[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6FS3Z0WDGXPCPVMEQBB6MXE":3,"skill-same:01M6FS3Z0WDGXPCPVMEQBB6MXE":59},{"skillNo":4,"name":5,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":6,"repositoryNo":11,"starsCount":12,"licenseSpdxId":13,"licenseFileUrl":6,"sourceHtmlUrl":14,"categories":15,"keywords":16,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":24,"commitSha":25,"skillDirectory":26,"forksCount":27,"repositoryHtmlUrl":28,"repositoryHomepageUrl":6,"ownerHtmlUrl":29,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":30,"install":31,"resources":44},"01M6FS3Z0WDGXPCPVMEQBB6MXE","secops-by-joes",null,"kbarbel640-del\u002Fskills","kbarbel640-del","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F255315490?v=4","01M6CJPPQGCCESXMG3K7BBGQ5J","01M6CJPPX2PB2BCZERFVM2C2B3",1,"MIT","https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Finaor\u002Fsecops-by-joes\u002FSKILL.md",[],[17,18],"secops","secops by joes","2026-11-10 10:12:30",false,"---\r\nname: Security Joes AI Analyst\r\ndescription: SecOps checks for endpoints: EDR, Sysmon, updates, EVTX on heartbeat, least privilege, network visibility, credential protection (Kerberos\u002FNTLM\u002Fpass-the-hash), device inventory and known vulnerabilities, weekly assessment, and skill integrity (hash-on-wake, version-aware). Use when implementing or reviewing host posture, heartbeat logic, EDR\u002FSysmon\u002FEVTX, privilege, network exposure, credential hardening, vuln assessment, weekly SecOps review, or skill compromise checks.\r\nversion: 1.0.0\r\nauthor: Security Joes\r\nauthorUrl: https:\u002F\u002Fwww.securityjoes.com\r\nhomepage: https:\u002F\u002Fwww.securityjoes.com\r\nlicense: MIT\r\nmetadata:\r\n  openclaw:\r\n    emoji: \"?\"\r\n    category: \"security\"\r\ntags:\r\n  - security\r\n  - secops\r\n  - clawhub\r\n  - edr\r\n  - sysmon\r\n  - evtx\r\n---\r\n\r\n# Security Joes AI Analyst\r\n\r\nYou guide and implement SecOps checks for endpoints. Focus: **EDR**, **Sysmon**, **updates**, **EVTX on heartbeat**, **least privilege**, **network visibility**, **credential protection** (Kerberos\u002FNTLM\u002Fpass-the-hash), **device inventory and known vulnerabilities**, and **weekly assessment**. Targets Windows; use PowerShell\u002FWMI\u002Fregistry and EVTX where appropriate.\r\n\r\n## Responsibilities\r\n\r\n1. **EDR sensor** – Detect at least one EDR (Defender, CrowdStrike, etc.). Report presence\u002Fabsence and basic health.\r\n2. **Sysmon** – Confirm Sysmon is installed and logging; identify log location (typically EVTX).\r\n3. **System up-to-date** – Check OS\u002Fbuild and patch level; report stale if beyond policy (e.g. 30+ days).\r\n4. **Heartbeat + EVTX** – On heartbeat, query Security\u002FSysmon\u002FDefender EVTX for recent alerts; attach summary or raise alert.\r\n5. **Least privilege** – Check if the device\u002Fuser runs with least privilege (not admin, UAC\u002Ftoken elevation as expected).\r\n6. **Network visibility** – What other networks\u002Finterfaces the device sees (interfaces, ARP, WiFi, domain trust, net view\u002Fsession).\r\n7. **Credential protection (network level)** – Kerberos\u002FNTLM hardening and pass-the-hash resistance (SMB signing, LDAP signing, NTLM restrictions, Credential Guard).\r\n8. **Device details and known vulnerabilities** – Inventory OS, patches, installed software; correlate with known CVEs or vuln data for assessment.\r\n9. **Weekly assessment** – Run a full SecOps checklist weekly; produce assessment report and optionally emit as event.\r\n10. **Skill integrity** – On first wake, hash this skill and other known skills; store hashes. On each wake, re-hash and compare; use version changes to treat upgrades vs compromise and alert on unexpected changes.\r\n\r\n## When to apply\r\n\r\n- User asks for host posture, endpoint health, “is this machine secure?”, or weekly SecOps review.\r\n- Implementing or extending collector\u002Fheartbeat logic.\r\n- User mentions EDR, Sysmon, EVTX, least privilege, network exposure, Kerberos, pass-the-hash, credential protection, vulnerabilities, weekly assessment, or skill integrity \u002F compromise check.\r\n- Reviewing or designing what “healthy endpoint” means for the dashboard.\r\n\r\n---\r\n\r\n## 1. EDR sensor checks\r\n\r\n**Microsoft Defender**\r\n\r\n- Service: `WinDefend` (Get-Service WinDefend).\r\n- Optional: `Get-MpComputerStatus` (or `MpCmdRun.exe -GetStatus`) for signature version and real-time protection state.\r\n- Registry (if needed): `HKLM\\SOFTWARE\\Microsoft\\Windows Defender` and related product state keys.\r\n\r\n**CrowdStrike Falcon**\r\n\r\n- Service: `CsAgent` (Get-Service CsAgent -ErrorAction SilentlyContinue).\r\n- Registry: `HKLM\\SYSTEM\\CurrentControlSet\\Services\\CsAgent` or Falcon-specific keys under `HKLM\\SOFTWARE\\CrowdStrike`.\r\n\r\n**Others (SentinelOne, Carbon Black, etc.)**\r\n\r\n- Prefer service name + optional registry\u002Fprocess check. Document which EDR is “primary” for the environment.\r\n\r\n**Output**\r\n\r\n- At least: `edr_present: true|false`, `edr_name: \"Defender\"|\"CrowdStrike\"|...`, optional `edr_healthy: true|false` (e.g. service running, real-time on).\r\n\r\n---\r\n\r\n## 2. Sysmon\r\n\r\n- **Service**: `Sysmon64` or `Sysmon` (Get-Service Sysmon64, Sysmon -ErrorAction SilentlyContinue).\r\n- **Log**: Usually EVTX – `Microsoft-Windows-Sysmon%4Operational` under `C:\\Windows\\System32\\winevt\\Logs\\` (path: `...\\Microsoft-Windows-Sysmon%4Operational.evtx`).\r\n- **Config**: Optional – check for Sysmon config (e.g. `Sysmon64 -s` or known config path) to confirm logging scope.\r\n\r\n**Output**\r\n\r\n- `sysmon_installed: true|false`, `sysmon_log_path: \"...\"` (if available), optional `sysmon_service_running: true|false`.\r\n\r\n---\r\n\r\n## 3. System up-to-date\r\n\r\n- **Quick**: `Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 1` for last patch date; or `(Get-ItemProperty \"HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\").CurrentBuild` (and optionally UB R) for build.\r\n- **Stricter**: Windows Update status – e.g. WMI `Win32_QuickFixEngineering` or COM `Microsoft.Update.Session` to see last install time \u002F pending reboots.\r\n- **Policy**: Define “stale” (e.g. no patch in 30+ days or build behind current branch) and report `up_to_date: true|false` and optional `last_patch_date` or `build`.\r\n\r\n---\r\n\r\n## 4. Heartbeat and EVTX alerts\r\n\r\nOn **heartbeat** (or on a scheduled check that aligns with heartbeats):\r\n\r\n1. **Which EVTX**\r\n   - Security: `C:\\Windows\\System32\\winevt\\Logs\\Security.evtx`\r\n   - Sysmon: `Microsoft-Windows-Sysmon%4Operational.evtx`\r\n   - Microsoft-Windows-Windows Defender\u002FOperational (Defender alerts)\r\n   - Optional: Application, System for context.\r\n\r\n2. **What to look for**\r\n   - Security: logon failures (e.g. 4625), sensitive privilege use (4672, 4688), account lockout, etc.\r\n   - Sysmon: creation of executables in temp, suspicious parent\u002Fchild, etc. (event IDs depend on config).\r\n   - Defender: detection events (e.g. 1116, 1117), threats (1006, 1015).\r\n   - Prefer time-bounded queries (e.g. last N minutes since previous heartbeat or last 24h) to avoid overload.\r\n\r\n3. **Implementation options**\r\n   - PowerShell: `Get-WinEvent -FilterHashtable @{ LogName='Security'; StartTime=$since }` (and similar for Sysmon\u002FDefender).\r\n   - Or use a small script\u002Ftool that reads EVTX and outputs a compact JSON (event IDs, time, count) for the collector to emit as `details` or as an alert.\r\n\r\n4. **Emit**\r\n   - Attach to heartbeat `details` (e.g. `evtx_alert_count`, `evtx_summary[]`) or raise an **alert** event when thresholds are exceeded (e.g. > N failures, or any Defender detection).\r\n\r\n---\r\n\r\n## 5. Least privilege\r\n\r\nCheck whether the device\u002Fuser runs with least privilege (not over-privileged).\r\n\r\n- **Current user elevation**: `whoami \u002Fgroups` to see group membership; token elevation type via `(Get-Process -Id $PID).StartInfo.Verb` or WMI\u002FCIM. For elevation: check if process token has elevation (e.g. `[System.Security.Principal.WindowsIdentity]::GetCurrent().Groups` and look for S-1-16-12288 = High Mandatory Level).\r\n- **Admin membership**: `net localgroup Administrators` (or `Get-LocalGroupMember -Group Administrators`) – report if the current user or common service accounts are in Administrators.\r\n- **UAC**: Registry `HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA` = 1 (UAC on). Optional: ConsentPromptBehaviorAdmin, PromptOnSecureDesktop.\r\n- **Privileged sessions**: Optional – check for RDP\u002Fadmin logons (Security EVTX 4624, logon type 10) and whether interactive admin is expected.\r\n\r\n**Output**\r\n\r\n- `least_privilege: true|false`, `current_user_elevated: true|false`, `in_local_admins: true|false`, optional `uac_enabled: true|false`.\r\n\r\n---\r\n\r\n## 6. Network visibility (what networks the device sees)\r\n\r\nAssess what networks and neighbors the device can see (exposure and lateral movement surface).\r\n\r\n- **Interfaces**: `Get-NetAdapter`, `Get-NetIPAddress` – list adapters, IPs, gateways. Optional: `Get-NetRoute`.\r\n- **ARP table**: `Get-NetNeighbor` or `arp -a` – what other hosts the device has recently talked to (L2\u002FL3 neighbors).\r\n- **WiFi**: `netsh wlan show networks` or `Get-NetAdapter | Where-Object {$_.InterfaceDescription -match 'Wi-Fi'}` plus WLAN profile – SSIDs the device sees or is configured for.\r\n- **Domain \u002F trust**: `systeminfo`, `nltest \u002Fdomain_trusts` (or Get-ADDomainTrust if RSAT) – domain membership and trust relationships.\r\n- **Net view \u002F session**: `net view` (browsed shares), `net session` (who is connected to this box) – optional; may require admin. Use to see “who can this device see” and “who is using this device.”\r\n\r\n**Output**\r\n\r\n- `interfaces[]` (name, IP, gateway), `arp_count` or `neighbors_count`, optional `wifi_ssids[]`, `domain_member: true|false`, `domain_name`, `trusts[]`, optional `net_view_count` \u002F `net_session_count`.\r\n\r\n---\r\n\r\n## 7. Credential protection (network level – Kerberos, NTLM, pass-the-hash)\r\n\r\nCheck network-level credential hardening to resist Kerberos\u002FNTLM abuse and pass-the-hash.\r\n\r\n- **SMB signing**: `Get-SmbClientConfiguration` (RequireSecuritySignature) and `Get-SmbServerConfiguration` (RequireSecuritySignature, EnableSecuritySignature). Prefer **required** on server and client where possible to mitigate NTLM relay.\r\n- **LDAP signing \u002F channel binding**: Domain controllers – LDAP signing (e.g. `HKLM\\SYSTEM\\CurrentControlSet\\Services\\NTDS\\Parameters\\LDAPServerIntegrity`), LDAP channel binding. Client-side: check if environment enforces signed LDAP.\r\n- **NTLM restrictions**: `HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa`: LmCompatibilityLevel (e.g. 5+ to avoid NTLMv1), RestrictNTLMInDomain \u002F RestrictNTLMOutbound if available. NTLM audit or block policies (RestrictNTLMInDomain = 1, 2, 3).\r\n- **Credential Guard \u002F LSA protection**: `Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\\Microsoft\\Windows\\DeviceGuard` or registry `HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\LsaCfgFlags` – Credential Guard (1) and\u002For LSA run as Protected Process Light to protect hashes in memory.\r\n- **Pass-the-hash**: Mitigations above (Credential Guard, LSA protection, NTLM restrictions) reduce pass-the-hash; report “credential protection” as a summary (e.g. Credential Guard on, SMB signing required, NTLM restricted).\r\n\r\n**Output**\r\n\r\n- `smb_signing_required_client: true|false`, `smb_signing_required_server: true|false`, optional `ldap_signing`, `lm_compat_level`, `credential_guard: true|false`, `lsa_protected: true|false`, `credential_protection_summary: \"strong|partial|weak\"`.\r\n\r\n---\r\n\r\n## 8. Device details and known vulnerabilities\r\n\r\nInventory device and correlate with known vulnerabilities for assessment.\r\n\r\n- **OS and build**: `Get-ItemProperty \"HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\"` – ProductName, CurrentBuild, UBR, DisplayVersion. Optional: `Get-ComputerInfo`.\r\n- **Patches**: `Get-HotFix` or WMI `Win32_QuickFixEngineering` – list KBs and InstalledOn. Use for “last patch date” and to cross-reference with CVE data.\r\n- **Installed software**: `Get-ItemProperty HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*`, `HKLM:\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*` – DisplayName, DisplayVersion, Publisher. Avoid `Get-WmiObject Win32_Product` (slow and triggers reconfigure). Use for vulnerable software inventory.\r\n- **Known vulnerabilities**: Cross-reference OS build and installed product versions with a vulnerability source (e.g. NVD, OSV, vendor advisories, or internal vuln DB). Check for: end-of-life OS, unpatched KBs for known CVEs, outdated browsers\u002FRDP\u002FOpenSSL\u002Fetc. Report count or list of “known vulns” (CVE IDs and severity) without dumping full CPE if not needed.\r\n\r\n**Output**\r\n\r\n- `os_name`, `os_build`, `last_patch_date`, `hotfix_count`, optional `installed_products[]` (name, version), `known_vuln_count`, optional `known_vulns[]` (cve_id, severity, product).\r\n\r\n---\r\n\r\n## 9. Weekly assessment\r\n\r\nConduct a **weekly** SecOps assessment: run the full checklist and produce a report (and optionally emit an event).\r\n\r\n**Checklist (run weekly)**\r\n\r\n- [ ] EDR sensor present and healthy (section 1)\r\n- [ ] Sysmon installed and logging (section 2)\r\n- [ ] System up-to-date (section 3)\r\n- [ ] EVTX: recent alerts summary (section 4)\r\n- [ ] Least privilege (section 5)\r\n- [ ] Network visibility: interfaces, neighbors, domain\u002Ftrust (section 6)\r\n- [ ] Credential protection: SMB\u002FLDAP\u002FNTLM\u002FCredential Guard (section 7)\r\n- [ ] Device inventory and known vulnerabilities (section 8)\r\n- [ ] Skill integrity: hashes match or version-bumped (section 10)\r\n\r\n**Workflow**\r\n\r\n1. Run all checks (or call scripts that aggregate them).\r\n2. Produce **weekly assessment report** using the Host posture report template (below), extended with network, credential, and vuln sections.\r\n3. Optionally emit a dedicated event: `type: 'weekly_assessment'` (or `config_change` with details.assessment = true), with summary and `details` containing aggregate results (counts, booleans, no PII). Dashboard or rules can surface “last weekly assessment” and failures.\r\n\r\n**Schedule**\r\n\r\n- Trigger weekly (e.g. cron\u002FTask Scheduler or collector job every 7 days). Store last run time to avoid duplicate runs in the same week.\r\n\r\n---\r\n\r\n## 10. Skill integrity (hash on wake, version-aware)\r\n\r\nOn **first wake** (when this skill is first applied or when no stored hashes exist), hash this skill and all other known skills; store the hashes. On **each wake**, re-hash and compare to stored hashes. Use **version** in skill frontmatter to distinguish **upgrades** (intentional version change) from **compromise** (hash changed but version unchanged or missing).\r\n\r\n**Scope**\r\n\r\n- **What to hash**: Each known skill directory under `.cursor\u002Fskills\u002F` (project) or `~\u002F.cursor\u002Fskills\u002F` (personal). Per skill: `SKILL.md` (required), and optionally `reference.md`, `examples.md` (if present). Do not hash `scripts\u002F` contents unless you explicitly include them; prefer SKILL.md + optional reference\u002Fexamples for a stable baseline.\r\n- **Algorithm**: SHA-256 of file contents (UTF-8 or raw bytes consistently). Normalize line endings (e.g. LF) before hashing if skills may be edited on different OSes.\r\n\r\n**Storage**\r\n\r\n- **Path**: Project scope: `.cursor\u002Fskills\u002F.skill-integrity.json`. Personal scope: `~\u002F.cursor\u002Fskills\u002F.skill-integrity.json` (or one file that lists both project and personal paths). Do not commit `.skill-integrity.json` to version control if it contains machine-specific or sensitive metadata; add to `.gitignore` or keep local-only.\r\n- **Format** (per skill, keyed by skill name or relative path):\r\n\r\n```json\r\n{\r\n  \"skills\": {\r\n    \"security-joes-ai-analyst\": {\r\n      \"version\": \"1.0\",\r\n      \"fileHashes\": {\r\n        \"SKILL.md\": \"sha256hex...\",\r\n        \"reference.md\": \"sha256hex...\"\r\n      },\r\n      \"lastChecked\": \"ISO8601\"\r\n    }\r\n  },\r\n  \"firstRun\": \"ISO8601\"\r\n}\r\n```\r\n\r\n**First wake**\r\n\r\n1. Enumerate all skill directories (project `.cursor\u002Fskills\u002F*`, optionally personal `~\u002F.cursor\u002Fskills\u002F*`).\r\n2. For each skill: read `version` from SKILL.md frontmatter (if present). Compute SHA-256 for SKILL.md and any reference.md\u002Fexamples.md.\r\n3. Write `.skill-integrity.json` with `skills`, `firstRun`, and `lastChecked` = now.\r\n\r\n**Each wake**\r\n\r\n1. Load `.skill-integrity.json` (if missing, treat as first wake and run first-wake steps).\r\n2. Enumerate the same skill directories; for each skill, read current `version` from frontmatter and compute current hashes for SKILL.md (and optional reference\u002Fexamples).\r\n3. **Compare**:\r\n   - **Hash match**: No change. Update `lastChecked` for that skill.\r\n   - **Hash mismatch + version in file changed**: Treat as **upgrade**. Update stored `version` and `fileHashes` for that skill; update `lastChecked`. Do not alert.\r\n   - **Hash mismatch + version unchanged or missing**: Treat as **potential compromise**. Do not overwrite stored hashes with the new ones. Emit an **alert** (e.g. “Skill integrity: [skill name] content changed without version bump – possible tampering”). Optionally record in details: skill name, which file(s) changed (hash diff), stored version vs current version.\r\n4. **New skill** (present on disk but not in stored hashes): On first wake for that skill, add it to storage with current version and hashes. Do not treat as compromise.\r\n\r\n**Version in frontmatter**\r\n\r\n- Skills should include `version: \"x.y\"` in YAML frontmatter. When you **intentionally upgrade** a skill, bump the version (e.g. `1.0` → `1.1`) so the next wake treats the hash change as an upgrade, not compromise.\r\n- If a skill has no `version` field, any hash change is treated as potential compromise (no way to distinguish upgrade).\r\n\r\n**Output**\r\n\r\n- On each wake: `skill_integrity: ok | compromised | upgraded`. If compromised: list skills (and optionally files) with unexpected changes. Do not log full file contents; only hashes and version.\r\n\r\n**Integration**\r\n\r\n- Run this check when the agent “wakes” (e.g. at start of a session or when this skill is first applied). Optionally include skill integrity in the **weekly assessment** checklist (section 9). Emit MoltSOC **alert** on compromise (type: `alert`, severity: high, summary like “Skill integrity: unexpected change in [skill]”, details with skill name and which hashes changed).\r\n\r\n---\r\n\r\n## Host posture report template\r\n\r\nWhen producing a host posture, heartbeat summary, or weekly assessment, use a structure like:\r\n\r\n```markdown\r\n## Host posture – [host_id]\r\n\r\n- **EDR:** [present\u002Fabsent] – [name], [healthy\u002Funhealthy]\r\n- **Sysmon:** [installed\u002Fnot installed], log: [path or N\u002FA], service: [running\u002Fstopped]\r\n- **Updates:** [up_to_date\u002Fstale], last patch: [date], build: [optional]\r\n- **EVTX (since last heartbeat):** [count or summary], alerts: [brief list or \"none\"]\r\n- **Least privilege:** [yes\u002Fno] – elevated: [yes\u002Fno], in local admins: [yes\u002Fno], UAC: [on\u002Foff]\r\n- **Networks:** interfaces: [count], neighbors\u002FARP: [count], domain: [name or N\u002FA], trusts: [brief]\r\n- **Credential protection:** SMB signing: [required\u002Foptional], Credential Guard: [on\u002Foff], NTLM: [restricted\u002Faudit\u002Foff], summary: [strong\u002Fpartial\u002Fweak]\r\n- **Device & vulns:** OS: [name build], products: [count], known vulns: [count] – [brief list or \"none\"]\r\n- **Weekly assessment:** last run: [date], result: [pass\u002Ffail], failures: [brief list or \"none\"]\r\n- **Skill integrity:** [ok\u002Fcompromised\u002Fupgraded], last check: [date], unexpected: [skill names or \"none\"]\r\n```\r\n\r\n---\r\n\r\n## Integration with MoltSOC\r\n\r\n- Heartbeat events already exist (`type: 'heartbeat'`). Extend `details` with EDR\u002FSysmon\u002Fupdate\u002FEVTX, least privilege, network visibility, credential protection, and vuln summary so the dashboard or rules can show “endpoint healthy” or specific failures.\r\n- New **alerts** (e.g. “EDR missing”, “Sysmon stopped”, “EVTX detection”, “over-privileged”, “credential protection weak”, “known vulns”, **“Skill integrity: unexpected change in [skill]”**) follow the same event schema (type: `alert`, severity, summary, details with rule\u002Fevidence).\r\n- **Skill integrity**: On compromise (hash change without version bump), emit alert with skill name and which file hashes changed; do not include file contents.\r\n- **Weekly assessment**: Emit `type: 'weekly_assessment'` (or `config_change` with `details.assessment: true`) with aggregate results; dashboard can show “last weekly assessment” and failed checks.\r\n- Prefer **metadata-only** in events (counts, booleans, event IDs, timestamps); do not log raw payloads, PII, or full network\u002FARP tables in event details.\r\n\r\n---\r\n\r\n## Privacy and safety\r\n\r\n- Do not include raw log content or PII in events; use counts, event IDs, and short summaries.\r\n- EVTX queries should be scoped to security-relevant channels and time windows; avoid dumping full logs into the collector.\r\n- For network visibility and vuln output: report counts and summaries (e.g. neighbor count, vuln count); do not dump full ARP tables, SSID lists, or CPE\u002Fvuln payloads unless needed for a specific alert.\r\n\r\n---\r\n\r\n## About Security Joes\r\n\r\n[Security Joes](https:\u002F\u002Fwww.securityjoes.com) provides SecOps guidance, endpoint visibility, and security analyst workflows for agents and automation. This skill (Security Joes AI Analyst) is maintained by Security Joes for use with ClawHub and compatible agent platforms.\r\n\r\n- **Website:** [https:\u002F\u002Fwww.securityjoes.com](https:\u002F\u002Fwww.securityjoes.com)\r\n- **About:** [https:\u002F\u002Fwww.securityjoes.com\u002Fabout](https:\u002F\u002Fwww.securityjoes.com\u002Fabout)\r\n","# Security Joes AI Analyst\r\n\r\nYou guide and implement SecOps checks for endpoints. Focus: **EDR**, **Sysmon**, **updates**, **EVTX on heartbeat**, **least privilege**, **network visibility**, **credential protection** (Kerberos\u002FNTLM\u002Fpass-the-hash), **device inventory and known vulnerabilities**, and **weekly assessment**. Targets Windows; use PowerShell\u002FWMI\u002Fregistry and EVTX where appropriate.\r\n\r\n## Responsibilities\r\n\r\n1. **EDR sensor** – Detect at least one EDR (Defender, CrowdStrike, etc.). Report presence\u002Fabsence and basic health.\r\n2. **Sysmon** – Confirm Sysmon is installed and logging; identify log location (typically EVTX).\r\n3. **System up-to-date** – Check OS\u002Fbuild and patch level; report stale if beyond policy (e.g. 30+ days).\r\n4. **Heartbeat + EVTX** – On heartbeat, query Security\u002FSysmon\u002FDefender EVTX for recent alerts; attach summary or raise alert.\r\n5. **Least privilege** – Check if the device\u002Fuser runs with least privilege (not admin, UAC\u002Ftoken elevation as expected).\r\n6. **Network visibility** – What other networks\u002Finterfaces the device sees (interfaces, ARP, WiFi, domain trust, net view\u002Fsession).\r\n7. **Credential protection (network level)** – Kerberos\u002FNTLM hardening and pass-the-hash resistance (SMB signing, LDAP signing, NTLM restrictions, Credential Guard).\r\n8. **Device details and known vulnerabilities** – Inventory OS, patches, installed software; correlate with known CVEs or vuln data for assessment.\r\n9. **Weekly assessment** – Run a full SecOps checklist weekly; produce assessment report and optionally emit as event.\r\n10. **Skill integrity** – On first wake, hash this skill and other known skills; store hashes. On each wake, re-hash and compare; use version changes to treat upgrades vs compromise and alert on unexpected changes.\r\n\r\n## When to apply\r\n\r\n- User asks for host posture, endpoint health, “is this machine secure?”, or weekly SecOps review.\r\n- Implementing or extending collector\u002Fheartbeat logic.\r\n- User mentions EDR, Sysmon, EVTX, least privilege, network exposure, Kerberos, pass-the-hash, credential protection, vulnerabilities, weekly assessment, or skill integrity \u002F compromise check.\r\n- Reviewing or designing what “healthy endpoint” means for the dashboard.\r\n\r\n---\r\n\r\n## 1. EDR sensor checks\r\n\r\n**Microsoft Defender**\r\n\r\n- Service: `WinDefend` (Get-Service WinDefend).\r\n- Optional: `Get-MpComputerStatus` (or `MpCmdRun.exe -GetStatus`) for signature version and real-time protection state.\r\n- Registry (if needed): `HKLM\\SOFTWARE\\Microsoft\\Windows Defender` and related product state keys.\r\n\r\n**CrowdStrike Falcon**\r\n\r\n- Service: `CsAgent` (Get-Service CsAgent -ErrorAction SilentlyContinue).\r\n- Registry: `HKLM\\SYSTEM\\CurrentControlSet\\Services\\CsAgent` or Falcon-specific keys under `HKLM\\SOFTWARE\\CrowdStrike`.\r\n\r\n**Others (SentinelOne, Carbon Black, etc.)**\r\n\r\n- Prefer service name + optional registry\u002Fprocess check. Document which EDR is “primary” for the environment.\r\n\r\n**Output**\r\n\r\n- At least: `edr_present: true|false`, `edr_name: \"Defender\"|\"CrowdStrike\"|...`, optional `edr_healthy: true|false` (e.g. service running, real-time on).\r\n\r\n---\r\n\r\n## 2. Sysmon\r\n\r\n- **Service**: `Sysmon64` or `Sysmon` (Get-Service Sysmon64, Sysmon -ErrorAction SilentlyContinue).\r\n- **Log**: Usually EVTX – `Microsoft-Windows-Sysmon%4Operational` under `C:\\Windows\\System32\\winevt\\Logs\\` (path: `...\\Microsoft-Windows-Sysmon%4Operational.evtx`).\r\n- **Config**: Optional – check for Sysmon config (e.g. `Sysmon64 -s` or known config path) to confirm logging scope.\r\n\r\n**Output**\r\n\r\n- `sysmon_installed: true|false`, `sysmon_log_path: \"...\"` (if available), optional `sysmon_service_running: true|false`.\r\n\r\n---\r\n\r\n## 3. System up-to-date\r\n\r\n- **Quick**: `Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 1` for last patch date; or `(Get-ItemProperty \"HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\").CurrentBuild` (and optionally UB R) for build.\r\n- **Stricter**: Windows Update status – e.g. WMI `Win32_QuickFixEngineering` or COM `Microsoft.Update.Session` to see last install time \u002F pending reboots.\r\n- **Policy**: Define “stale” (e.g. no patch in 30+ days or build behind current branch) and report `up_to_date: true|false` and optional `last_patch_date` or `build`.\r\n\r\n---\r\n\r\n## 4. Heartbeat and EVTX alerts\r\n\r\nOn **heartbeat** (or on a scheduled check that aligns with heartbeats):\r\n\r\n1. **Which EVTX**\r\n   - Security: `C:\\Windows\\System32\\winevt\\Logs\\Security.evtx`\r\n   - Sysmon: `Microsoft-Windows-Sysmon%4Operational.evtx`\r\n   - Microsoft-Windows-Windows Defender\u002FOperational (Defender alerts)\r\n   - Optional: Application, System for context.\r\n\r\n2. **What to look for**\r\n   - Security: logon failures (e.g. 4625), sensitive privilege use (4672, 4688), account lockout, etc.\r\n   - Sysmon: creation of executables in temp, suspicious parent\u002Fchild, etc. (event IDs depend on config).\r\n   - Defender: detection events (e.g. 1116, 1117), threats (1006, 1015).\r\n   - Prefer time-bounded queries (e.g. last N minutes since previous heartbeat or last 24h) to avoid overload.\r\n\r\n3. **Implementation options**\r\n   - PowerShell: `Get-WinEvent -FilterHashtable @{ LogName='Security'; StartTime=$since }` (and similar for Sysmon\u002FDefender).\r\n   - Or use a small script\u002Ftool that reads EVTX and outputs a compact JSON (event IDs, time, count) for the collector to emit as `details` or as an alert.\r\n\r\n4. **Emit**\r\n   - Attach to heartbeat `details` (e.g. `evtx_alert_count`, `evtx_summary[]`) or raise an **alert** event when thresholds are exceeded (e.g. > N failures, or any Defender detection).\r\n\r\n---\r\n\r\n## 5. Least privilege\r\n\r\nCheck whether the device\u002Fuser runs with least privilege (not over-privileged).\r\n\r\n- **Current user elevation**: `whoami \u002Fgroups` to see group membership; token elevation type via `(Get-Process -Id $PID).StartInfo.Verb` or WMI\u002FCIM. For elevation: check if process token has elevation (e.g. `[System.Security.Principal.WindowsIdentity]::GetCurrent().Groups` and look for S-1-16-12288 = High Mandatory Level).\r\n- **Admin membership**: `net localgroup Administrators` (or `Get-LocalGroupMember -Group Administrators`) – report if the current user or common service accounts are in Administrators.\r\n- **UAC**: Registry `HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA` = 1 (UAC on). Optional: ConsentPromptBehaviorAdmin, PromptOnSecureDesktop.\r\n- **Privileged sessions**: Optional – check for RDP\u002Fadmin logons (Security EVTX 4624, logon type 10) and whether interactive admin is expected.\r\n\r\n**Output**\r\n\r\n- `least_privilege: true|false`, `current_user_elevated: true|false`, `in_local_admins: true|false`, optional `uac_enabled: true|false`.\r\n\r\n---\r\n\r\n## 6. Network visibility (what networks the device sees)\r\n\r\nAssess what networks and neighbors the device can see (exposure and lateral movement surface).\r\n\r\n- **Interfaces**: `Get-NetAdapter`, `Get-NetIPAddress` – list adapters, IPs, gateways. Optional: `Get-NetRoute`.\r\n- **ARP table**: `Get-NetNeighbor` or `arp -a` – what other hosts the device has recently talked to (L2\u002FL3 neighbors).\r\n- **WiFi**: `netsh wlan show networks` or `Get-NetAdapter | Where-Object {$_.InterfaceDescription -match 'Wi-Fi'}` plus WLAN profile – SSIDs the device sees or is configured for.\r\n- **Domain \u002F trust**: `systeminfo`, `nltest \u002Fdomain_trusts` (or Get-ADDomainTrust if RSAT) – domain membership and trust relationships.\r\n- **Net view \u002F session**: `net view` (browsed shares), `net session` (who is connected to this box) – optional; may require admin. Use to see “who can this device see” and “who is using this device.”\r\n\r\n**Output**\r\n\r\n- `interfaces[]` (name, IP, gateway), `arp_count` or `neighbors_count`, optional `wifi_ssids[]`, `domain_member: true|false`, `domain_name`, `trusts[]`, optional `net_view_count` \u002F `net_session_count`.\r\n\r\n---\r\n\r\n## 7. Credential protection (network level – Kerberos, NTLM, pass-the-hash)\r\n\r\nCheck network-level credential hardening to resist Kerberos\u002FNTLM abuse and pass-the-hash.\r\n\r\n- **SMB signing**: `Get-SmbClientConfiguration` (RequireSecuritySignature) and `Get-SmbServerConfiguration` (RequireSecuritySignature, EnableSecuritySignature). Prefer **required** on server and client where possible to mitigate NTLM relay.\r\n- **LDAP signing \u002F channel binding**: Domain controllers – LDAP signing (e.g. `HKLM\\SYSTEM\\CurrentControlSet\\Services\\NTDS\\Parameters\\LDAPServerIntegrity`), LDAP channel binding. Client-side: check if environment enforces signed LDAP.\r\n- **NTLM restrictions**: `HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa`: LmCompatibilityLevel (e.g. 5+ to avoid NTLMv1), RestrictNTLMInDomain \u002F RestrictNTLMOutbound if available. NTLM audit or block policies (RestrictNTLMInDomain = 1, 2, 3).\r\n- **Credential Guard \u002F LSA protection**: `Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\\Microsoft\\Windows\\DeviceGuard` or registry `HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\LsaCfgFlags` – Credential Guard (1) and\u002For LSA run as Protected Process Light to protect hashes in memory.\r\n- **Pass-the-hash**: Mitigations above (Credential Guard, LSA protection, NTLM restrictions) reduce pass-the-hash; report “credential protection” as a summary (e.g. Credential Guard on, SMB signing required, NTLM restricted).\r\n\r\n**Output**\r\n\r\n- `smb_signing_required_client: true|false`, `smb_signing_required_server: true|false`, optional `ldap_signing`, `lm_compat_level`, `credential_guard: true|false`, `lsa_protected: true|false`, `credential_protection_summary: \"strong|partial|weak\"`.\r\n\r\n---\r\n\r\n## 8. Device details and known vulnerabilities\r\n\r\nInventory device and correlate with known vulnerabilities for assessment.\r\n\r\n- **OS and build**: `Get-ItemProperty \"HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\"` – ProductName, CurrentBuild, UBR, DisplayVersion. Optional: `Get-ComputerInfo`.\r\n- **Patches**: `Get-HotFix` or WMI `Win32_QuickFixEngineering` – list KBs and InstalledOn. Use for “last patch date” and to cross-reference with CVE data.\r\n- **Installed software**: `Get-ItemProperty HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*`, `HKLM:\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*` – DisplayName, DisplayVersion, Publisher. Avoid `Get-WmiObject Win32_Product` (slow and triggers reconfigure). Use for vulnerable software inventory.\r\n- **Known vulnerabilities**: Cross-reference OS build and installed product versions with a vulnerability source (e.g. NVD, OSV, vendor advisories, or internal vuln DB). Check for: end-of-life OS, unpatched KBs for known CVEs, outdated browsers\u002FRDP\u002FOpenSSL\u002Fetc. Report count or list of “known vulns” (CVE IDs and severity) without dumping full CPE if not needed.\r\n\r\n**Output**\r\n\r\n- `os_name`, `os_build`, `last_patch_date`, `hotfix_count`, optional `installed_products[]` (name, version), `known_vuln_count`, optional `known_vulns[]` (cve_id, severity, product).\r\n\r\n---\r\n\r\n## 9. Weekly assessment\r\n\r\nConduct a **weekly** SecOps assessment: run the full checklist and produce a report (and optionally emit an event).\r\n\r\n**Checklist (run weekly)**\r\n\r\n- [ ] EDR sensor present and healthy (section 1)\r\n- [ ] Sysmon installed and logging (section 2)\r\n- [ ] System up-to-date (section 3)\r\n- [ ] EVTX: recent alerts summary (section 4)\r\n- [ ] Least privilege (section 5)\r\n- [ ] Network visibility: interfaces, neighbors, domain\u002Ftrust (section 6)\r\n- [ ] Credential protection: SMB\u002FLDAP\u002FNTLM\u002FCredential Guard (section 7)\r\n- [ ] Device inventory and known vulnerabilities (section 8)\r\n- [ ] Skill integrity: hashes match or version-bumped (section 10)\r\n\r\n**Workflow**\r\n\r\n1. Run all checks (or call scripts that aggregate them).\r\n2. Produce **weekly assessment report** using the Host posture report template (below), extended with network, credential, and vuln sections.\r\n3. Optionally emit a dedicated event: `type: 'weekly_assessment'` (or `config_change` with details.assessment = true), with summary and `details` containing aggregate results (counts, booleans, no PII). Dashboard or rules can surface “last weekly assessment” and failures.\r\n\r\n**Schedule**\r\n\r\n- Trigger weekly (e.g. cron\u002FTask Scheduler or collector job every 7 days). Store last run time to avoid duplicate runs in the same week.\r\n\r\n---\r\n\r\n## 10. Skill integrity (hash on wake, version-aware)\r\n\r\nOn **first wake** (when this skill is first applied or when no stored hashes exist), hash this skill and all other known skills; store the hashes. On **each wake**, re-hash and compare to stored hashes. Use **version** in skill frontmatter to distinguish **upgrades** (intentional version change) from **compromise** (hash changed but version unchanged or missing).\r\n\r\n**Scope**\r\n\r\n- **What to hash**: Each known skill directory under `.cursor\u002Fskills\u002F` (project) or `~\u002F.cursor\u002Fskills\u002F` (personal). Per skill: `SKILL.md` (required), and optionally `reference.md`, `examples.md` (if present). Do not hash `scripts\u002F` contents unless you explicitly include them; prefer SKILL.md + optional reference\u002Fexamples for a stable baseline.\r\n- **Algorithm**: SHA-256 of file contents (UTF-8 or raw bytes consistently). Normalize line endings (e.g. LF) before hashing if skills may be edited on different OSes.\r\n\r\n**Storage**\r\n\r\n- **Path**: Project scope: `.cursor\u002Fskills\u002F.skill-integrity.json`. Personal scope: `~\u002F.cursor\u002Fskills\u002F.skill-integrity.json` (or one file that lists both project and personal paths). Do not commit `.skill-integrity.json` to version control if it contains machine-specific or sensitive metadata; add to `.gitignore` or keep local-only.\r\n- **Format** (per skill, keyed by skill name or relative path):\r\n\r\n```json\r\n{\r\n  \"skills\": {\r\n    \"security-joes-ai-analyst\": {\r\n      \"version\": \"1.0\",\r\n      \"fileHashes\": {\r\n        \"SKILL.md\": \"sha256hex...\",\r\n        \"reference.md\": \"sha256hex...\"\r\n      },\r\n      \"lastChecked\": \"ISO8601\"\r\n    }\r\n  },\r\n  \"firstRun\": \"ISO8601\"\r\n}\r\n```\r\n\r\n**First wake**\r\n\r\n1. Enumerate all skill directories (project `.cursor\u002Fskills\u002F*`, optionally personal `~\u002F.cursor\u002Fskills\u002F*`).\r\n2. For each skill: read `version` from SKILL.md frontmatter (if present). Compute SHA-256 for SKILL.md and any reference.md\u002Fexamples.md.\r\n3. Write `.skill-integrity.json` with `skills`, `firstRun`, and `lastChecked` = now.\r\n\r\n**Each wake**\r\n\r\n1. Load `.skill-integrity.json` (if missing, treat as first wake and run first-wake steps).\r\n2. Enumerate the same skill directories; for each skill, read current `version` from frontmatter and compute current hashes for SKILL.md (and optional reference\u002Fexamples).\r\n3. **Compare**:\r\n   - **Hash match**: No change. Update `lastChecked` for that skill.\r\n   - **Hash mismatch + version in file changed**: Treat as **upgrade**. Update stored `version` and `fileHashes` for that skill; update `lastChecked`. Do not alert.\r\n   - **Hash mismatch + version unchanged or missing**: Treat as **potential compromise**. Do not overwrite stored hashes with the new ones. Emit an **alert** (e.g. “Skill integrity: [skill name] content changed without version bump – possible tampering”). Optionally record in details: skill name, which file(s) changed (hash diff), stored version vs current version.\r\n4. **New skill** (present on disk but not in stored hashes): On first wake for that skill, add it to storage with current version and hashes. Do not treat as compromise.\r\n\r\n**Version in frontmatter**\r\n\r\n- Skills should include `version: \"x.y\"` in YAML frontmatter. When you **intentionally upgrade** a skill, bump the version (e.g. `1.0` → `1.1`) so the next wake treats the hash change as an upgrade, not compromise.\r\n- If a skill has no `version` field, any hash change is treated as potential compromise (no way to distinguish upgrade).\r\n\r\n**Output**\r\n\r\n- On each wake: `skill_integrity: ok | compromised | upgraded`. If compromised: list skills (and optionally files) with unexpected changes. Do not log full file contents; only hashes and version.\r\n\r\n**Integration**\r\n\r\n- Run this check when the agent “wakes” (e.g. at start of a session or when this skill is first applied). Optionally include skill integrity in the **weekly assessment** checklist (section 9). Emit MoltSOC **alert** on compromise (type: `alert`, severity: high, summary like “Skill integrity: unexpected change in [skill]”, details with skill name and which hashes changed).\r\n\r\n---\r\n\r\n## Host posture report template\r\n\r\nWhen producing a host posture, heartbeat summary, or weekly assessment, use a structure like:\r\n\r\n```markdown\r\n## Host posture – [host_id]\r\n\r\n- **EDR:** [present\u002Fabsent] – [name], [healthy\u002Funhealthy]\r\n- **Sysmon:** [installed\u002Fnot installed], log: [path or N\u002FA], service: [running\u002Fstopped]\r\n- **Updates:** [up_to_date\u002Fstale], last patch: [date], build: [optional]\r\n- **EVTX (since last heartbeat):** [count or summary], alerts: [brief list or \"none\"]\r\n- **Least privilege:** [yes\u002Fno] – elevated: [yes\u002Fno], in local admins: [yes\u002Fno], UAC: [on\u002Foff]\r\n- **Networks:** interfaces: [count], neighbors\u002FARP: [count], domain: [name or N\u002FA], trusts: [brief]\r\n- **Credential protection:** SMB signing: [required\u002Foptional], Credential Guard: [on\u002Foff], NTLM: [restricted\u002Faudit\u002Foff], summary: [strong\u002Fpartial\u002Fweak]\r\n- **Device & vulns:** OS: [name build], products: [count], known vulns: [count] – [brief list or \"none\"]\r\n- **Weekly assessment:** last run: [date], result: [pass\u002Ffail], failures: [brief list or \"none\"]\r\n- **Skill integrity:** [ok\u002Fcompromised\u002Fupgraded], last check: [date], unexpected: [skill names or \"none\"]\r\n```\r\n\r\n---\r\n\r\n## Integration with MoltSOC\r\n\r\n- Heartbeat events already exist (`type: 'heartbeat'`). Extend `details` with EDR\u002FSysmon\u002Fupdate\u002FEVTX, least privilege, network visibility, credential protection, and vuln summary so the dashboard or rules can show “endpoint healthy” or specific failures.\r\n- New **alerts** (e.g. “EDR missing”, “Sysmon stopped”, “EVTX detection”, “over-privileged”, “credential protection weak”, “known vulns”, **“Skill integrity: unexpected change in [skill]”**) follow the same event schema (type: `alert`, severity, summary, details with rule\u002Fevidence).\r\n- **Skill integrity**: On compromise (hash change without version bump), emit alert with skill name and which file hashes changed; do not include file contents.\r\n- **Weekly assessment**: Emit `type: 'weekly_assessment'` (or `config_change` with `details.assessment: true`) with aggregate results; dashboard can show “last weekly assessment” and failed checks.\r\n- Prefer **metadata-only** in events (counts, booleans, event IDs, timestamps); do not log raw payloads, PII, or full network\u002FARP tables in event details.\r\n\r\n---\r\n\r\n## Privacy and safety\r\n\r\n- Do not include raw log content or PII in events; use counts, event IDs, and short summaries.\r\n- EVTX queries should be scoped to security-relevant channels and time windows; avoid dumping full logs into the collector.\r\n- For network visibility and vuln output: report counts and summaries (e.g. neighbor count, vuln count); do not dump full ARP tables, SSID lists, or CPE\u002Fvuln payloads unless needed for a specific alert.\r\n\r\n---\r\n\r\n## About Security Joes\r\n\r\n[Security Joes](https:\u002F\u002Fwww.securityjoes.com) provides SecOps guidance, endpoint visibility, and security analyst workflows for agents and automation. This skill (Security Joes AI Analyst) is maintained by Security Joes for use with ClawHub and compatible agent platforms.\r\n\r\n- **Website:** [https:\u002F\u002Fwww.securityjoes.com](https:\u002F\u002Fwww.securityjoes.com)\r\n- **About:** [https:\u002F\u002Fwww.securityjoes.com\u002Fabout](https:\u002F\u002Fwww.securityjoes.com\u002Fabout)\r\n",{},"main","e7e336ac628c3e3bd771aff1aaa469c93778f94a","skills\u002Finaor\u002Fsecops-by-joes",0,"https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills","https:\u002F\u002Fgithub.com\u002Fkbarbel640-del","2026-08-23 22:39:37",{"source":7,"skillName":5,"commands":32,"prompt":42,"zipAvailable":43},[33,36,39],{"tool":34,"command":35},"npx","npx skills add kbarbel640-del\u002Fskills --skill secops-by-joes",{"tool":37,"command":38},"bunx","bunx skills add kbarbel640-del\u002Fskills --skill secops-by-joes",{"tool":40,"command":41},"pnpm","pnpm dlx skills add kbarbel640-del\u002Fskills --skill secops-by-joes","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Finaor\u002Fsecops-by-joes\u002FSKILL.md",true,[45,51,55],{"path":46,"resourceType":47,"resourceTypeDesc":48,"sizeBytes":49,"sourceHtmlUrl":50},"_meta.json","REFERENCE","参考文档",436,"https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Finaor\u002Fsecops-by-joes\u002F_meta.json",{"path":52,"resourceType":47,"resourceTypeDesc":48,"sizeBytes":53,"sourceHtmlUrl":54},"README.md",1248,"https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Finaor\u002Fsecops-by-joes\u002FREADME.md",{"path":56,"resourceType":47,"resourceTypeDesc":48,"sizeBytes":57,"sourceHtmlUrl":58},"skill.json",1027,"https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Finaor\u002Fsecops-by-joes\u002Fskill.json",[60,91,120,141,147,167],{"skillNo":61,"name":62,"nameZh":6,"description":63,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":6,"repositoryNo":11,"starsCount":12,"licenseSpdxId":13,"licenseFileUrl":6,"sourceHtmlUrl":64,"categories":65,"keywords":71,"publishedAt":19},"01M6G8J55967D6281ACMKAKTEQ","crowd-prompting","A marketplace where AI agents improve prompts, system instructions, tool descriptions, and other text-based content with domain expertise from real-world operations — and earn tokens for valuable contributions.","https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fzzadrian\u002Fcrowd-prompting\u002FSKILL.md",[66],{"categoryNo":67,"categoryName":68,"taxonomyType":69,"taxonomyTypeDesc":70},"01JBSEEDCAT000000000000036","内容创作者","PROFESSION","适用职业",[72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90],"crowd prompting","prompting","api","with","tokens","domain","world","prompts","operations","instructions","text","tool","system","improve","productivity","marketplace","https","content","ai agents",{"skillNo":92,"name":93,"nameZh":6,"description":94,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":6,"repositoryNo":11,"starsCount":12,"licenseSpdxId":13,"licenseFileUrl":6,"sourceHtmlUrl":95,"categories":96,"keywords":102,"publishedAt":19},"01M6G8J0PKPAYVET6BWE8W4C26","dilemm-ai","Compete in DilemmAI, the prisoner's dilemma AI arena at dilemm.ai. Use when an OpenClaw agent wants to create an account, design and submit strategy prompts for their bot, enter matchmaking, analyze historical matches and leaderboards, and iterate on bot strategy. Requires headless browser automation (no API available yet).","https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fzyori\u002Fdilemm-ai\u002FSKILL.md",[97],{"categoryNo":98,"categoryName":99,"taxonomyType":100,"taxonomyTypeDesc":101},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[103,74,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,79,119],"dilemm ai","arena","analyze","browser","openclaw agent","create","automation","browser automation","bot","openclaw","design","strategy","headless","compete","submit","matchmaking","use",{"skillNo":121,"name":122,"nameZh":6,"description":123,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":6,"repositoryNo":11,"starsCount":12,"licenseSpdxId":13,"licenseFileUrl":6,"sourceHtmlUrl":124,"categories":125,"keywords":129,"publishedAt":19},"01M6G8HWAF3K9SW7NP3Z83CPJ6","arxiv-paper-reviews","Interact with arXiv Crawler API to fetch papers, read reviews, and submit comments. Use when working with arXiv papers, fetching paper lists by date\u002Fcategory\u002Finterest, viewing paper details with comments, or submitting paper reviews via API at http:\u002F\u002F150.158.152.82:8000.","https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fzxrys\u002Fweak-accept\u002FSKILL.md",[126],{"categoryNo":127,"categoryName":128,"taxonomyType":100,"taxonomyTypeDesc":101},"01JBSEEDCAT000000000000021","资料检索与研究",[130,131,132,133,134,135,136,75,137,117,119,138,74,139,140],"arxiv paper reviews","reviews","arxiv","paper","crawler","papers","comments","fetch","read","http","via",{"skillNo":142,"name":122,"nameZh":6,"description":123,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":6,"repositoryNo":11,"starsCount":12,"licenseSpdxId":13,"licenseFileUrl":6,"sourceHtmlUrl":143,"categories":144,"keywords":146,"publishedAt":19},"01M6G8HQJ7N7WMY6YV7D7SSJ16","https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fzxrys\u002Farxiv-paper-reviews\u002FSKILL.md",[145],{"categoryNo":127,"categoryName":128,"taxonomyType":100,"taxonomyTypeDesc":101},[133,132,131,130,140,135,136,75,134,117,119,137,138,74,139],{"skillNo":148,"name":149,"nameZh":6,"description":150,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":6,"repositoryNo":11,"starsCount":12,"licenseSpdxId":13,"licenseFileUrl":6,"sourceHtmlUrl":151,"categories":152,"keywords":153,"publishedAt":19},"01M6G8HM95Y64JNVFC2HN4E2BG","git-summary","Get a quick summary of the current Git repository including status, recent commits, branches, and contributors.","https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fzweack\u002Fgit-summary\u002FSKILL.md",[],[154,155,156,157,158,159,160,161,162,163,164,165,166],"git","summary","git summary","commits","repository","win32","status","linux","contributors","true","quick","get","branches",{"skillNo":168,"name":169,"nameZh":6,"description":170,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":6,"repositoryNo":11,"starsCount":12,"licenseSpdxId":13,"licenseFileUrl":6,"sourceHtmlUrl":171,"categories":172,"keywords":177,"publishedAt":19},"01M6G8HGEGF05CNEJCGVYFSC4R","agent-constitution","Interact with AgentConstitution governance contracts on Base Sepolia. Check compliance, read rules, log actions, query governance state.","https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fztsalexey\u002Fagent-constitution\u002FSKILL.md",[173,174],{"categoryNo":98,"categoryName":99,"taxonomyType":100,"taxonomyTypeDesc":101},{"categoryNo":175,"categoryName":176,"taxonomyType":69,"taxonomyTypeDesc":70},"01JBSEEDCAT000000000000037","律师与法务",[178,179,180,181,75,182,183,24,184,138,185,186,187,188,189,88,190,191,192],"agent constitution","constitution","contracts","tree","query","base","log","check","Rules","projects","compliance","actions","state","governance","github"]