure all evidence meets legal admissibility standards:\n\n- Maintain strict chain of custody for all physical and digital evidence\n- Document all analysis steps in detail (reproducible by another examiner)\n- Hash all evidence files and maintain an integrity log\n- Store evidence in a secure, access-controlled repository with audit logging\n- Retain evidence per legal hold requirements (do not destroy during active investigation or litigation)\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Insider Threat** | Risk posed by individuals with authorized access who intentionally or unintentionally cause harm to the organization |\n| **User Behavior Analytics (UBA)** | Technology that analyzes user activity patterns to detect anomalies indicating potential insider threats |\n| **Data Loss Prevention (DLP)** | Technology that monitors, detects, and blocks unauthorized transfer of sensitive data outside the organization |\n| **Legal Hold** | Directive to preserve all relevant evidence and suspend normal document destruction policies during an investigation |\n| **Need to Know** | Information access principle restricting insider threat investigation details to only authorized team members |\n| **Exfiltration Vector** | Method used to move data outside the organization: USB, email, cloud storage, print, screen capture, photography |\n\n## Tools & Systems\n\n- **Microsoft Purview (formerly Compliance Center)**: Insider risk management, DLP, eDiscovery, and content search\n- **Exabeam \u002F Securonix**: User and entity behavior analytics (UEBA) platforms for anomaly detection\n- **Digital Guardian**: DLP and insider threat detection platform with endpoint agent\n- **Magnet AXIOM**: Digital forensics platform supporting endpoint, cloud, and mobile evidence analysis\n- **Relativity**: eDiscovery platform for legal review of collected evidence in insider threat cases\n\n## Common Scenarios\n\n### Scenario: Departing Engineer Exfiltrating Source Code\n\n**Context**: A senior software engineer with access to critical repositories submits a two-week resignation notice. The engineering manager reports that the engineer has been working unusual hours and downloading large amounts of code.\n\n**Approach**:\n1. Obtain legal authorization to investigate before taking any action\n2. Pull Git access logs showing repository clones and downloads for the past 60 days\n3. Review DLP logs for USB device connections and large file transfers\n4. Check email gateway for messages with code attachments sent to personal accounts\n5. Analyze browser history for personal cloud storage uploads\n6. Image the workstation forensically before the employee's last day\n7. Present findings to legal and HR for determination of next steps\n\n**Pitfalls**:\n- Investigating without legal counsel authorization (may violate employee privacy rights)\n- Alerting the subject to the investigation before evidence is preserved\n- Not preserving the workstation before the employee's departure date\n- Assuming all after-hours access is malicious without comparing to the employee's historical baseline\n- Failing to check personal mobile devices that may have accessed corporate cloud services\n\n## Output Format\n\n```\nINSIDER THREAT INVESTIGATION REPORT\n=====================================\nCase ID:          INV-2025-042\nClassification:   CONFIDENTIAL - Need to Know Only\nSubject:          [Name Redacted] - Senior Engineer\nInvestigation Period: 2025-10-01 to 2025-10-28\nInvestigator:     [Name]\nLegal Counsel:    [Name]\nHR Liaison:       [Name]\n\nALLEGATION\nUnauthorized exfiltration of proprietary source code and customer\ndata following resignation submission.\n\nEVIDENCE SUMMARY\n1. Git logs: 47 repositories cloned (vs. baseline of 3)\n2. USB transfers: 4.6 GB across 3 unique devices over 12 sessions\n3. Email: 200+ emails with attachments forwarded to personal Gmail\n4. Cloud: Google Drive sync client installed, syncing corporate files\n5. Print: 847 pages including customer contact database\n6. Physical access: After-hours badge access on 8 of 12 workdays\n\nBEHAVIORAL ANALYSIS\n[Baseline vs. anomalous activity comparison]\n\nIMPACT ASSESSMENT\nData Classification:  Confidential (source code, customer PII)\nEstimated Volume:     7.2 GB exfiltrated\nRegulatory Impact:    Potential GDPR notification (customer PII)\nBusiness Impact:      Competitive advantage at risk\n\nTIMELINE\n[Chronological event listing]\n\nRECOMMENDATIONS\n1. [Legal\u002FHR decision on employment action]\n2. [Evidence preservation actions]\n3. [Regulatory notification assessment]\n4. [Access control improvements]\n```\n","# Performing Insider Threat Investigation\n\n## When to Use\n\n- DLP (Data Loss Prevention) alerts on large data transfers to personal cloud storage or USB devices\n- User behavior analytics (UBA) detects anomalous access patterns for a user account\n- HR reports a departing employee suspected of taking proprietary information\n- A privileged user is observed accessing systems outside their job function\n- Whistleblower or coworker report alleges policy violations or data theft\n\n**Do not use** for external attacker investigations where compromised credentials are used without insider collusion; use standard incident response procedures instead.\n\n## Prerequisites\n\n- Legal counsel approval before initiating any monitoring or investigation of an employee\n- HR partnership with defined investigation procedures and employee privacy guidelines\n- DLP platform with content inspection and policy enforcement (Symantec DLP, Microsoft Purview, Digital Guardian)\n- User behavior analytics platform (Microsoft Sentinel UEBA, Exabeam, Securonix)\n- Forensic imaging capability for endpoint examination\n- Chain of custody procedures for evidence that may be used in legal proceedings\n- Clear authority and scope documentation approved by legal and HR\n\n## Workflow\n\n### Step 1: Receive and Validate the Allegation\n\nDocument the initial report and validate before proceeding:\n\n- Record the source of the allegation (DLP alert, UBA detection, HR referral, manager report)\n- Confirm with legal counsel that the investigation is authorized\n- Define the investigation scope: what activity is being investigated, time period, systems involved\n- Establish the investigation team: security, legal, HR (never investigate alone)\n- Create a restricted case file accessible only to the investigation team\n\n```\nInvestigation Authorization:\n━━━━━━━━━━━━━━━━━━━━━━━━━━━\nCase ID:           INV-2025-042\nSubject:           [Employee Name] - [Title] - [Department]\nAllegation:        Unauthorized transfer of proprietary data to personal cloud storage\nReported By:       DLP system alert + manager concern\nLegal Approval:    [Counsel Name] - 2025-11-15\nHR Liaison:        [HR Name]\nScope:             File access and transfer activity from 2025-10-01 to present\nSystems in Scope:  Workstation, email, cloud storage, VPN, DLP logs\n```\n\n### Step 2: Collect Evidence Covertly\n\nGather evidence without alerting the subject to the investigation:\n\n**Log-Based Evidence (non-intrusive):**\n- DLP logs: file transfers, policy violations, content matches\n- Cloud access logs: SharePoint, OneDrive, Google Drive activity\n- Email logs: messages to personal accounts, large attachments, forwarding rules\n- VPN and authentication logs: access times, locations, devices\n- Badge access logs: physical access patterns\n- Print logs: large print jobs of sensitive documents\n- USB device connection logs: device type, serial number, connection times\n\n**User Activity Monitoring (requires legal approval):**\n- Screen capture or session recording (only if legally authorized and documented)\n- Keystroke logging (jurisdiction-dependent, requires explicit legal approval)\n- Network traffic capture for the subject's workstation\n\n**Endpoint Forensics (if warranted by evidence):**\n- Create forensic image of the subject's workstation\n- Analyze browser history, download history, and installed applications\n- Examine deleted files and Recycle Bin contents\n- Review cloud sync application logs (Dropbox, Google Drive desktop client)\n\n### Step 3: Analyze User Behavior Patterns\n\nBuild a behavioral profile comparing normal vs. anomalous activity:\n\n```\nBehavioral Analysis:\n━━━━━━━━━━━━━━━━━━\nNormal Baseline (6-month average):\n- Login time: 08:30-09:00 weekdays\n- Files accessed: 15-25 per day (marketing department files)\n- Email volume: 45 sent, 80 received per day\n- Data transferred: 50MB per day average\n- USB usage: None\n\nInvestigation Period (last 30 days):\n- Login time: 22:00-02:00 (after hours, multiple occasions)\n- Files accessed: 200+ per day (finance, engineering, executive files)\n- Email volume: 120 sent per day (30% to personal gmail)\n- Data transferred: 2.5GB per day average\n- USB usage: 3 unique devices connected (Kingston DataTraveler)\n- Print jobs: 847 pages (competitor analysis, customer lists, source code)\n\nAnomaly Score: 94\u002F100 (Critical)\n```\n\n### Step 4: Reconstruct the Activity Timeline\n\nBuild a chronological timeline of the subject's actions:\n\n```\nTimeline of Activity:\n2025-10-15  Subject submits resignation (2-week notice)\n2025-10-16  First after-hours login at 23:15, accessed engineering Git repository\n2025-10-17  USB device (Kingston DT 64GB) first connected at 23:30\n2025-10-18  DLP alert: 450 files copied to USB, including CAD drawings\n2025-10-19  200+ emails forwarded to personal Gmail account\n2025-10-20  Google Drive desktop client installed, syncing corporate SharePoint\n2025-10-22  Accessed executive SharePoint site (not normally accessed)\n2025-10-25  Second USB device connected, 2.1GB transferred\n2025-10-28  Print job: 847 pages including customer contact database\n```\n\n### Step 5: Assess Impact and Determine Response\n\nEvaluate the severity and coordinate the response with HR and legal:\n\n**Impact Assessment:**\n- What data was accessed or exfiltrated (classification level, business impact)\n- Was the data shared externally (competitors, public, personal storage)\n- Regulatory implications (PII, PHI, financial data, export-controlled)\n- Contractual implications (NDA violations, IP assignment agreements)\n- Potential financial damage to the organization\n\n**Response Options (determined by legal and HR):**\n- Confront the subject with evidence during an interview (HR-led)\n- Terminate employment and revoke all access immediately\n- Pursue civil litigation for breach of NDA or trade secret theft\n- Refer to law enforcement for criminal prosecution (theft of trade secrets, CFAA violation)\n- Negotiate a settlement with return\u002Fdestruction of data\n\n### Step 6: Preserve Evidence for Legal Proceedings\n\nEnsure all evidence meets legal admissibility standards:\n\n- Maintain strict chain of custody for all physical and digital evidence\n- Document all analysis steps in detail (reproducible by another examiner)\n- Hash all evidence files and maintain an integrity log\n- Store evidence in a secure, access-controlled repository with audit logging\n- Retain evidence per legal hold requirements (do not destroy during active investigation or litigation)\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Insider Threat** | Risk posed by individuals with authorized access who intentionally or unintentionally cause harm to the organization |\n| **User Behavior Analytics (UBA)** | Technology that analyzes user activity patterns to detect anomalies indicating potential insider threats |\n| **Data Loss Prevention (DLP)** | Technology that monitors, detects, and blocks unauthorized transfer of sensitive data outside the organization |\n| **Legal Hold** | Directive to preserve all relevant evidence and suspend normal document destruction policies during an investigation |\n| **Need to Know** | Information access principle restricting insider threat investigation details to only authorized team members |\n| **Exfiltration Vector** | Method used to move data outside the organization: USB, email, cloud storage, print, screen capture, photography |\n\n## Tools & Systems\n\n- **Microsoft Purview (formerly Compliance Center)**: Insider risk management, DLP, eDiscovery, and content search\n- **Exabeam \u002F Securonix**: User and entity behavior analytics (UEBA) platforms for anomaly detection\n- **Digital Guardian**: DLP and insider threat detection platform with endpoint agent\n- **Magnet AXIOM**: Digital forensics platform supporting endpoint, cloud, and mobile evidence analysis\n- **Relativity**: eDiscovery platform for legal review of collected evidence in insider threat cases\n\n## Common Scenarios\n\n### Scenario: Departing Engineer Exfiltrating Source Code\n\n**Context**: A senior software engineer with access to critical repositories submits a two-week resignation notice. The engineering manager reports that the engineer has been working unusual hours and downloading large amounts of code.\n\n**Approach**:\n1. Obtain legal authorization to investigate before taking any action\n2. Pull Git access logs showing repository clones and downloads for the past 60 days\n3. Review DLP logs for USB device connections and large file transfers\n4. Check email gateway for messages with code attachments sent to personal accounts\n5. Analyze browser history for personal cloud storage uploads\n6. Image the workstation forensically before the employee's last day\n7. Present findings to legal and HR for determination of next steps\n\n**Pitfalls**:\n- Investigating without legal counsel authorization (may violate employee privacy rights)\n- Alerting the subject to the investigation before evidence is preserved\n- Not preserving the workstation before the employee's departure date\n- Assuming all after-hours access is malicious without comparing to the employee's historical baseline\n- Failing to check personal mobile devices that may have accessed corporate cloud services\n\n## Output Format\n\n```\nINSIDER THREAT INVESTIGATION REPORT\n=====================================\nCase ID:          INV-2025-042\nClassification:   CONFIDENTIAL - Need to Know Only\nSubject:          [Name Redacted] - Senior Engineer\nInvestigation Period: 2025-10-01 to 2025-10-28\nInvestigator:     [Name]\nLegal Counsel:    [Name]\nHR Liaison:       [Name]\n\nALLEGATION\nUnauthorized exfiltration of proprietary source code and customer\ndata following resignation submission.\n\nEVIDENCE SUMMARY\n1. Git logs: 47 repositories cloned (vs. baseline of 3)\n2. USB transfers: 4.6 GB across 3 unique devices over 12 sessions\n3. Email: 200+ emails with attachments forwarded to personal Gmail\n4. Cloud: Google Drive sync client installed, syncing corporate files\n5. Print: 847 pages including customer contact database\n6. Physical access: After-hours badge access on 8 of 12 workdays\n\nBEHAVIORAL ANALYSIS\n[Baseline vs. anomalous activity comparison]\n\nIMPACT ASSESSMENT\nData Classification:  Confidential (source code, customer PII)\nEstimated Volume:     7.2 GB exfiltrated\nRegulatory Impact:    Potential GDPR notification (customer PII)\nBusiness Impact:      Competitive advantage at risk\n\nTIMELINE\n[Chronological event listing]\n\nRECOMMENDATIONS\n1. [Legal\u002FHR decision on employment action]\n2. [Evidence preservation actions]\n3. [Regulatory notification assessment]\n4. [Access control improvements]\n```\n",{"name":5,"tags":60,"author":62,"domain":46,"license":15,"version":63,"nist_csf":64,"subdomain":69,"description":70,"mitre_attack":71},[50,39,52,45,61],"DFIR","mahipal","1.0.0",[65,66,67,68],"RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01","incident-response","Investigates insider threat incidents involving employees, contractors, or trusted partners who misuse authorized access to steal data, sabotage systems, or violate security policies. Combines digital forensics, user behavior analytics, and HR\u002Flegal coordination to build an evidence-based case. Activates for requests involving insider threat investigation, employee data theft, privilege misuse, user behavior anomaly, or internal threat detection.\n",[72,73,74,75,76],"T1486","T1490","T1070","T1078","T1048","main","7925716f065257435fdb12e97f7e52842147d5ad",".claude\u002Fskills\u002Fperforming-insider-threat-investigation","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude","https:\u002F\u002Fclaude.com\u002Fclaude-code","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho","Software · Applied AI · Quantitative Modeling · Building with Claude.","2026-06-10 12:24:46",{"source":8,"skillName":5,"commands":86,"prompt":96,"zipAvailable":97},[87,90,93],{"tool":88,"command":89},"npx","npx skills add henriquescastilho\u002Fmy-claude --skill performing-insider-threat-investigation",{"tool":91,"command":92},"bunx","bunx skills add henriquescastilho\u002Fmy-claude --skill performing-insider-threat-investigation",{"tool":94,"command":95},"pnpm","pnpm dlx skills add henriquescastilho\u002Fmy-claude --skill performing-insider-threat-investigation","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-insider-threat-investigation\u002FSKILL.md",true,[99,104,110],{"path":100,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":102,"sourceHtmlUrl":103},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-insider-threat-investigation\u002FLICENSE",{"path":105,"resourceType":106,"resourceTypeDesc":107,"sizeBytes":108,"sourceHtmlUrl":109},"references\u002Fapi-reference.md","REFERENCE","参考文档",1899,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-insider-threat-investigation\u002Freferences\u002Fapi-reference.md",{"path":111,"resourceType":112,"resourceTypeDesc":113,"sizeBytes":114,"sourceHtmlUrl":115},"scripts\u002Fagent.py","SCRIPT","脚本",8867,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-insider-threat-investigation\u002Fscripts\u002Fagent.py",[117,156,165,174,196,222],{"skillNo":118,"name":119,"nameZh":6,"description":120,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":121,"licenseFileUrl":6,"sourceHtmlUrl":122,"categories":123,"keywords":136,"publishedAt":55},"01M6F0B6XPQ65AX2X0DWK8KT3E","markitdown","Convert files and office documents to Markdown. Supports PDF, DOCX, PPTX, XLSX, images (with OCR), audio (with transcription), HTML, CSV, JSON, XML, ZIP, YouTube URLs, EPubs and more.","MIT","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[124,127,130,133],{"categoryNo":125,"categoryName":126,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000002","文档处理",{"categoryNo":128,"categoryName":129,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":131,"categoryName":132,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000004","电子表格",{"categoryNo":134,"categoryName":135,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000034","行政与办公人员",[119,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155],"docx","PDF","pptx","xlsx","documents","csv","ocr","Audio","Bash","markdown","convert","read","write","edit","html","images","files","youtube","with",{"skillNo":157,"name":119,"nameZh":6,"description":120,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":121,"licenseFileUrl":6,"sourceHtmlUrl":158,"categories":159,"keywords":164,"publishedAt":55},"01M6F06SBHR9F0SDWE282Y8075","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fscientific_writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[160,161,162,163],{"categoryNo":125,"categoryName":126,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":128,"categoryName":129,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":131,"categoryName":132,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":134,"categoryName":135,"taxonomyType":29,"taxonomyTypeDesc":30},[119,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155],{"skillNo":166,"name":119,"nameZh":6,"description":120,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":121,"licenseFileUrl":6,"sourceHtmlUrl":167,"categories":168,"keywords":173,"publishedAt":55},"01M6F02D4R14EJAPBWVDF9J9VQ","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[169,170,171,172],{"categoryNo":125,"categoryName":126,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":128,"categoryName":129,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":131,"categoryName":132,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":134,"categoryName":135,"taxonomyType":29,"taxonomyTypeDesc":30},[119,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155],{"skillNo":175,"name":176,"nameZh":6,"description":177,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":121,"licenseFileUrl":6,"sourceHtmlUrl":178,"categories":179,"keywords":180,"publishedAt":55},"01M6F000KS6YB4MKS774G4R8ND","zarr-python","Chunked N-D arrays for cloud storage. Compressed arrays, parallel I\u002FO, S3\u002FGCS integration, NumPy\u002FDask\u002FXarray compatible, for large-scale scientific computing pipelines.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fzarr-python\u002FSKILL.md",[],[181,182,183,184,185,186,187,188,189,190,191,192,193,194,195],"python","zarr python","storage","integration","s3","gcs","cloud","dask","parallel","pipelines","arrays","numpy","scientific computing","scale","scientific",{"skillNo":197,"name":198,"nameZh":6,"description":199,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":121,"licenseFileUrl":6,"sourceHtmlUrl":200,"categories":201,"keywords":203,"publishedAt":55},"01M6EZZJWFXM1GR78KTW6J0DN8","what-if-oracle","Run structured What-If scenario analysis with multi-branch possibility exploration. Use this skill when the user asks speculative questions like \"what if...\", \"what would happen if...\", \"what are the possibilities\", \"explore scenarios\", \"scenario analysis\", \"possibility space\", \"what could go wrong\", \"best case \u002F worst case\", \"risk analysis\", \"contingency planning\", \"strategic options\", or any question about uncertain futures. Also trigger when the user faces a fork-in-the-road decision, wants to stress-test an idea, or needs to think through consequences before committing.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fwhat-if-oracle\u002FSKILL.md",[202],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[204,205,206,207,208,209,210,211,212,213,214,148,149,215,216,217,218,219,220,221],"oracle","what if oracle","go","run","ux","futures","analysis","explore","decision","branch","question","idea","exploration","options","stress-test","strategies","scenario","stress",{"skillNo":223,"name":224,"nameZh":6,"description":225,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":121,"licenseFileUrl":6,"sourceHtmlUrl":226,"categories":227,"keywords":238,"publishedAt":55},"01M6EZZCXAEB49RXGQCJX5E8GB","venue-templates","Access comprehensive LaTeX templates, formatting requirements, and submission guidelines for major scientific publication venues (Nature, Science, PLOS, IEEE, ACM), academic conferences (NeurIPS, ICML, CVPR, CHI), research posters, and grant proposals (NSF, NIH, DOE, DARPA). This skill should be used when preparing manuscripts for journal submission, conference papers, research posters, or grant proposals and need venue-specific formatting requirements and templates.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fvenue-templates\u002FSKILL.md",[228,231,234,235],{"categoryNo":229,"categoryName":230,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":232,"categoryName":233,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":236,"categoryName":237,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000036","内容创作者",[239,240,241,242,243,244,245,246,145,44,148,149,150,247,248,249,250,251,195,252],"templates","venue templates","research","guidelines","NeurIPS","ICML","LaTeX","science","proposals","Academic","requirements","formatting","journal","chi"]