[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6GY0FAMYV77BVQ8VM1VZBPB":3,"skill-same:01M6GY0FAMYV77BVQ8VM1VZBPB":89},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":51,"commitSha":52,"skillDirectory":53,"forksCount":54,"repositoryHtmlUrl":55,"repositoryHomepageUrl":6,"ownerHtmlUrl":56,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":57,"install":58,"resources":71},"01M6GY0FAMYV77BVQ8VM1VZBPB","hunting-advanced-persistent-threats",null,"Proactively hunts for Advanced Persistent Threat (APT) activity within enterprise environments using hypothesis-driven searches across endpoint telemetry, network logs, and memory artifacts. Use when conducting scheduled threat hunting cycles, investigating anomalous behavior flagged by UEBA, or validating that known APT TTPs are not present in the environment. Activates for requests involving MITRE ATT&CK, Velociraptor, osquery, Zeek, or threat hunting playbooks.","micsapp\u002Fmicstec-skills","micsapp","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F82411001?v=4","01M6GWCFQ6D3PV8EHNY62NN5VW","01M6GWCFVE1PA5HG0DKC7AMFJ3",4,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fhunting-advanced-persistent-threats\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"hunting","advanced","hunting advanced persistent threats","edr","scheduled","activity","across","intelligence","TTP","osquery","memory","NIST","network","NIST-CSF","MITRE-ATT&CK","threat-hunting","threat-intelligence","logs","threat hunting","cybersecurity","2026-11-10 10:12:30",false,"---\nname: hunting-advanced-persistent-threats\ndescription: >\n  Proactively hunts for Advanced Persistent Threat (APT) activity within enterprise environments\n  using hypothesis-driven searches across endpoint telemetry, network logs, and memory artifacts.\n  Use when conducting scheduled threat hunting cycles, investigating anomalous behavior flagged by\n  UEBA, or validating that known APT TTPs are not present in the environment. Activates for requests\n  involving MITRE ATT&CK, Velociraptor, osquery, Zeek, or threat hunting playbooks.\ndomain: cybersecurity\nsubdomain: threat-intelligence\ntags: [MITRE-ATT&CK, threat-hunting, APT, Velociraptor, osquery, Zeek, TTP, NIST-CSF, EDR]\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\n---\n# Hunting Advanced Persistent Threats\n\n## When to Use\n\nUse this skill when:\n- Conducting proactive threat hunting sprints (typically 2–4 week cycles) based on newly published APT intelligence\n- A UEBA alert or anomaly detection system flags behavioral deviations warranting deeper investigation\n- A peer organization or ISAC sharing partner reports active APT compromise and you need to validate your own exposure\n\n**Do not use** this skill as a substitute for incident response when a confirmed breach is in progress — escalate to IR procedures (NIST SP 800-61).\n\n## Prerequisites\n\n- EDR platform with telemetry retention (CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne) covering 30+ days\n- Access to MITRE ATT&CK Navigator for hypothesis development\n- Network flow data (NetFlow, Zeek, or Suricata logs) in a queryable SIEM\n- Threat hunting platform or query interface (Velociraptor, osquery fleet, or Splunk ES)\n\n## Workflow\n\n### Step 1: Develop Hunt Hypothesis\n\nSelect a threat actor relevant to your sector using MITRE ATT&CK Groups (https:\u002F\u002Fattack.mitre.org\u002Fgroups\u002F). Review the group's known TTPs mapped to ATT&CK techniques. Example hypothesis: \"APT29 (Cozy Bear) uses spearphishing with ISO attachments (T1566.001) and living-off-the-land binaries (T1218) — test for unusual mshta.exe and rundll32.exe parent-child relationships.\"\n\nDocument hypothesis using the Threat Hunting Loop framework: hypothesis → data collection → pattern analysis → response.\n\n### Step 2: Identify Required Data Sources\n\nMap each ATT&CK technique to required log sources using the ATT&CK Data Sources taxonomy:\n- Process creation (T1059): Windows Security Event 4688 or Sysmon Event ID 1\n- Network connections (T1071): Zeek conn.log, NetFlow, EDR network telemetry\n- Registry modifications (T1547): Sysmon Event ID 13, Windows Security 4657\n- Memory injection (T1055): EDR memory scan telemetry, Volatility output\n\nVerify log coverage using ATT&CK Coverage Calculator or a custom data source matrix.\n\n### Step 3: Execute Hunts with Velociraptor or osquery\n\n**Velociraptor VQL hunt** for unusual PowerShell execution:\n```vql\nSELECT Pid, Ppid, Name, CommandLine, CreateTime\nFROM pslist()\nWHERE Name =~ \"powershell.exe\"\nAND CommandLine =~ \"-enc|-nop|-w hidden\"\n```\n\n**osquery** for persistence via scheduled tasks:\n```sql\nSELECT name, action, enabled, path\nFROM scheduled_tasks\nWHERE action NOT LIKE '%System32%'\nAND enabled = 1;\n```\n\n**Splunk SPL** for lateral movement via PsExec:\n```spl\nindex=windows EventCode=7045 ServiceFileName=\"*PSEXESVC*\"\n| stats count by ComputerName, ServiceName, ServiceFileName\n```\n\n### Step 4: Analyze Results and Pivot\n\nFor each anomaly identified, pivot across dimensions:\n- Temporal: Did this occur before or after known IOC timestamps?\n- Host: How many endpoints exhibit this behavior?\n- User: Is the associated account a service account, privileged user, or regular user?\n- Network: Does the host communicate with external IPs not in baseline?\n\nApply the Diamond Model (adversary, capability, infrastructure, victim) to structure findings.\n\n### Step 5: Document and Operationalize Findings\n\nIf hunting reveals confirmed malicious activity, activate IR procedures. If hunting reveals a gap (hunt found nothing but data coverage was insufficient), document the coverage gap and remediate.\n\nConvert successful hunt queries into SIEM detection rules using Sigma format for portability across platforms.\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **TTP** | Tactics, Techniques, and Procedures — adversary behavioral patterns as defined in MITRE ATT&CK |\n| **Diamond Model** | Analytical framework with four vertices (adversary, capability, infrastructure, victim) used to structure intrusion analysis |\n| **Living-off-the-Land (LotL)** | Attacker technique using legitimate OS tools (PowerShell, WMI, certutil) to evade detection |\n| **UEBA** | User and Entity Behavior Analytics — ML-based detection of anomalous behavior baselines |\n| **Sigma** | Open standard for SIEM-agnostic detection rule format, analogous to YARA for network\u002Flog detection |\n| **Hunt Hypothesis** | A testable prediction about adversary presence based on threat intelligence and environmental knowledge |\n\n## Tools & Systems\n\n- **Velociraptor**: Open-source DFIR platform with VQL query language for scalable endpoint hunting across thousands of systems\n- **osquery**: SQL-based OS instrumentation framework for real-time endpoint telemetry queries\n- **MITRE ATT&CK Navigator**: Web-based tool for visualizing ATT&CK coverage and technique prioritization\n- **Zeek (formerly Bro)**: Network traffic analyzer producing structured logs (conn, dns, http, ssl) suitable for hunting\n- **Elastic Security**: EQL (Event Query Language) enables sequence-based hunting for multi-stage attack patterns\n- **Sigma**: Detection rule format with translators for Splunk, QRadar, Sentinel, and Elastic\n\n## Common Pitfalls\n\n- **Confirmation bias**: Starting a hunt expecting to find something and interpreting benign data as malicious. Document null results — they validate controls.\n- **Insufficient data retention**: Many APT techniques require 90+ days of log history to identify slow-and-low patterns. Default retention periods are often too short.\n- **Hunting without baselines**: Cannot identify anomalies without knowing normal. Spend time on baseline documentation before hunting.\n- **Query performance impact**: Broad queries against production SIEM during business hours can degrade analyst workflows. Schedule intensive hunts during off-peak hours.\n- **Ignoring false positives systematically**: Track false positive rates per query. Queries with >80% FP rate should be refined or retired before operationalization.\n","# Hunting Advanced Persistent Threats\n\n## When to Use\n\nUse this skill when:\n- Conducting proactive threat hunting sprints (typically 2–4 week cycles) based on newly published APT intelligence\n- A UEBA alert or anomaly detection system flags behavioral deviations warranting deeper investigation\n- A peer organization or ISAC sharing partner reports active APT compromise and you need to validate your own exposure\n\n**Do not use** this skill as a substitute for incident response when a confirmed breach is in progress — escalate to IR procedures (NIST SP 800-61).\n\n## Prerequisites\n\n- EDR platform with telemetry retention (CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne) covering 30+ days\n- Access to MITRE ATT&CK Navigator for hypothesis development\n- Network flow data (NetFlow, Zeek, or Suricata logs) in a queryable SIEM\n- Threat hunting platform or query interface (Velociraptor, osquery fleet, or Splunk ES)\n\n## Workflow\n\n### Step 1: Develop Hunt Hypothesis\n\nSelect a threat actor relevant to your sector using MITRE ATT&CK Groups (https:\u002F\u002Fattack.mitre.org\u002Fgroups\u002F). Review the group's known TTPs mapped to ATT&CK techniques. Example hypothesis: \"APT29 (Cozy Bear) uses spearphishing with ISO attachments (T1566.001) and living-off-the-land binaries (T1218) — test for unusual mshta.exe and rundll32.exe parent-child relationships.\"\n\nDocument hypothesis using the Threat Hunting Loop framework: hypothesis → data collection → pattern analysis → response.\n\n### Step 2: Identify Required Data Sources\n\nMap each ATT&CK technique to required log sources using the ATT&CK Data Sources taxonomy:\n- Process creation (T1059): Windows Security Event 4688 or Sysmon Event ID 1\n- Network connections (T1071): Zeek conn.log, NetFlow, EDR network telemetry\n- Registry modifications (T1547): Sysmon Event ID 13, Windows Security 4657\n- Memory injection (T1055): EDR memory scan telemetry, Volatility output\n\nVerify log coverage using ATT&CK Coverage Calculator or a custom data source matrix.\n\n### Step 3: Execute Hunts with Velociraptor or osquery\n\n**Velociraptor VQL hunt** for unusual PowerShell execution:\n```vql\nSELECT Pid, Ppid, Name, CommandLine, CreateTime\nFROM pslist()\nWHERE Name =~ \"powershell.exe\"\nAND CommandLine =~ \"-enc|-nop|-w hidden\"\n```\n\n**osquery** for persistence via scheduled tasks:\n```sql\nSELECT name, action, enabled, path\nFROM scheduled_tasks\nWHERE action NOT LIKE '%System32%'\nAND enabled = 1;\n```\n\n**Splunk SPL** for lateral movement via PsExec:\n```spl\nindex=windows EventCode=7045 ServiceFileName=\"*PSEXESVC*\"\n| stats count by ComputerName, ServiceName, ServiceFileName\n```\n\n### Step 4: Analyze Results and Pivot\n\nFor each anomaly identified, pivot across dimensions:\n- Temporal: Did this occur before or after known IOC timestamps?\n- Host: How many endpoints exhibit this behavior?\n- User: Is the associated account a service account, privileged user, or regular user?\n- Network: Does the host communicate with external IPs not in baseline?\n\nApply the Diamond Model (adversary, capability, infrastructure, victim) to structure findings.\n\n### Step 5: Document and Operationalize Findings\n\nIf hunting reveals confirmed malicious activity, activate IR procedures. If hunting reveals a gap (hunt found nothing but data coverage was insufficient), document the coverage gap and remediate.\n\nConvert successful hunt queries into SIEM detection rules using Sigma format for portability across platforms.\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **TTP** | Tactics, Techniques, and Procedures — adversary behavioral patterns as defined in MITRE ATT&CK |\n| **Diamond Model** | Analytical framework with four vertices (adversary, capability, infrastructure, victim) used to structure intrusion analysis |\n| **Living-off-the-Land (LotL)** | Attacker technique using legitimate OS tools (PowerShell, WMI, certutil) to evade detection |\n| **UEBA** | User and Entity Behavior Analytics — ML-based detection of anomalous behavior baselines |\n| **Sigma** | Open standard for SIEM-agnostic detection rule format, analogous to YARA for network\u002Flog detection |\n| **Hunt Hypothesis** | A testable prediction about adversary presence based on threat intelligence and environmental knowledge |\n\n## Tools & Systems\n\n- **Velociraptor**: Open-source DFIR platform with VQL query language for scalable endpoint hunting across thousands of systems\n- **osquery**: SQL-based OS instrumentation framework for real-time endpoint telemetry queries\n- **MITRE ATT&CK Navigator**: Web-based tool for visualizing ATT&CK coverage and technique prioritization\n- **Zeek (formerly Bro)**: Network traffic analyzer producing structured logs (conn, dns, http, ssl) suitable for hunting\n- **Elastic Security**: EQL (Event Query Language) enables sequence-based hunting for multi-stage attack patterns\n- **Sigma**: Detection rule format with translators for Splunk, QRadar, Sentinel, and Elastic\n\n## Common Pitfalls\n\n- **Confirmation bias**: Starting a hunt expecting to find something and interpreting benign data as malicious. Document null results — they validate controls.\n- **Insufficient data retention**: Many APT techniques require 90+ days of log history to identify slow-and-low patterns. Default retention periods are often too short.\n- **Hunting without baselines**: Cannot identify anomalies without knowing normal. Spend time on baseline documentation before hunting.\n- **Query performance impact**: Broad queries against production SIEM during business hours can degrade analyst workflows. Schedule intensive hunts during off-peak hours.\n- **Ignoring false positives systematically**: Track false positive rates per query. Queries with >80% FP rate should be refined or retired before operationalization.\n",{"name":5,"tags":43,"author":48,"domain":37,"license":14,"version":49,"subdomain":34,"description":50},[32,33,44,45,27,46,26,31,47],"APT","Velociraptor","Zeek","EDR","mahipal","1.0.0","Proactively hunts for Advanced Persistent Threat (APT) activity within enterprise environments using hypothesis-driven searches across endpoint telemetry, network logs, and memory artifacts. Use when conducting scheduled threat hunting cycles, investigating anomalous behavior flagged by UEBA, or validating that known APT TTPs are not present in the environment. Activates for requests involving MITRE ATT&CK, Velociraptor, osquery, Zeek, or threat hunting playbooks.\n","master","3f5d983eb4ef375b749adcd6b07ec03bd82ae8a8","_universal\u002Fcybersecurity-skills\u002Fskills\u002Fhunting-advanced-persistent-threats",0,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills","https:\u002F\u002Fgithub.com\u002Fmicsapp","2026-03-20 11:24:18",{"source":8,"skillName":5,"commands":59,"prompt":69,"zipAvailable":70},[60,63,66],{"tool":61,"command":62},"npx","npx skills add micsapp\u002Fmicstec-skills --skill hunting-advanced-persistent-threats",{"tool":64,"command":65},"bunx","bunx skills add micsapp\u002Fmicstec-skills --skill hunting-advanced-persistent-threats",{"tool":67,"command":68},"pnpm","pnpm dlx skills add micsapp\u002Fmicstec-skills --skill hunting-advanced-persistent-threats","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fhunting-advanced-persistent-threats\u002FSKILL.md",true,[72,77,83],{"path":73,"resourceType":73,"resourceTypeDesc":74,"sizeBytes":75,"sourceHtmlUrl":76},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fhunting-advanced-persistent-threats\u002FLICENSE",{"path":78,"resourceType":79,"resourceTypeDesc":80,"sizeBytes":81,"sourceHtmlUrl":82},"references\u002Fapi-reference.md","REFERENCE","参考文档",2114,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fhunting-advanced-persistent-threats\u002Freferences\u002Fapi-reference.md",{"path":84,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":87,"sourceHtmlUrl":88},"scripts\u002Fagent.py","SCRIPT","脚本",7246,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fhunting-advanced-persistent-threats\u002Fscripts\u002Fagent.py",[90,127,157,178,198,223],{"skillNo":91,"name":92,"nameZh":6,"description":93,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":94,"licenseFileUrl":6,"sourceHtmlUrl":95,"categories":96,"keywords":107,"publishedAt":38},"01M6HBTJ02FXBFG9NYEHHYAP52","azure-apim-architecture","Analyzes and explains Azure API Management architecture decisions for enterprise API marketplace implementations using VNet Internal mode, Front Door, hybrid authentication, and multi-environment strategies. Use when discussing APIM component selection, network topology, cost optimization, or comparing alternatives like workspaces vs instances, VNet Internal vs External mode, or Front Door vs Application Gateway.","MIT","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fazure-apim-architecture\u002FSKILL.md",[97,102],{"categoryNo":98,"categoryName":99,"taxonomyType":100,"taxonomyTypeDesc":101},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":103,"categoryName":104,"taxonomyType":105,"taxonomyTypeDesc":106},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[108,109,110,111,112,113,114,115,30,116,117,118,119,120,121,122,123,124,125,126],"architecture","azure","azure apim architecture","component","authentication","gateway","topology","Optimization","api","team","environment","multi-environment","workspaces","instances","selection","strategies","azure api management","mode","for",{"skillNo":128,"name":129,"nameZh":6,"description":130,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":94,"licenseFileUrl":6,"sourceHtmlUrl":131,"categories":132,"keywords":141,"publishedAt":38},"01M6HBT7J4H082JEEA670B3EQ9","apiops-deployment","Guides deployment of Azure API Management infrastructure using Infrastructure as Code (Bicep\u002FTerraform), CI\u002FCD pipelines (GitHub Actions\u002FAzure DevOps), and APIOps workflows. Use when deploying APIM, creating pipelines, or implementing dev→test→prod promotion strategies.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapiops-deployment\u002FSKILL.md",[133,134,137,140],{"categoryNo":98,"categoryName":99,"taxonomyType":100,"taxonomyTypeDesc":101},{"categoryNo":135,"categoryName":136,"taxonomyType":100,"taxonomyTypeDesc":101},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":138,"categoryName":139,"taxonomyType":100,"taxonomyTypeDesc":101},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":103,"categoryName":104,"taxonomyType":105,"taxonomyTypeDesc":106},[142,143,144,145,109,146,147,148,149,150,151,152,116,117,123,153,154,124,155,156],"deployment","apiops deployment","workflows","azure devops","infrastructure","code","infrastructure as code","actions","ci","github actions","github-actions","as","guides","CI\u002FCD","implementing",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":94,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":164,"publishedAt":38},"01M6HBT2HEA23THNE9E00GYQBE","apim-policy-authoring","Creates production-ready Azure API Management policy XML for authentication (OAuth 2.0, JWT validation, subscription keys), rate limiting, CORS configuration, error handling, and API transformations. Use when implementing API security, access control, or request\u002Fresponse processing logic.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapim-policy-authoring\u002FSKILL.md",[163],{"categoryNo":98,"categoryName":99,"taxonomyType":100,"taxonomyTypeDesc":101},[165,166,167,168,109,112,116,117,169,170,171,172,173,174,175,124,176,177,156,126],"policy","authoring","apim policy authoring","security","access","use","ready","api security","Access Control","error","processing","cors configuration","production-ready",{"skillNo":179,"name":180,"nameZh":6,"description":181,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":94,"licenseFileUrl":6,"sourceHtmlUrl":182,"categories":183,"keywords":186,"publishedAt":38},"01M6HBSY65SB29J9WE9KYD0K6T","api-security-review","Reviews Azure API Management configurations for security vulnerabilities, OWASP API Security Top 10 compliance, VNet Internal mode validation, Private Link verification, and Azure Security Benchmark alignment. Use when performing security audits, pre-deployment validation, or compliance reviews.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapi-security-review\u002FSKILL.md",[184,185],{"categoryNo":98,"categoryName":99,"taxonomyType":100,"taxonomyTypeDesc":101},{"categoryNo":103,"categoryName":104,"taxonomyType":105,"taxonomyTypeDesc":106},[187,168,188,116,172,189,109,142,190,191,192,193,117,194,124,195,196,197,125,126],"review","security review","api security review","benchmark","verification","owasp","owasp-api","alignment","azure security","reviews","top",{"skillNo":199,"name":200,"nameZh":6,"description":201,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":94,"licenseFileUrl":6,"sourceHtmlUrl":202,"categories":203,"keywords":204,"publishedAt":38},"01M6HBSRW4PDFE6K4F8JYPZQ05","jira-cli","Interact with Jira from the command line to create, list, view, edit, and transition issues, manage sprints and epics, and perform common Jira workflows. Use when the user asks about Jira tasks, tickets, issues, sprints, or needs to manage project work items.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fawesome-copilot-agents\u002Fskills\u002Fjira-cli\u002FSKILL.md",[],[205,206,207,144,208,209,210,211,116,212,213,214,215,216,217,218,219,220,221,222],"cli","jira","jira cli","init","tasks","create","issues","common","work","command","edit","list","view","project","project work","token","line","sprints",{"skillNo":224,"name":225,"nameZh":6,"description":226,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":94,"licenseFileUrl":6,"sourceHtmlUrl":227,"categories":228,"keywords":229,"publishedAt":38},"01M6HBSNS3JHMW603G47TWE31H","calculator","Performs arbitrary-precision arithmetic calculations including addition, subtraction, multiplication, division, and exponents. Use when the user asks to calculate, compute, or evaluate math expressions, or when precise decimal arithmetic is needed to avoid floating-point errors.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fawesome-copilot-agents\u002Fskills\u002Fcalculator\u002FSKILL.md",[],[225,230,231,232,233,234,235,170,236,237],"npm","js","calculate","node","math","user","compute","errors"]