[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6HPCCS4QQQENK072145X1D2":3,"skill-same:01M6HPCCS4QQQENK072145X1D2":132},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":31,"publishedAt":52,"linkOnly":53,"markdownContent":54,"markdownBody":55,"frontMatter":56,"refName":75,"commitSha":76,"skillDirectory":77,"forksCount":78,"repositoryHtmlUrl":79,"repositoryHomepageUrl":6,"ownerHtmlUrl":80,"ownerBlogUrl":6,"ownerDescription":81,"updatedAt":82,"install":83,"resources":96},"01M6HPCCS4QQQENK072145X1D2","testing-mobile-api-authentication",null,"Tests authentication and authorization mechanisms in mobile application APIs to identify broken authentication, insecure token management, session fixation, privilege escalation, and IDOR vulnerabilities. Use when performing API security...","HenriqueMC17\u002Fagente-core","HenriqueMC17","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F206460478?v=4","01M6HB63HBBF18AC4H09XTB549","Henrique Monteiro Cardoso","01M6HB63NGSQXWKWCFWW2B20W0",1,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftesting-mobile-api-authentication\u002FSKILL.md",[18,23,26],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51],"api authentication","authentication","api","testing mobile api authentication","testing","mobile","broken","token management","api-authentication","privilege escalation","penetration","de","token","cm","broken authentication","t1078","escalation","api-security","cybersecurity","security","2026-11-10 10:12:30",false,"---\nname: testing-mobile-api-authentication\ndescription: Tests authentication and authorization mechanisms in mobile application APIs to identify broken authentication, insecure token management, session fixation, privilege escalation, and IDOR vulnerabilities. Use when performing API security...\ndomain: cybersecurity\nsubdomain: mobile-security\nauthor: mahipal\ntags:\n- mobile-security\n- android\n- ios\n- api-security\n- authentication\n- penetration-testing\nversion: 1.0.0\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- PR.AA-05\n- ID.RA-01\n- DE.CM-09\nmitre_attack:\n- T1059\n- T1056\n- T1036\n- T1078\n- T1068\ncategory: testing-mobile-api-authentication\n---\n# Testing-Mobile-Api-Authentication\n\n## Overview\nTests authentication and authorization mechanisms in mobile application APIs to identify broken authentication, insecure token management, session fixation, privilege escalation, and IDOR vulnerabilities. Use when performing API security assessments against mobile app backends, testing JWT implementations, evaluating OAuth flows, or assessing session management. Activates for requests involving mobile API auth testing, token security assessment, OAuth mobile flow testing, or API authorization bypass.\n\n\n# Testing Mobile API Authentication\n\n## When to Use\n\nUse this skill when:\n- Assessing mobile app backend API authentication during penetration tests\n- Testing JWT token implementation for common vulnerabilities (none algorithm, weak signing)\n- Evaluating OAuth 2.0 \u002F OIDC flows in mobile applications for redirect, PKCE, and scope issues\n- Testing for broken object-level authorization (BOLA\u002FIDOR) in API endpoints\n\n**Do not use** this skill against production APIs without explicit authorization and rate-limiting awareness.\n\n## Prerequisites\n\n- Burp Suite or mitmproxy configured as mobile device proxy\n- SSL pinning bypassed on target application (if implemented)\n- Valid test account credentials for the target application\n- Postman or curl for API request crafting\n- jwt.io or PyJWT for JWT analysis and manipulation\n\n## Workflow\n\n### Step 1: Map Authentication Endpoints\n\nIntercept mobile app traffic to identify authentication-related endpoints:\n\n```\nPOST \u002Fapi\u002Fv1\u002Fauth\u002Flogin          - Initial authentication\nPOST \u002Fapi\u002Fv1\u002Fauth\u002Fregister       - Account registration\nPOST \u002Fapi\u002Fv1\u002Fauth\u002Frefresh        - Token refresh\nPOST \u002Fapi\u002Fv1\u002Fauth\u002Flogout         - Session termination\nPOST \u002Fapi\u002Fv1\u002Fauth\u002Fforgot-password - Password reset\nPOST \u002Fapi\u002Fv1\u002Fauth\u002Fverify-otp     - OTP verification\nGET  \u002Fapi\u002Fv1\u002Fauth\u002Fme             - Authenticated user profile\n```\n\n### Step 2: Analyze Token Format and Security\n\n**JWT Analysis:**\n```bash\n# Decode JWT without verification\necho \"eyJhbGciOiJIUzI1NiIs...\" | cut -d. -f2 | base64 -d 2>\u002Fdev\u002Fnull\n\n# Check for common JWT vulnerabilities:\n# 1. None algorithm attack\n# Change header to: {\"alg\":\"none\",\"typ\":\"JWT\"}\n# Remove signature: header.payload.\n\n# 2. Algorithm confusion (RS256 to HS256)\n# If server uses RS256, try HS256 with public key as secret\n\n# 3. Weak signing key\n# Use hashcat or jwt-cracker to brute-force HMAC secret\nhashcat -m 16500 jwt.txt wordlist.txt\n\n# 4. Expiration bypass\n# Modify \"exp\" claim to future timestamp\n```\n\n**Opaque Token Analysis:**\n```\n- Test token length and entropy\n- Check if tokens are sequential\u002Fpredictable\n- Test token reuse after logout\n- Verify token invalidation on password change\n```\n\n### Step 3: Test Authentication Bypass\n\n```bash\n# Test missing authentication\ncurl -X GET https:\u002F\u002Fapi.target.com\u002Fapi\u002Fv1\u002Fusers\u002Fprofile\n\n# Test with empty\u002Fnull token\ncurl -X GET https:\u002F\u002Fapi.target.com\u002Fapi\u002Fv1\u002Fusers\u002Fprofile \\\n  -H \"Authorization: Bearer \"\n\ncurl -X GET https:\u002F\u002Fapi.target.com\u002Fapi\u002Fv1\u002Fusers\u002Fprofile \\\n  -H \"Authorization: Bearer null\"\n\n# Test with expired token (should fail)\ncurl -X GET https:\u002F\u002Fapi.target.com\u002Fapi\u002Fv1\u002Fusers\u002Fprofile \\\n  -H \"Authorization: Bearer \u003Cexpired_token>\"\n\n# Test token from different user\ncurl -X GET https:\u002F\u002Fapi.target.com\u002Fapi\u002Fv1\u002Fusers\u002F123\u002Fprofile \\\n  -H \"Authorization: Bearer \u003Cuser_456_token>\"\n```\n\n### Step 4: Test IDOR \u002F Broken Object-Level Authorization\n\n```bash\n# Change user ID in request path\ncurl -X GET https:\u002F\u002Fapi.target.com\u002Fapi\u002Fv1\u002Fusers\u002F123\u002Forders \\\n  -H \"Authorization: Bearer \u003Cuser_456_token>\"\n\n# Change object ID in request body\ncurl -X PUT https:\u002F\u002Fapi.target.com\u002Fapi\u002Fv1\u002Forders\u002F789 \\\n  -H \"Authorization: Bearer \u003Cuser_456_token>\" \\\n  -d '{\"status\": \"cancelled\"}'\n\n# Test horizontal privilege escalation\n# Access admin endpoints with regular user token\ncurl -X GET https:\u002F\u002Fapi.target.com\u002Fapi\u002Fv1\u002Fadmin\u002Fusers \\\n  -H \"Authorization: Bearer \u003Cregular_user_token>\"\n```\n\n### Step 5: Test Session Management\n\n```bash\n# Test concurrent sessions\n# Login from multiple devices simultaneously - should both remain valid?\n\n# Test session invalidation after logout\nTOKEN=$(curl -s -X POST https:\u002F\u002Fapi.target.com\u002Fapi\u002Fv1\u002Fauth\u002Flogin \\\n  -d '{\"email\":\"test@test.com\",\"password\":\"pass\"}' | jq -r '.token')\n\n# Logout\ncurl -X POST https:\u002F\u002Fapi.target.com\u002Fapi\u002Fv1\u002Fauth\u002Flogout \\\n  -H \"Authorization: Bearer $TOKEN\"\n\n# Try using the same token (should fail)\ncurl -X GET https:\u002F\u002Fapi.target.com\u002Fapi\u002Fv1\u002Fusers\u002Fme \\\n  -H \"Authorization: Bearer $TOKEN\"\n\n# Test session invalidation after password change\n# Token obtained before password change should be invalidated\n```\n\n### Step 6: Test OAuth 2.0 \u002F OIDC Mobile Flows\n\n```bash\n# Test for authorization code interception\n# Check if PKCE (Proof Key for Code Exchange) is enforced\n# Test with missing code_verifier parameter\n\n# Test redirect URI manipulation\n# Try custom scheme hijacking: myapp:\u002F\u002Fcallback\n# Test with modified redirect_uri parameter\n\n# Test scope escalation\n# Request higher privileges than granted\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **BOLA\u002FIDOR** | Broken Object Level Authorization - accessing resources by changing identifiers without server-side authorization checks |\n| **JWT** | JSON Web Token - self-contained authentication token with header, payload, and signature components |\n| **PKCE** | Proof Key for Code Exchange - OAuth 2.0 extension preventing authorization code interception in mobile apps |\n| **Token Refresh** | Mechanism for obtaining new access tokens using long-lived refresh tokens without re-authentication |\n| **Session Fixation** | Attack where adversary sets a known session ID before victim authenticates, then hijacks the session |\n\n## Tools & Systems\n\n- **Burp Suite**: HTTP proxy for intercepting and modifying authentication requests\n- **jwt_tool**: Python tool for testing JWT vulnerabilities (none algorithm, key confusion, claim manipulation)\n- **Postman**: API testing client for crafting authentication requests\n- **hashcat**: Password\u002FJWT secret cracking tool for testing HMAC signing key strength\n- **Autorize**: Burp Suite extension for automated authorization testing\n\n## Common Pitfalls\n\n- **Rate limiting masks issues**: API may rate-limit test requests. Use delays between requests and test from the tester's authorized perspective first.\n- **Token in URL**: Some mobile APIs pass tokens in URL query parameters, exposing them in server logs and browser history. Flag as finding even if authorization works correctly.\n- **Refresh token rotation**: Some APIs rotate refresh tokens on each use. If your test invalidates the refresh token, you may lock out your test account.\n- **Mobile-specific OAuth**: Mobile apps use custom URI schemes for OAuth redirects, which can be intercepted by malicious apps registered for the same scheme.\n","# Testing-Mobile-Api-Authentication\n\n## Overview\nTests authentication and authorization mechanisms in mobile application APIs to identify broken authentication, insecure token management, session fixation, privilege escalation, and IDOR vulnerabilities. Use when performing API security assessments against mobile app backends, testing JWT implementations, evaluating OAuth flows, or assessing session management. Activates for requests involving mobile API auth testing, token security assessment, OAuth mobile flow testing, or API authorization bypass.\n\n\n# Testing Mobile API Authentication\n\n## When to Use\n\nUse this skill when:\n- Assessing mobile app backend API authentication during penetration tests\n- Testing JWT token implementation for common vulnerabilities (none algorithm, weak signing)\n- Evaluating OAuth 2.0 \u002F OIDC flows in mobile applications for redirect, PKCE, and scope issues\n- Testing for broken object-level authorization (BOLA\u002FIDOR) in API endpoints\n\n**Do not use** this skill against production APIs without explicit authorization and rate-limiting awareness.\n\n## Prerequisites\n\n- Burp Suite or mitmproxy configured as mobile device proxy\n- SSL pinning bypassed on target application (if implemented)\n- Valid test account credentials for the target application\n- Postman or curl for API request crafting\n- jwt.io or PyJWT for JWT analysis and manipulation\n\n## Workflow\n\n### Step 1: Map Authentication Endpoints\n\nIntercept mobile app traffic to identify authentication-related endpoints:\n\n```\nPOST \u002Fapi\u002Fv1\u002Fauth\u002Flogin          - Initial authentication\nPOST \u002Fapi\u002Fv1\u002Fauth\u002Fregister       - Account registration\nPOST \u002Fapi\u002Fv1\u002Fauth\u002Frefresh        - Token refresh\nPOST \u002Fapi\u002Fv1\u002Fauth\u002Flogout         - Session termination\nPOST \u002Fapi\u002Fv1\u002Fauth\u002Fforgot-password - Password reset\nPOST \u002Fapi\u002Fv1\u002Fauth\u002Fverify-otp     - OTP verification\nGET  \u002Fapi\u002Fv1\u002Fauth\u002Fme             - Authenticated user profile\n```\n\n### Step 2: Analyze Token Format and Security\n\n**JWT Analysis:**\n```bash\n# Decode JWT without verification\necho \"eyJhbGciOiJIUzI1NiIs...\" | cut -d. -f2 | base64 -d 2>\u002Fdev\u002Fnull\n\n# Check for common JWT vulnerabilities:\n# 1. None algorithm attack\n# Change header to: {\"alg\":\"none\",\"typ\":\"JWT\"}\n# Remove signature: header.payload.\n\n# 2. Algorithm confusion (RS256 to HS256)\n# If server uses RS256, try HS256 with public key as secret\n\n# 3. Weak signing key\n# Use hashcat or jwt-cracker to brute-force HMAC secret\nhashcat -m 16500 jwt.txt wordlist.txt\n\n# 4. Expiration bypass\n# Modify \"exp\" claim to future timestamp\n```\n\n**Opaque Token Analysis:**\n```\n- Test token length and entropy\n- Check if tokens are sequential\u002Fpredictable\n- Test token reuse after logout\n- Verify token invalidation on password change\n```\n\n### Step 3: Test Authentication Bypass\n\n```bash\n# Test missing authentication\ncurl -X GET https:\u002F\u002Fapi.target.com\u002Fapi\u002Fv1\u002Fusers\u002Fprofile\n\n# Test with empty\u002Fnull token\ncurl -X GET https:\u002F\u002Fapi.target.com\u002Fapi\u002Fv1\u002Fusers\u002Fprofile \\\n  -H \"Authorization: Bearer \"\n\ncurl -X GET https:\u002F\u002Fapi.target.com\u002Fapi\u002Fv1\u002Fusers\u002Fprofile \\\n  -H \"Authorization: Bearer null\"\n\n# Test with expired token (should fail)\ncurl -X GET https:\u002F\u002Fapi.target.com\u002Fapi\u002Fv1\u002Fusers\u002Fprofile \\\n  -H \"Authorization: Bearer \u003Cexpired_token>\"\n\n# Test token from different user\ncurl -X GET https:\u002F\u002Fapi.target.com\u002Fapi\u002Fv1\u002Fusers\u002F123\u002Fprofile \\\n  -H \"Authorization: Bearer \u003Cuser_456_token>\"\n```\n\n### Step 4: Test IDOR \u002F Broken Object-Level Authorization\n\n```bash\n# Change user ID in request path\ncurl -X GET https:\u002F\u002Fapi.target.com\u002Fapi\u002Fv1\u002Fusers\u002F123\u002Forders \\\n  -H \"Authorization: Bearer \u003Cuser_456_token>\"\n\n# Change object ID in request body\ncurl -X PUT https:\u002F\u002Fapi.target.com\u002Fapi\u002Fv1\u002Forders\u002F789 \\\n  -H \"Authorization: Bearer \u003Cuser_456_token>\" \\\n  -d '{\"status\": \"cancelled\"}'\n\n# Test horizontal privilege escalation\n# Access admin endpoints with regular user token\ncurl -X GET https:\u002F\u002Fapi.target.com\u002Fapi\u002Fv1\u002Fadmin\u002Fusers \\\n  -H \"Authorization: Bearer \u003Cregular_user_token>\"\n```\n\n### Step 5: Test Session Management\n\n```bash\n# Test concurrent sessions\n# Login from multiple devices simultaneously - should both remain valid?\n\n# Test session invalidation after logout\nTOKEN=$(curl -s -X POST https:\u002F\u002Fapi.target.com\u002Fapi\u002Fv1\u002Fauth\u002Flogin \\\n  -d '{\"email\":\"test@test.com\",\"password\":\"pass\"}' | jq -r '.token')\n\n# Logout\ncurl -X POST https:\u002F\u002Fapi.target.com\u002Fapi\u002Fv1\u002Fauth\u002Flogout \\\n  -H \"Authorization: Bearer $TOKEN\"\n\n# Try using the same token (should fail)\ncurl -X GET https:\u002F\u002Fapi.target.com\u002Fapi\u002Fv1\u002Fusers\u002Fme \\\n  -H \"Authorization: Bearer $TOKEN\"\n\n# Test session invalidation after password change\n# Token obtained before password change should be invalidated\n```\n\n### Step 6: Test OAuth 2.0 \u002F OIDC Mobile Flows\n\n```bash\n# Test for authorization code interception\n# Check if PKCE (Proof Key for Code Exchange) is enforced\n# Test with missing code_verifier parameter\n\n# Test redirect URI manipulation\n# Try custom scheme hijacking: myapp:\u002F\u002Fcallback\n# Test with modified redirect_uri parameter\n\n# Test scope escalation\n# Request higher privileges than granted\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **BOLA\u002FIDOR** | Broken Object Level Authorization - accessing resources by changing identifiers without server-side authorization checks |\n| **JWT** | JSON Web Token - self-contained authentication token with header, payload, and signature components |\n| **PKCE** | Proof Key for Code Exchange - OAuth 2.0 extension preventing authorization code interception in mobile apps |\n| **Token Refresh** | Mechanism for obtaining new access tokens using long-lived refresh tokens without re-authentication |\n| **Session Fixation** | Attack where adversary sets a known session ID before victim authenticates, then hijacks the session |\n\n## Tools & Systems\n\n- **Burp Suite**: HTTP proxy for intercepting and modifying authentication requests\n- **jwt_tool**: Python tool for testing JWT vulnerabilities (none algorithm, key confusion, claim manipulation)\n- **Postman**: API testing client for crafting authentication requests\n- **hashcat**: Password\u002FJWT secret cracking tool for testing HMAC signing key strength\n- **Autorize**: Burp Suite extension for automated authorization testing\n\n## Common Pitfalls\n\n- **Rate limiting masks issues**: API may rate-limit test requests. Use delays between requests and test from the tester's authorized perspective first.\n- **Token in URL**: Some mobile APIs pass tokens in URL query parameters, exposing them in server logs and browser history. Flag as finding even if authorization works correctly.\n- **Refresh token rotation**: Some APIs rotate refresh tokens on each use. If your test invalidates the refresh token, you may lock out your test account.\n- **Mobile-specific OAuth**: Mobile apps use custom URI schemes for OAuth redirects, which can be intercepted by malicious apps registered for the same scheme.\n",{"name":5,"tags":57,"author":62,"domain":50,"license":15,"version":63,"category":5,"nist_csf":64,"subdomain":58,"description":7,"mitre_attack":69},[58,59,60,49,33,61],"mobile-security","android","ios","penetration-testing","mahipal","1.0.0",[65,66,67,68],"PR.PS-01","PR.AA-05","ID.RA-01","DE.CM-09",[70,71,72,73,74],"T1059","T1056","T1036","T1078","T1068","main","5eea5b3296f4673b5f481e8bcc1ba76281149f16","modules\u002Ftesting-mobile-api-authentication",0,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core","https:\u002F\u002Fgithub.com\u002FHenriqueMC17","Qualquer tecnologia suficientemente avançada é indistinguível da mágica.","2026-09-28 22:40:38",{"source":8,"skillName":5,"commands":84,"prompt":94,"zipAvailable":95},[85,88,91],{"tool":86,"command":87},"npx","npx skills add HenriqueMC17\u002Fagente-core --skill testing-mobile-api-authentication",{"tool":89,"command":90},"bunx","bunx skills add HenriqueMC17\u002Fagente-core --skill testing-mobile-api-authentication",{"tool":92,"command":93},"pnpm","pnpm dlx skills add HenriqueMC17\u002Fagente-core --skill testing-mobile-api-authentication","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftesting-mobile-api-authentication\u002FSKILL.md",true,[97,103,108,114,118,122,128],{"path":98,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"assets\u002Ftemplate.md","ASSET","资产文件",971,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftesting-mobile-api-authentication\u002Fassets\u002Ftemplate.md",{"path":104,"resourceType":104,"resourceTypeDesc":105,"sizeBytes":106,"sourceHtmlUrl":107},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftesting-mobile-api-authentication\u002FLICENSE",{"path":109,"resourceType":110,"resourceTypeDesc":111,"sizeBytes":112,"sourceHtmlUrl":113},"references\u002Fapi-reference.md","REFERENCE","参考文档",1821,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftesting-mobile-api-authentication\u002Freferences\u002Fapi-reference.md",{"path":115,"resourceType":110,"resourceTypeDesc":111,"sizeBytes":116,"sourceHtmlUrl":117},"references\u002Fstandards.md",1458,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftesting-mobile-api-authentication\u002Freferences\u002Fstandards.md",{"path":119,"resourceType":110,"resourceTypeDesc":111,"sizeBytes":120,"sourceHtmlUrl":121},"references\u002Fworkflows.md",1517,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftesting-mobile-api-authentication\u002Freferences\u002Fworkflows.md",{"path":123,"resourceType":124,"resourceTypeDesc":125,"sizeBytes":126,"sourceHtmlUrl":127},"scripts\u002Fagent.py","SCRIPT","脚本",8107,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftesting-mobile-api-authentication\u002Fscripts\u002Fagent.py",{"path":129,"resourceType":124,"resourceTypeDesc":125,"sizeBytes":130,"sourceHtmlUrl":131},"scripts\u002Fprocess.py",9243,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftesting-mobile-api-authentication\u002Fscripts\u002Fprocess.py",[133,158,184,206,222,241],{"skillNo":134,"name":135,"nameZh":6,"description":136,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":137,"categories":138,"keywords":140,"publishedAt":52},"01M6HPFF0RCN0X6WT5EBSV71GY","validating-backup-integrity-for-recovery","Validate backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to ensure backups are reliable for disaster recovery and ransomware response scenarios.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[139],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[141,142,143,144,145,36,50,146,147,148,149,150,151,47,152,153,154,155,156,157],"integrity","backup","recovery","validating backup integrity for recovery","for","validate","verification","hash-verification","incident-response","ransomware","detection","t1490","disaster-recovery","restore","incident","disaster recovery","ransomware response",{"skillNo":159,"name":160,"nameZh":6,"description":161,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":162,"categories":163,"keywords":164,"publishedAt":52},"01M6HPFAWJVFK25Q33K3T7WQ8G","triaging-vulnerabilities-with-ssvc-framework","Triage and prioritize vulnerabilities using CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree framework to produce actionable remediation priorities.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[],[165,166,167,168,169,50,170,171,172,173,174,175,176,177,178,179,180,181,182,183],"vulnerabilities","framework","ssvc","triaging vulnerabilities with ssvc framework","with","triage and prioritize","CISA","vulnerability-management","risk-management","cvss","remediation","vulnerability","prioritization","decision-tree","prioritize","decision","priorities","actionable","tree",{"skillNo":185,"name":186,"nameZh":6,"description":187,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":188,"categories":189,"keywords":190,"publishedAt":52},"01M6HPF6JS9X72WP59094H3ASQ","triaging-security-incident","Performs initial triage of security incidents to determine severity, scope, and required response actions using the NIST SP 800-61r3 and SANS PICERL frameworks. Classifies incidents by type, assigns priority based on business impact, and routes...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident\u002FSKILL.md",[],[51,191,155,50,192,193,194,47,152,195,196,197,198,199,200,201,202,203,204,205],"triaging security incident","actions","soc","NIST","analysis","severity-classification","incident-triage","SANS-PICERL","SOC-operations","picerl","conversion","isolation","scope","impact","consistency",{"skillNo":207,"name":208,"nameZh":6,"description":209,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":210,"categories":211,"keywords":212,"publishedAt":52},"01M6HPF2EX6ZYNYYHKBRJN7GEF","triaging-security-incident-with-ir-playbook","Classify and prioritize security incidents using structured IR playbooks to determine severity, assign response teams, and initiate appropriate response procedures.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident-with-ir-playbook\u002FSKILL.md",[],[51,213,214,191,155,169,50,215,193,149,216,217,47,152,218,196,179,219,220,221],"playbook","triaging security incident with ir playbook","teams","IR-playbook","severity","classification","classify","incidents","initiate",{"skillNo":223,"name":224,"nameZh":6,"description":225,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":226,"categories":227,"keywords":228,"publishedAt":52},"01M6HPEY9XPGE7X95AG4XJFQAW","triaging-security-alerts-in-splunk","Triages security alerts in Splunk Enterprise Security by classifying severity, investigating notable events, correlating related telemetry, and making escalation or closure decisions using SPL queries and the Incident Review dashboard. Use when...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-alerts-in-splunk\u002FSKILL.md",[],[51,229,230,231,232,233,50,234,235,236,193,237,47,238,239,240,199,45,155,43],"security alerts","splunk","triaging security alerts in splunk","alerts","review","siem","dashboard","search","correlation-search","t1566","notable-events","incident-review",{"skillNo":242,"name":243,"nameZh":6,"description":244,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":245,"categories":246,"keywords":247,"publishedAt":52},"01M6HPET6XGEPEJPN7V032JGZ0","tracking-threat-actor-infrastructure","Threat actor infrastructure tracking involves monitoring and mapping adversary-controlled assets including command-and-control (C2) servers, phishing domains, exploit kit hosts, bulletproof hosting, a","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftracking-threat-actor-infrastructure\u002FSKILL.md",[],[248,249,250,251,50,252,253,254,255,256,257,238,258,259,45,260,43,261,262,263],"infrastructure","tracking threat actor infrastructure","tracking","threat","monitoring","mitre-attack","threat-actor","threat-intelligence","command-and-control","dns","command","exploit","intelligence","domains","kit","hosts"]