[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6EVZV016EDWGF7A4N136HDF":3,"skill-same:01M6EVZV016EDWGF7A4N136HDF":112},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":73,"commitSha":74,"skillDirectory":75,"forksCount":14,"repositoryHtmlUrl":76,"repositoryHomepageUrl":77,"ownerHtmlUrl":78,"ownerBlogUrl":6,"ownerDescription":79,"updatedAt":80,"install":81,"resources":94},"01M6EVZV016EDWGF7A4N136HDF","performing-oil-gas-cybersecurity-assessment",null,"This skill covers conducting cybersecurity assessments specific to oil and gas facilities including upstream (exploration\u002Fproduction), midstream (pipeline\u002Ftransport), and downstream (refining\u002Fdistribution) operations. It addresses SCADA systems controlling pipeline operations, DCS for refinery process control, safety instrumented systems for hazardous processes, remote terminal units at unmanned wellhead sites, and compliance with API 1164, TSA Pipeline Security Directives, IEC 62443, and NIST Cybersecurity Framework for critical infrastructure.","henriquescastilho\u002Fmy-claude","henriquescastilho","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153296945?v=4","01M6ESH7EXPXTH9CVQ4K16SRG8","Henrique Scheer","01M6ESH7JHEK2PTNNH4HEH787Z",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-oil-gas-cybersecurity-assessment\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"cybersecurity","assessment","gas","performing oil gas cybersecurity assessment","api","remote","de","iec 62443","critical","distribution","exploration","cm","terminal","ICS-security","Safety","t1078","NIST","pipeline","infrastructure","security","2026-11-10 10:12:30",false,"---\nname: performing-oil-gas-cybersecurity-assessment\ndescription: 'This skill covers conducting cybersecurity assessments specific to oil\n  and gas facilities including upstream (exploration\u002Fproduction), midstream (pipeline\u002Ftransport),\n  and downstream (refining\u002Fdistribution) operations. It addresses SCADA systems controlling\n  pipeline operations, DCS for refinery process control, safety instrumented systems\n  for hazardous processes, remote terminal units at unmanned wellhead sites, and compliance\n  with API 1164, TSA Pipeline Security Directives, IEC 62443, and NIST Cybersecurity\n  Framework for critical infrastructure.\n\n  '\ndomain: cybersecurity\nsubdomain: ot-ics-security\ntags:\n- ot-security\n- ics\n- scada\n- industrial-control\n- iec62443\n- oil-gas\n- pipeline-security\n- api1164\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.IR-01\n- DE.CM-01\n- ID.AM-05\n- GV.OC-02\nmitre_attack:\n- T1078\n- T1190\n- T1059\n- T0816\n- T0836\n---\n\n# Performing Oil & Gas Cybersecurity Assessment\n\n## When to Use\n\n- When conducting a cybersecurity assessment of a refinery, pipeline, or production facility\n- When preparing for TSA Pipeline Security Directive compliance (SD-01, SD-02)\n- When assessing cybersecurity posture against API Standard 1164 (Pipeline SCADA Security)\n- When evaluating the security of remote wellhead SCADA systems and satellite communications\n- When a merger, acquisition, or regulatory audit requires a comprehensive OT security evaluation\n\n**Do not use** for IT-only corporate network assessments of oil and gas companies, for physical security assessments without a cyber component, or for environmental compliance assessments.\n\n## Prerequisites\n\n- Written authorization from facility management and operations team\n- Understanding of oil and gas operations (upstream, midstream, downstream processes)\n- Familiarity with API 1164, TSA SD-01\u002FSD-02, IEC 62443, and NIST CSF\n- Passive monitoring tools for OT network traffic capture\n- Access to network diagrams, SCADA architecture documentation, and safety studies (HAZOP)\n\n## Workflow\n\n### Step 1: Scope Assessment Based on Facility Type\n\nOil and gas facilities have unique characteristics based on their operational segment that affect the assessment approach.\n\n```yaml\n# Oil & Gas Cybersecurity Assessment Scope\nfacility:\n  name: \"Gulf Coast Refinery\"\n  segment: \"Downstream\"\n  capacity: \"250,000 barrels per day\"\n  regulatory: [\"TSA SD-02\", \"API 1164\", \"IEC 62443\", \"NIST CSF\"]\n\nassessment_areas:\n  process_control:\n    description: \"Refinery DCS and SCADA systems\"\n    systems:\n      - \"Honeywell Experion DCS - main process control\"\n      - \"Yokogawa CENTUM VP - hydrocracker unit\"\n      - \"Triconex SIS - emergency shutdown systems\"\n      - \"Allen-Bradley PLCs - utilities and tank farm\"\n    protocols: [\"Modbus\u002FTCP\", \"OPC UA\", \"HART\", \"Foundation Fieldbus\"]\n\n  pipeline_scada:\n    description: \"Pipeline SCADA for crude receipt and product dispatch\"\n    systems:\n      - \"ABB RTU560 - pipeline RTUs at pump stations\"\n      - \"GE iFIX SCADA - pipeline control center\"\n      - \"Flow computers - custody transfer metering\"\n    protocols: [\"DNP3\", \"Modbus RTU over serial\", \"IEC 60870-5-104\"]\n    communications: [\"Licensed radio\", \"Leased line\", \"Satellite (VSAT)\"]\n\n  safety_systems:\n    description: \"Safety Instrumented Systems and fire\u002Fgas detection\"\n    systems:\n      - \"Schneider Triconex 3008 - process SIS\"\n      - \"Honeywell FSC - fire and gas\"\n      - \"Combustion turbine protection systems\"\n    criticality: \"SIL 2\u002F3 rated - highest priority\"\n\n  remote_access:\n    description: \"Vendor and operator remote access to OT\"\n    methods:\n      - \"Citrix-based remote access to SCADA terminals\"\n      - \"VPN to vendor support for DCS maintenance\"\n      - \"Satellite communication to remote pump stations\"\n\n  physical_security:\n    description: \"Physical security integration with cyber\"\n    systems:\n      - \"Access control systems (badge readers)\"\n      - \"CCTV with IP network connectivity\"\n      - \"Perimeter intrusion detection\"\n\ncompliance_mapping:\n  tsa_sd_02:\n    - \"Implement network segmentation between IT and OT\"\n    - \"Develop and maintain a Cybersecurity Implementation Plan (CIP)\"\n    - \"Establish a Cybersecurity Assessment Program\"\n    - \"Report cybersecurity incidents to CISA within 24 hours\"\n    - \"Implement access control measures for critical OT systems\"\n  api_1164:\n    - \"Risk-based cybersecurity program for pipeline SCADA\"\n    - \"Asset identification and classification\"\n    - \"Network security and access control\"\n    - \"Personnel security and training\"\n    - \"Incident response and recovery\"\n```\n\n### Step 2: Assess Pipeline SCADA Security\n\nPipeline SCADA systems have unique challenges including long-distance communications over untrusted media, unmanned remote sites, and custody transfer integrity requirements.\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Pipeline SCADA Security Assessment Tool.\n\nEvaluates security of pipeline SCADA systems against\nAPI 1164 and TSA Pipeline Security Directive requirements.\n\"\"\"\n\nimport json\nimport sys\nfrom dataclasses import dataclass, field, asdict\nfrom datetime import datetime\n\n\n@dataclass\nclass AssessmentFinding:\n    finding_id: str\n    category: str\n    severity: str\n    title: str\n    description: str\n    affected_systems: list\n    regulatory_reference: str\n    remediation: str\n    timeline: str\n\n\n@dataclass\nclass ComplianceCheck:\n    requirement_id: str\n    description: str\n    standard: str\n    status: str  # compliant, partial, non-compliant\n    evidence: str\n    gap: str = \"\"\n\n\nclass PipelineSCADAAssessment:\n    \"\"\"Pipeline SCADA security assessment per API 1164 \u002F TSA SD-02.\"\"\"\n\n    def __init__(self, facility_name):\n        self.facility = facility_name\n        self.findings = []\n        self.compliance_checks = []\n        self.finding_counter = 1\n\n    def assess_network_architecture(self, architecture_data):\n        \"\"\"Evaluate pipeline SCADA network architecture.\"\"\"\n        checks = []\n\n        # TSA SD-02: Network segmentation between IT and OT\n        if not architecture_data.get(\"it_ot_segmentation\"):\n            self.findings.append(AssessmentFinding(\n                finding_id=f\"OG-{self.finding_counter:03d}\",\n                category=\"Network Architecture\",\n                severity=\"critical\",\n                title=\"No IT\u002FOT Network Segmentation\",\n                description=(\n                    \"Pipeline SCADA network is not segmented from corporate IT. \"\n                    \"An attacker compromising the corporate network could pivot \"\n                    \"directly to pipeline control systems.\"\n                ),\n                affected_systems=[\"Pipeline SCADA servers\", \"RTU communications\"],\n                regulatory_reference=\"TSA SD-02 Section 2.1; API 1164 Section 7\",\n                remediation=\"Deploy DMZ with industrial firewall between IT and pipeline SCADA\",\n                timeline=\"30 days\",\n            ))\n            self.finding_counter += 1\n\n        # Check for encrypted RTU communications\n        if architecture_data.get(\"rtu_comm_encrypted\") is False:\n            self.findings.append(AssessmentFinding(\n                finding_id=f\"OG-{self.finding_counter:03d}\",\n                category=\"Communication Security\",\n                severity=\"high\",\n                title=\"Unencrypted Pipeline RTU Communications\",\n                description=(\n                    \"DNP3 communications between control center and remote RTUs \"\n                    \"traverse radio\u002Fsatellite links without encryption. An attacker \"\n                    \"with radio access could intercept or inject SCADA commands.\"\n                ),\n                affected_systems=[\"Pipeline RTUs\", \"SCADA master station\"],\n                regulatory_reference=\"API 1164 Section 7.3; IEC 62351\",\n                remediation=\"Deploy DNP3 Secure Authentication or VPN tunnel for RTU links\",\n                timeline=\"90 days\",\n            ))\n            self.finding_counter += 1\n\n        # Check remote pump station physical security\n        if not architecture_data.get(\"remote_site_intrusion_detection\"):\n            self.findings.append(AssessmentFinding(\n                finding_id=f\"OG-{self.finding_counter:03d}\",\n                category=\"Physical-Cyber Convergence\",\n                severity=\"high\",\n                title=\"Remote Pump Stations Lack Physical Intrusion Detection\",\n                description=(\n                    \"Unmanned pump stations along the pipeline corridor lack physical \"\n                    \"intrusion detection systems. An attacker could gain physical access \"\n                    \"to RTUs and SCADA communication equipment without detection.\"\n                ),\n                affected_systems=[\"Remote pump station RTUs and networking equipment\"],\n                regulatory_reference=\"TSA SD-02 Section 2.3; API 1164 Section 10\",\n                remediation=\"Install intrusion detection with cellular alerting at remote sites\",\n                timeline=\"60 days\",\n            ))\n            self.finding_counter += 1\n\n    def assess_custody_transfer(self, metering_data):\n        \"\"\"Assess security of custody transfer metering systems.\"\"\"\n        if not metering_data.get(\"flow_computer_auth\"):\n            self.findings.append(AssessmentFinding(\n                finding_id=f\"OG-{self.finding_counter:03d}\",\n                category=\"Custody Transfer Integrity\",\n                severity=\"critical\",\n                title=\"Flow Computer Lacks Authentication\",\n                description=(\n                    \"Custody transfer flow computers accept unauthenticated Modbus \"\n                    \"commands allowing meter factor and flow calculation parameters \"\n                    \"to be modified. This could enable financial fraud through \"\n                    \"manipulation of custody transfer measurements.\"\n                ),\n                affected_systems=[\"Flow computers at custody transfer points\"],\n                regulatory_reference=\"API 1164 Section 8; API MPMS Chapter 21\",\n                remediation=\"Implement authenticated access to flow computers; deploy audit logging\",\n                timeline=\"45 days\",\n            ))\n            self.finding_counter += 1\n\n    def check_tsa_compliance(self):\n        \"\"\"Evaluate compliance with TSA Pipeline Security Directives.\"\"\"\n        tsa_requirements = [\n            ComplianceCheck(\"TSA-01\", \"Cybersecurity Coordinator designated\",\n                           \"TSA SD-01\", \"compliant\", \"CySec coordinator appointed\"),\n            ComplianceCheck(\"TSA-02\", \"Incident reporting to CISA within 24 hours\",\n                           \"TSA SD-01\", \"partial\", \"Process exists but not tested\",\n                           gap=\"Need tabletop exercise to validate reporting timeline\"),\n            ComplianceCheck(\"TSA-03\", \"Cybersecurity Implementation Plan\",\n                           \"TSA SD-02\", \"non-compliant\", \"No formal CIP exists\",\n                           gap=\"Develop and submit CIP to TSA within 90 days\"),\n            ComplianceCheck(\"TSA-04\", \"Network segmentation between IT and OT\",\n                           \"TSA SD-02\", \"non-compliant\", \"Flat network observed\",\n                           gap=\"Implement DMZ and zone-based segmentation\"),\n            ComplianceCheck(\"TSA-05\", \"Access control for critical OT systems\",\n                           \"TSA SD-02\", \"partial\", \"Shared accounts on SCADA\",\n                           gap=\"Implement individual accounts with role-based access\"),\n            ComplianceCheck(\"TSA-06\", \"Continuous monitoring and detection\",\n                           \"TSA SD-02\", \"non-compliant\", \"No OT IDS deployed\",\n                           gap=\"Deploy OT intrusion detection (Dragos\u002FNozomi\u002FClaroty)\"),\n            ComplianceCheck(\"TSA-07\", \"Patch management for critical systems\",\n                           \"TSA SD-02\", \"partial\", \"Ad hoc patching only\",\n                           gap=\"Establish formal OT patch management program\"),\n        ]\n        self.compliance_checks.extend(tsa_requirements)\n\n    def generate_report(self):\n        \"\"\"Generate comprehensive assessment report.\"\"\"\n        report = []\n        report.append(\"=\" * 70)\n        report.append(f\"OIL & GAS CYBERSECURITY ASSESSMENT REPORT\")\n        report.append(f\"Facility: {self.facility}\")\n        report.append(f\"Date: {datetime.now().strftime('%Y-%m-%d')}\")\n        report.append(\"=\" * 70)\n\n        # Findings summary\n        report.append(f\"\\nFINDINGS: {len(self.findings)}\")\n        for sev in [\"critical\", \"high\", \"medium\", \"low\"]:\n            count = sum(1 for f in self.findings if f.severity == sev)\n            if count:\n                report.append(f\"  {sev.upper()}: {count}\")\n\n        for f in self.findings:\n            report.append(f\"\\n  [{f.finding_id}] [{f.severity.upper()}] {f.title}\")\n            report.append(f\"    Category: {f.category}\")\n            report.append(f\"    {f.description}\")\n            report.append(f\"    Regulatory: {f.regulatory_reference}\")\n            report.append(f\"    Remediation: {f.remediation} ({f.timeline})\")\n\n        # Compliance summary\n        report.append(f\"\\n{'='*70}\")\n        report.append(\"TSA PIPELINE SECURITY DIRECTIVE COMPLIANCE\")\n        report.append(\"=\" * 70)\n        for c in self.compliance_checks:\n            icon = \"+\" if c.status == \"compliant\" else \"~\" if c.status == \"partial\" else \"-\"\n            report.append(f\"  [{icon}] {c.requirement_id}: {c.description}\")\n            report.append(f\"      Status: {c.status.upper()}\")\n            if c.gap:\n                report.append(f\"      Gap: {c.gap}\")\n\n        return \"\\n\".join(report)\n\n\nif __name__ == \"__main__\":\n    assessment = PipelineSCADAAssessment(\"Gulf Coast Refinery\")\n\n    assessment.assess_network_architecture({\n        \"it_ot_segmentation\": False,\n        \"rtu_comm_encrypted\": False,\n        \"remote_site_intrusion_detection\": False,\n    })\n\n    assessment.assess_custody_transfer({\n        \"flow_computer_auth\": False,\n    })\n\n    assessment.check_tsa_compliance()\n    print(assessment.generate_report())\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| API 1164 | American Petroleum Institute standard for Pipeline SCADA Security providing a risk-based framework for cybersecurity of pipeline control systems |\n| TSA Pipeline Security Directives | Mandatory cybersecurity requirements issued by TSA for pipeline operators including SD-01 (reporting) and SD-02 (implementation) |\n| Custody Transfer | Transfer of ownership of petroleum products between parties, requiring metering system integrity to prevent financial fraud |\n| DCS | Distributed Control System used in refineries for continuous process control with redundant controllers and operator stations |\n| Remote Terminal Unit (RTU) | Field device at remote pipeline sites that collects sensor data and executes control commands, communicating via radio\u002Fsatellite |\n| Safety Integrity Level (SIL) | IEC 61511 rating for safety instrumented functions, with SIL 1-4 defining probability of failure on demand |\n| HAZOP | Hazard and Operability Study identifying potential hazards in process design; cybersecurity should be integrated with HAZOP results |\n\n## Tools & Systems\n\n- **Dragos Platform**: OT cybersecurity platform with specific detection for oil and gas threat groups (XENOTIME, KAMACITE, ERYTHRITE)\n- **Claroty xDome**: Comprehensive asset discovery and vulnerability management for oil and gas OT environments\n- **Nozomi Guardian**: Network monitoring with support for pipeline protocols (DNP3, Modbus, IEC 60870-5-104)\n- **Honeywell Forge Cybersecurity**: OT security platform designed for Honeywell DCS environments common in refineries\n\n## Output Format\n\n```\nOil & Gas Cybersecurity Assessment Report\n==========================================\nFacility: [Name]\nSegment: Upstream \u002F Midstream \u002F Downstream\nDate: YYYY-MM-DD\nStandards: API 1164, TSA SD-02, IEC 62443\n\nFINDINGS:\n  Critical: [N]  High: [N]  Medium: [N]  Low: [N]\n\nCOMPLIANCE STATUS:\n  TSA SD-02: [N]% compliant\n  API 1164: [N]% compliant\n  IEC 62443: [N]% compliant\n```\n","# Performing Oil & Gas Cybersecurity Assessment\n\n## When to Use\n\n- When conducting a cybersecurity assessment of a refinery, pipeline, or production facility\n- When preparing for TSA Pipeline Security Directive compliance (SD-01, SD-02)\n- When assessing cybersecurity posture against API Standard 1164 (Pipeline SCADA Security)\n- When evaluating the security of remote wellhead SCADA systems and satellite communications\n- When a merger, acquisition, or regulatory audit requires a comprehensive OT security evaluation\n\n**Do not use** for IT-only corporate network assessments of oil and gas companies, for physical security assessments without a cyber component, or for environmental compliance assessments.\n\n## Prerequisites\n\n- Written authorization from facility management and operations team\n- Understanding of oil and gas operations (upstream, midstream, downstream processes)\n- Familiarity with API 1164, TSA SD-01\u002FSD-02, IEC 62443, and NIST CSF\n- Passive monitoring tools for OT network traffic capture\n- Access to network diagrams, SCADA architecture documentation, and safety studies (HAZOP)\n\n## Workflow\n\n### Step 1: Scope Assessment Based on Facility Type\n\nOil and gas facilities have unique characteristics based on their operational segment that affect the assessment approach.\n\n```yaml\n# Oil & Gas Cybersecurity Assessment Scope\nfacility:\n  name: \"Gulf Coast Refinery\"\n  segment: \"Downstream\"\n  capacity: \"250,000 barrels per day\"\n  regulatory: [\"TSA SD-02\", \"API 1164\", \"IEC 62443\", \"NIST CSF\"]\n\nassessment_areas:\n  process_control:\n    description: \"Refinery DCS and SCADA systems\"\n    systems:\n      - \"Honeywell Experion DCS - main process control\"\n      - \"Yokogawa CENTUM VP - hydrocracker unit\"\n      - \"Triconex SIS - emergency shutdown systems\"\n      - \"Allen-Bradley PLCs - utilities and tank farm\"\n    protocols: [\"Modbus\u002FTCP\", \"OPC UA\", \"HART\", \"Foundation Fieldbus\"]\n\n  pipeline_scada:\n    description: \"Pipeline SCADA for crude receipt and product dispatch\"\n    systems:\n      - \"ABB RTU560 - pipeline RTUs at pump stations\"\n      - \"GE iFIX SCADA - pipeline control center\"\n      - \"Flow computers - custody transfer metering\"\n    protocols: [\"DNP3\", \"Modbus RTU over serial\", \"IEC 60870-5-104\"]\n    communications: [\"Licensed radio\", \"Leased line\", \"Satellite (VSAT)\"]\n\n  safety_systems:\n    description: \"Safety Instrumented Systems and fire\u002Fgas detection\"\n    systems:\n      - \"Schneider Triconex 3008 - process SIS\"\n      - \"Honeywell FSC - fire and gas\"\n      - \"Combustion turbine protection systems\"\n    criticality: \"SIL 2\u002F3 rated - highest priority\"\n\n  remote_access:\n    description: \"Vendor and operator remote access to OT\"\n    methods:\n      - \"Citrix-based remote access to SCADA terminals\"\n      - \"VPN to vendor support for DCS maintenance\"\n      - \"Satellite communication to remote pump stations\"\n\n  physical_security:\n    description: \"Physical security integration with cyber\"\n    systems:\n      - \"Access control systems (badge readers)\"\n      - \"CCTV with IP network connectivity\"\n      - \"Perimeter intrusion detection\"\n\ncompliance_mapping:\n  tsa_sd_02:\n    - \"Implement network segmentation between IT and OT\"\n    - \"Develop and maintain a Cybersecurity Implementation Plan (CIP)\"\n    - \"Establish a Cybersecurity Assessment Program\"\n    - \"Report cybersecurity incidents to CISA within 24 hours\"\n    - \"Implement access control measures for critical OT systems\"\n  api_1164:\n    - \"Risk-based cybersecurity program for pipeline SCADA\"\n    - \"Asset identification and classification\"\n    - \"Network security and access control\"\n    - \"Personnel security and training\"\n    - \"Incident response and recovery\"\n```\n\n### Step 2: Assess Pipeline SCADA Security\n\nPipeline SCADA systems have unique challenges including long-distance communications over untrusted media, unmanned remote sites, and custody transfer integrity requirements.\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Pipeline SCADA Security Assessment Tool.\n\nEvaluates security of pipeline SCADA systems against\nAPI 1164 and TSA Pipeline Security Directive requirements.\n\"\"\"\n\nimport json\nimport sys\nfrom dataclasses import dataclass, field, asdict\nfrom datetime import datetime\n\n\n@dataclass\nclass AssessmentFinding:\n    finding_id: str\n    category: str\n    severity: str\n    title: str\n    description: str\n    affected_systems: list\n    regulatory_reference: str\n    remediation: str\n    timeline: str\n\n\n@dataclass\nclass ComplianceCheck:\n    requirement_id: str\n    description: str\n    standard: str\n    status: str  # compliant, partial, non-compliant\n    evidence: str\n    gap: str = \"\"\n\n\nclass PipelineSCADAAssessment:\n    \"\"\"Pipeline SCADA security assessment per API 1164 \u002F TSA SD-02.\"\"\"\n\n    def __init__(self, facility_name):\n        self.facility = facility_name\n        self.findings = []\n        self.compliance_checks = []\n        self.finding_counter = 1\n\n    def assess_network_architecture(self, architecture_data):\n        \"\"\"Evaluate pipeline SCADA network architecture.\"\"\"\n        checks = []\n\n        # TSA SD-02: Network segmentation between IT and OT\n        if not architecture_data.get(\"it_ot_segmentation\"):\n            self.findings.append(AssessmentFinding(\n                finding_id=f\"OG-{self.finding_counter:03d}\",\n                category=\"Network Architecture\",\n                severity=\"critical\",\n                title=\"No IT\u002FOT Network Segmentation\",\n                description=(\n                    \"Pipeline SCADA network is not segmented from corporate IT. \"\n                    \"An attacker compromising the corporate network could pivot \"\n                    \"directly to pipeline control systems.\"\n                ),\n                affected_systems=[\"Pipeline SCADA servers\", \"RTU communications\"],\n                regulatory_reference=\"TSA SD-02 Section 2.1; API 1164 Section 7\",\n                remediation=\"Deploy DMZ with industrial firewall between IT and pipeline SCADA\",\n                timeline=\"30 days\",\n            ))\n            self.finding_counter += 1\n\n        # Check for encrypted RTU communications\n        if architecture_data.get(\"rtu_comm_encrypted\") is False:\n            self.findings.append(AssessmentFinding(\n                finding_id=f\"OG-{self.finding_counter:03d}\",\n                category=\"Communication Security\",\n                severity=\"high\",\n                title=\"Unencrypted Pipeline RTU Communications\",\n                description=(\n                    \"DNP3 communications between control center and remote RTUs \"\n                    \"traverse radio\u002Fsatellite links without encryption. An attacker \"\n                    \"with radio access could intercept or inject SCADA commands.\"\n                ),\n                affected_systems=[\"Pipeline RTUs\", \"SCADA master station\"],\n                regulatory_reference=\"API 1164 Section 7.3; IEC 62351\",\n                remediation=\"Deploy DNP3 Secure Authentication or VPN tunnel for RTU links\",\n                timeline=\"90 days\",\n            ))\n            self.finding_counter += 1\n\n        # Check remote pump station physical security\n        if not architecture_data.get(\"remote_site_intrusion_detection\"):\n            self.findings.append(AssessmentFinding(\n                finding_id=f\"OG-{self.finding_counter:03d}\",\n                category=\"Physical-Cyber Convergence\",\n                severity=\"high\",\n                title=\"Remote Pump Stations Lack Physical Intrusion Detection\",\n                description=(\n                    \"Unmanned pump stations along the pipeline corridor lack physical \"\n                    \"intrusion detection systems. An attacker could gain physical access \"\n                    \"to RTUs and SCADA communication equipment without detection.\"\n                ),\n                affected_systems=[\"Remote pump station RTUs and networking equipment\"],\n                regulatory_reference=\"TSA SD-02 Section 2.3; API 1164 Section 10\",\n                remediation=\"Install intrusion detection with cellular alerting at remote sites\",\n                timeline=\"60 days\",\n            ))\n            self.finding_counter += 1\n\n    def assess_custody_transfer(self, metering_data):\n        \"\"\"Assess security of custody transfer metering systems.\"\"\"\n        if not metering_data.get(\"flow_computer_auth\"):\n            self.findings.append(AssessmentFinding(\n                finding_id=f\"OG-{self.finding_counter:03d}\",\n                category=\"Custody Transfer Integrity\",\n                severity=\"critical\",\n                title=\"Flow Computer Lacks Authentication\",\n                description=(\n                    \"Custody transfer flow computers accept unauthenticated Modbus \"\n                    \"commands allowing meter factor and flow calculation parameters \"\n                    \"to be modified. This could enable financial fraud through \"\n                    \"manipulation of custody transfer measurements.\"\n                ),\n                affected_systems=[\"Flow computers at custody transfer points\"],\n                regulatory_reference=\"API 1164 Section 8; API MPMS Chapter 21\",\n                remediation=\"Implement authenticated access to flow computers; deploy audit logging\",\n                timeline=\"45 days\",\n            ))\n            self.finding_counter += 1\n\n    def check_tsa_compliance(self):\n        \"\"\"Evaluate compliance with TSA Pipeline Security Directives.\"\"\"\n        tsa_requirements = [\n            ComplianceCheck(\"TSA-01\", \"Cybersecurity Coordinator designated\",\n                           \"TSA SD-01\", \"compliant\", \"CySec coordinator appointed\"),\n            ComplianceCheck(\"TSA-02\", \"Incident reporting to CISA within 24 hours\",\n                           \"TSA SD-01\", \"partial\", \"Process exists but not tested\",\n                           gap=\"Need tabletop exercise to validate reporting timeline\"),\n            ComplianceCheck(\"TSA-03\", \"Cybersecurity Implementation Plan\",\n                           \"TSA SD-02\", \"non-compliant\", \"No formal CIP exists\",\n                           gap=\"Develop and submit CIP to TSA within 90 days\"),\n            ComplianceCheck(\"TSA-04\", \"Network segmentation between IT and OT\",\n                           \"TSA SD-02\", \"non-compliant\", \"Flat network observed\",\n                           gap=\"Implement DMZ and zone-based segmentation\"),\n            ComplianceCheck(\"TSA-05\", \"Access control for critical OT systems\",\n                           \"TSA SD-02\", \"partial\", \"Shared accounts on SCADA\",\n                           gap=\"Implement individual accounts with role-based access\"),\n            ComplianceCheck(\"TSA-06\", \"Continuous monitoring and detection\",\n                           \"TSA SD-02\", \"non-compliant\", \"No OT IDS deployed\",\n                           gap=\"Deploy OT intrusion detection (Dragos\u002FNozomi\u002FClaroty)\"),\n            ComplianceCheck(\"TSA-07\", \"Patch management for critical systems\",\n                           \"TSA SD-02\", \"partial\", \"Ad hoc patching only\",\n                           gap=\"Establish formal OT patch management program\"),\n        ]\n        self.compliance_checks.extend(tsa_requirements)\n\n    def generate_report(self):\n        \"\"\"Generate comprehensive assessment report.\"\"\"\n        report = []\n        report.append(\"=\" * 70)\n        report.append(f\"OIL & GAS CYBERSECURITY ASSESSMENT REPORT\")\n        report.append(f\"Facility: {self.facility}\")\n        report.append(f\"Date: {datetime.now().strftime('%Y-%m-%d')}\")\n        report.append(\"=\" * 70)\n\n        # Findings summary\n        report.append(f\"\\nFINDINGS: {len(self.findings)}\")\n        for sev in [\"critical\", \"high\", \"medium\", \"low\"]:\n            count = sum(1 for f in self.findings if f.severity == sev)\n            if count:\n                report.append(f\"  {sev.upper()}: {count}\")\n\n        for f in self.findings:\n            report.append(f\"\\n  [{f.finding_id}] [{f.severity.upper()}] {f.title}\")\n            report.append(f\"    Category: {f.category}\")\n            report.append(f\"    {f.description}\")\n            report.append(f\"    Regulatory: {f.regulatory_reference}\")\n            report.append(f\"    Remediation: {f.remediation} ({f.timeline})\")\n\n        # Compliance summary\n        report.append(f\"\\n{'='*70}\")\n        report.append(\"TSA PIPELINE SECURITY DIRECTIVE COMPLIANCE\")\n        report.append(\"=\" * 70)\n        for c in self.compliance_checks:\n            icon = \"+\" if c.status == \"compliant\" else \"~\" if c.status == \"partial\" else \"-\"\n            report.append(f\"  [{icon}] {c.requirement_id}: {c.description}\")\n            report.append(f\"      Status: {c.status.upper()}\")\n            if c.gap:\n                report.append(f\"      Gap: {c.gap}\")\n\n        return \"\\n\".join(report)\n\n\nif __name__ == \"__main__\":\n    assessment = PipelineSCADAAssessment(\"Gulf Coast Refinery\")\n\n    assessment.assess_network_architecture({\n        \"it_ot_segmentation\": False,\n        \"rtu_comm_encrypted\": False,\n        \"remote_site_intrusion_detection\": False,\n    })\n\n    assessment.assess_custody_transfer({\n        \"flow_computer_auth\": False,\n    })\n\n    assessment.check_tsa_compliance()\n    print(assessment.generate_report())\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| API 1164 | American Petroleum Institute standard for Pipeline SCADA Security providing a risk-based framework for cybersecurity of pipeline control systems |\n| TSA Pipeline Security Directives | Mandatory cybersecurity requirements issued by TSA for pipeline operators including SD-01 (reporting) and SD-02 (implementation) |\n| Custody Transfer | Transfer of ownership of petroleum products between parties, requiring metering system integrity to prevent financial fraud |\n| DCS | Distributed Control System used in refineries for continuous process control with redundant controllers and operator stations |\n| Remote Terminal Unit (RTU) | Field device at remote pipeline sites that collects sensor data and executes control commands, communicating via radio\u002Fsatellite |\n| Safety Integrity Level (SIL) | IEC 61511 rating for safety instrumented functions, with SIL 1-4 defining probability of failure on demand |\n| HAZOP | Hazard and Operability Study identifying potential hazards in process design; cybersecurity should be integrated with HAZOP results |\n\n## Tools & Systems\n\n- **Dragos Platform**: OT cybersecurity platform with specific detection for oil and gas threat groups (XENOTIME, KAMACITE, ERYTHRITE)\n- **Claroty xDome**: Comprehensive asset discovery and vulnerability management for oil and gas OT environments\n- **Nozomi Guardian**: Network monitoring with support for pipeline protocols (DNP3, Modbus, IEC 60870-5-104)\n- **Honeywell Forge Cybersecurity**: OT security platform designed for Honeywell DCS environments common in refineries\n\n## Output Format\n\n```\nOil & Gas Cybersecurity Assessment Report\n==========================================\nFacility: [Name]\nSegment: Upstream \u002F Midstream \u002F Downstream\nDate: YYYY-MM-DD\nStandards: API 1164, TSA SD-02, IEC 62443\n\nFINDINGS:\n  Critical: [N]  High: [N]  Medium: [N]  Low: [N]\n\nCOMPLIANCE STATUS:\n  TSA SD-02: [N]% compliant\n  API 1164: [N]% compliant\n  IEC 62443: [N]% compliant\n```\n",{"name":5,"tags":49,"author":58,"domain":24,"license":15,"version":59,"nist_csf":60,"subdomain":65,"description":66,"mitre_attack":67},[50,51,52,53,54,55,56,57],"ot-security","ics","scada","industrial-control","iec62443","oil-gas","pipeline-security","api1164","mahipal","1.0.0",[61,62,63,64],"PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02","ot-ics-security","This skill covers conducting cybersecurity assessments specific to oil and gas facilities including upstream (exploration\u002Fproduction), midstream (pipeline\u002Ftransport), and downstream (refining\u002Fdistribution) operations. It addresses SCADA systems controlling pipeline operations, DCS for refinery process control, safety instrumented systems for hazardous processes, remote terminal units at unmanned wellhead sites, and compliance with API 1164, TSA Pipeline Security Directives, IEC 62443, and NIST Cybersecurity Framework for critical infrastructure.\n",[68,69,70,71,72],"T1078","T1190","T1059","T0816","T0836","main","7925716f065257435fdb12e97f7e52842147d5ad",".claude\u002Fskills\u002Fperforming-oil-gas-cybersecurity-assessment","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude","https:\u002F\u002Fclaude.com\u002Fclaude-code","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho","Software · Applied AI · Quantitative Modeling · Building with Claude.","2026-06-10 12:24:46",{"source":8,"skillName":5,"commands":82,"prompt":92,"zipAvailable":93},[83,86,89],{"tool":84,"command":85},"npx","npx skills add henriquescastilho\u002Fmy-claude --skill performing-oil-gas-cybersecurity-assessment",{"tool":87,"command":88},"bunx","bunx skills add henriquescastilho\u002Fmy-claude --skill performing-oil-gas-cybersecurity-assessment",{"tool":90,"command":91},"pnpm","pnpm dlx skills add henriquescastilho\u002Fmy-claude --skill performing-oil-gas-cybersecurity-assessment","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-oil-gas-cybersecurity-assessment\u002FSKILL.md",true,[95,100,106],{"path":96,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-oil-gas-cybersecurity-assessment\u002FLICENSE",{"path":101,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":104,"sourceHtmlUrl":105},"references\u002Fapi-reference.md","REFERENCE","参考文档",1567,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-oil-gas-cybersecurity-assessment\u002Freferences\u002Fapi-reference.md",{"path":107,"resourceType":108,"resourceTypeDesc":109,"sizeBytes":110,"sourceHtmlUrl":111},"scripts\u002Fagent.py","SCRIPT","脚本",7078,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-oil-gas-cybersecurity-assessment\u002Fscripts\u002Fagent.py",[113,154,163,172,194,219],{"skillNo":114,"name":115,"nameZh":6,"description":116,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":117,"licenseFileUrl":6,"sourceHtmlUrl":118,"categories":119,"keywords":134,"publishedAt":44},"01M6F0B6XPQ65AX2X0DWK8KT3E","markitdown","Convert files and office documents to Markdown. Supports PDF, DOCX, PPTX, XLSX, images (with OCR), audio (with transcription), HTML, CSV, JSON, XML, ZIP, YouTube URLs, EPubs and more.","MIT","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[120,123,126,129],{"categoryNo":121,"categoryName":122,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000002","文档处理",{"categoryNo":124,"categoryName":125,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":127,"categoryName":128,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000004","电子表格",{"categoryNo":130,"categoryName":131,"taxonomyType":132,"taxonomyTypeDesc":133},"01JBSEEDCAT000000000000034","行政与办公人员","PROFESSION","适用职业",[115,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153],"docx","PDF","pptx","xlsx","documents","csv","ocr","Audio","Bash","markdown","convert","read","write","edit","html","images","files","youtube","with",{"skillNo":155,"name":115,"nameZh":6,"description":116,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":117,"licenseFileUrl":6,"sourceHtmlUrl":156,"categories":157,"keywords":162,"publishedAt":44},"01M6F06SBHR9F0SDWE282Y8075","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fscientific_writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[158,159,160,161],{"categoryNo":121,"categoryName":122,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":124,"categoryName":125,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":127,"categoryName":128,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":130,"categoryName":131,"taxonomyType":132,"taxonomyTypeDesc":133},[115,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153],{"skillNo":164,"name":115,"nameZh":6,"description":116,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":117,"licenseFileUrl":6,"sourceHtmlUrl":165,"categories":166,"keywords":171,"publishedAt":44},"01M6F02D4R14EJAPBWVDF9J9VQ","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[167,168,169,170],{"categoryNo":121,"categoryName":122,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":124,"categoryName":125,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":127,"categoryName":128,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":130,"categoryName":131,"taxonomyType":132,"taxonomyTypeDesc":133},[115,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153],{"skillNo":173,"name":174,"nameZh":6,"description":175,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":117,"licenseFileUrl":6,"sourceHtmlUrl":176,"categories":177,"keywords":178,"publishedAt":44},"01M6F000KS6YB4MKS774G4R8ND","zarr-python","Chunked N-D arrays for cloud storage. Compressed arrays, parallel I\u002FO, S3\u002FGCS integration, NumPy\u002FDask\u002FXarray compatible, for large-scale scientific computing pipelines.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fzarr-python\u002FSKILL.md",[],[179,180,181,182,183,184,185,186,187,188,189,190,191,192,193],"python","zarr python","storage","integration","s3","gcs","cloud","dask","parallel","pipelines","arrays","numpy","scientific computing","scale","scientific",{"skillNo":195,"name":196,"nameZh":6,"description":197,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":117,"licenseFileUrl":6,"sourceHtmlUrl":198,"categories":199,"keywords":201,"publishedAt":44},"01M6EZZJWFXM1GR78KTW6J0DN8","what-if-oracle","Run structured What-If scenario analysis with multi-branch possibility exploration. Use this skill when the user asks speculative questions like \"what if...\", \"what would happen if...\", \"what are the possibilities\", \"explore scenarios\", \"scenario analysis\", \"possibility space\", \"what could go wrong\", \"best case \u002F worst case\", \"risk analysis\", \"contingency planning\", \"strategic options\", or any question about uncertain futures. Also trigger when the user faces a fork-in-the-road decision, wants to stress-test an idea, or needs to think through consequences before committing.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fwhat-if-oracle\u002FSKILL.md",[200],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[202,203,204,205,206,207,208,209,210,211,212,146,147,213,34,214,215,216,217,218],"oracle","what if oracle","go","run","ux","futures","analysis","explore","decision","branch","question","idea","options","stress-test","strategies","scenario","stress",{"skillNo":220,"name":221,"nameZh":6,"description":222,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":117,"licenseFileUrl":6,"sourceHtmlUrl":223,"categories":224,"keywords":235,"publishedAt":44},"01M6EZZCXAEB49RXGQCJX5E8GB","venue-templates","Access comprehensive LaTeX templates, formatting requirements, and submission guidelines for major scientific publication venues (Nature, Science, PLOS, IEEE, ACM), academic conferences (NeurIPS, ICML, CVPR, CHI), research posters, and grant proposals (NSF, NIH, DOE, DARPA). This skill should be used when preparing manuscripts for journal submission, conference papers, research posters, or grant proposals and need venue-specific formatting requirements and templates.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fvenue-templates\u002FSKILL.md",[225,228,231,232],{"categoryNo":226,"categoryName":227,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":229,"categoryName":230,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":233,"categoryName":234,"taxonomyType":132,"taxonomyTypeDesc":133},"01JBSEEDCAT000000000000036","内容创作者",[236,237,238,239,240,241,242,243,143,244,146,147,148,245,246,247,248,249,193,250],"templates","venue templates","research","guidelines","NeurIPS","ICML","LaTeX","science","access","proposals","Academic","requirements","formatting","journal","chi"]