[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71AMCF8XRZN6BDYB41T5WSV":3,"skill-same:01M71AMCF8XRZN6BDYB41T5WSV":73},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":52,"commitSha":53,"skillDirectory":54,"forksCount":55,"repositoryHtmlUrl":56,"repositoryHomepageUrl":6,"ownerHtmlUrl":57,"ownerBlogUrl":6,"ownerDescription":58,"updatedAt":59,"install":60,"resources":72},"01M71AMCF8XRZN6BDYB41T5WSV","cyber-building-incident-timeline-with-timesketch",null,"Build collaborative forensic incident timelines using Timesketch to ingest, normalize, and analyze multi-source event data for attack chain reconstruction and investigation documentation.","nexuslinkproductions\u002Fyuri-os","nexuslinkproductions","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F273246263?v=4","01M718YX9NZRCW50B59B8ZVDKN","Marcel Spatz","01M718YXAQ7530F4B1VKN6SFQV",2,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fcyber-building-incident-timeline-with-timesketch\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"with","timesketch","building incident timeline with timesketch","cyber building incident timeline with timesketch","timeline","incident","normalize","reconstruction","source","data","subdomain","documentation","analyze","incident-investigation","analysis","false","cybersecurity","timeline-analysis","chain","T1059.001","2026-11-10 10:12:30",false,"---\nname: cyber-building-incident-timeline-with-timesketch\ndescription: \"Build collaborative forensic incident timelines using Timesketch to ingest, normalize, and analyze multi-source event data for attack chain reconstruction and investigation documentation.\"\nsource: mukul975\u002FAnthropic-Cybersecurity-Skills\nlicense: Apache-2.0\nauthorized_lab: false\norigin_frontmatter: \"name: building-incident-timeline-with-timesketch | description: Build collaborative forensic incident timelines using Timesketch to ingest, |   normalize, and analyze multi-source event data for attack chain reconstruction and |   investigation documentation. | domain: cybersecurity | subdomain: incident-response | tags: | - timesketch | - timeline-analysis | - forensic-timeline | - plaso | - dfir | - incident-investigation | - collaborative-forensics | mitre_attack: | - T1059.001 | - T1021.002 \"\nhide: true\n---\n\n> Defensive\u002Fanalysis cyber skill. Source: mukul975\u002FAnthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.\n\n# Building Incident Timeline with Timesketch\n\n## Overview\n\nTimesketch is an open-source collaborative forensic timeline analysis tool developed by Google that enables security teams to visualize and analyze chronological data from multiple sources during incident investigations. It ingests logs and artifacts from endpoints, servers, and cloud services, normalizes them into a unified searchable timeline, and provides powerful analysis capabilities including built-in analyzers, tagging, sketch annotations, and story building. Timesketch integrates with Plaso (log2timeline) for artifact parsing and supports direct CSV\u002FJSONL ingestion for rapid timeline construction during active incidents.\n\n\n## When to Use\n\n- When deploying or configuring building incident timeline with timesketch capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Familiarity with incident response concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Architecture and Components\n\n### Core Components\n- **Timesketch Server**: Web application with REST API for timeline management\n- **OpenSearch\u002FElasticsearch**: Backend storage and search engine for timeline events\n- **PostgreSQL**: Metadata storage for sketches, stories, and user data\n- **Redis**: Task queue management for background processing\n- **Celery Workers**: Asynchronous processing of timeline uploads and analyzers\n\n### Data Flow\n```\nEvidence Sources --> Plaso\u002Flog2timeline --> Plaso storage file (.plaso)\n     |                                           |\n     v                                           v\n  CSV\u002FJSONL --> Timesketch Importer --> OpenSearch Index\n                                           |\n                                           v\n                                    Timesketch Web UI\n                                    (Search, Analyze, Story)\n```\n\n## Deployment\n\n### Docker Deployment (Recommended)\n```bash\n# Clone Timesketch repository\ngit clone https:\u002F\u002Fgithub.com\u002Fgoogle\u002Ftimesketch.git\ncd timesketch\n\n# Run deployment helper script\ncd docker\nsudo docker compose up -d\n\n# Default access: https:\u002F\u002Flocalhost:443\n# Admin credentials generated during first run\n```\n\n### System Requirements\n- Minimum 8 GB RAM (16+ GB recommended for large investigations)\n- 4 CPU cores minimum\n- SSD storage for OpenSearch indices\n- Docker and Docker Compose installed\n\n## Data Ingestion Methods\n\n### Method 1: Plaso Integration (Comprehensive)\n```bash\n# Process disk image with log2timeline\nlog2timeline.py --storage-file evidence.plaso \u002Fpath\u002Fto\u002Fdisk\u002Fimage\n\n# Process Windows event logs\nlog2timeline.py --parsers winevtx --storage-file windows_events.plaso \u002Fpath\u002Fto\u002Fevtx\u002F\n\n# Process multiple evidence sources\nlog2timeline.py --parsers \"winevtx,prefetch,amcache,shimcache,userassist\" \\\n  --storage-file full_analysis.plaso \u002Fpath\u002Fto\u002Fmounted\u002Fimage\u002F\n\n# Import Plaso file into Timesketch\ntimesketch_importer -s \"Case-2025-001\" -t \"Endpoint-WKS01\" evidence.plaso\n```\n\n### Method 2: CSV Import (Quick Ingestion)\n```csv\nmessage,datetime,timestamp_desc,source,hostname\n\"User login detected\",\"2025-01-15T08:30:00Z\",\"Event Recorded\",\"Security Log\",\"DC01\"\n\"PowerShell execution\",\"2025-01-15T08:31:15Z\",\"Event Recorded\",\"PowerShell\",\"WKS042\"\n```\n\n```bash\n# Import CSV directly\ntimesketch_importer -s \"Case-2025-001\" -t \"Quick-Triage\" events.csv\n```\n\n### Method 3: JSONL Import (Structured Data)\n```json\n{\"message\": \"Suspicious logon from 10.1.2.3\", \"datetime\": \"2025-01-15T08:30:00Z\", \"timestamp_desc\": \"Event Recorded\", \"source_short\": \"Security\", \"hostname\": \"DC01\"}\n```\n\n### Method 4: Sigma Rule Integration\n```bash\n# Upload Sigma rules for automated detection\ntimesketch_importer --sigma-rules \u002Fpath\u002Fto\u002Fsigma\u002Frules\u002F\n```\n\n## Analysis Workflow\n\n### Step 1: Create Investigation Sketch\n```\n1. Log into Timesketch web interface\n2. Create new sketch (investigation case)\n3. Add relevant timelines to the sketch\n4. Set sketch description and tags\n```\n\n### Step 2: Run Built-in Analyzers\nTimesketch includes analyzers that automatically identify:\n- **Browser Search Analyzer**: Extracts search queries from browser history\n- **Chain of Events Analyzer**: Links related events (download -> execute)\n- **Domain Analyzer**: Extracts and categorizes domain names\n- **Feature Extraction Analyzer**: Identifies IPs, URLs, hashes\n- **Geo Location Analyzer**: Maps events to geographic locations\n- **Similarity Scorer**: Finds similar events across timelines\n- **Sigma Analyzer**: Matches events against Sigma detection rules\n- **Account Finder**: Identifies user account activity patterns\n- **Tagger**: Applies labels based on predefined rules\n\n### Step 3: Search and Filter\n```\n# Search examples in Timesketch query language\n\n# Find all events related to specific user\nsource_short:Security AND message:\"john.admin\"\n\n# Find PowerShell execution events\ndata_type:\"windows:evtx:record\" AND event_identifier:4104\n\n# Find lateral movement indicators\nsource_short:Security AND event_identifier:4624 AND xml_string:\"LogonType\\\">3\"\n\n# Find events within specific time range\ndatetime:[2025-01-15T00:00:00 TO 2025-01-15T23:59:59]\n\n# Find file creation events\ndata_type:\"fs:stat\" AND timestamp_desc:\"Creation Time\"\n\n# Search with tags\ntag:\"suspicious\" OR tag:\"lateral_movement\"\n```\n\n### Step 4: Build Investigation Story\n```\n1. Create new story within the sketch\n2. Add search views that support each finding\n3. Annotate key events with investigator notes\n4. Link events to MITRE ATT&CK techniques\n5. Document the attack narrative chronologically\n6. Export story for inclusion in incident report\n```\n\n## Advanced Features\n\n### Collaborative Investigation\n- Multiple analysts work on the same sketch simultaneously\n- Comments and annotations persist on events\n- Saved searches shared across the team\n- Investigation stories document findings in context\n\n### API Automation\n```python\nfrom timesketch_api_client import config\nfrom timesketch_api_client import client as ts_client\n\n# Connect to Timesketch\nts = ts_client.TimesketchApi(\n    host_uri=\"https:\u002F\u002Ftimesketch.local\",\n    username=\"analyst\",\n    password=\"password\"\n)\n\n# Get sketch\nsketch = ts.get_sketch(1)\n\n# Search events\nsearch = sketch.explore(\n    query_string='event_identifier:4624 AND LogonType:3',\n    return_fields='datetime,message,hostname,source_short'\n)\n\n# Add tags to events\nfor event in search.get('objects', []):\n    sketch.tag_event(event['_id'], ['lateral_movement'])\n```\n\n### Integration with Dissect\n```bash\n# Use Dissect for faster artifact parsing (alternative to Plaso)\ntarget-query -f timesketch:\u002F\u002Ftimesketch.local\u002Fcase-001 \\\n  targets\u002Fhostname\u002F -q \"windows.evtx\" --limit 0\n```\n\n## Key Data Sources for Timeline Building\n\n| Source | Parser | Evidence Value |\n|--------|--------|---------------|\n| Windows Event Logs (.evtx) | winevtx | Authentication, process execution, services |\n| Prefetch Files | prefetch | Program execution history |\n| MFT ($MFT) | mft | File system activity |\n| Registry Hives | winreg | System configuration, persistence |\n| Browser History | chrome\u002Ffirefox | Web activity, downloads |\n| Syslog | syslog | Linux\u002Fnetwork device events |\n| CloudTrail Logs | jsonl | AWS API activity |\n| Azure Activity Logs | jsonl | Azure resource operations |\n| Firewall Logs | csv\u002Fjsonl | Network connections |\n| Proxy Logs | csv\u002Fjsonl | HTTP\u002FHTTPS traffic |\n\n## MITRE ATT&CK Mapping\n\n| Technique | Timeline Indicators |\n|-----------|-------------------|\n| Initial Access (TA0001) | First malicious event, phishing email receipt |\n| Execution (T1059) | PowerShell\u002FCMD events, process creation |\n| Persistence (TA0003) | Registry modifications, scheduled tasks, services |\n| Lateral Movement (TA0008) | Remote logons, SMB connections, RDP sessions |\n| Exfiltration (TA0010) | Large data transfers, cloud storage uploads |\n\n## References\n\n- [Timesketch Official Documentation](https:\u002F\u002Ftimesketch.org\u002F)\n- [Timesketch GitHub Repository](https:\u002F\u002Fgithub.com\u002Fgoogle\u002Ftimesketch)\n- [CISA Timesketch Resource](https:\u002F\u002Fwww.cisa.gov\u002Fresources-tools\u002Fservices\u002Ftimesketch)\n- [Hunt and Hackett: Scalable Forensics with Dissect and Timesketch](https:\u002F\u002Fwww.huntandhackett.com\u002Fblog\u002Fscalable-forensics-timeline-analysis-using-dissect-and-timesketch)\n- [Plaso (log2timeline) Documentation](https:\u002F\u002Fplaso.readthedocs.io\u002F)\n","> Defensive\u002Fanalysis cyber skill. Source: mukul975\u002FAnthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.\n\n# Building Incident Timeline with Timesketch\n\n## Overview\n\nTimesketch is an open-source collaborative forensic timeline analysis tool developed by Google that enables security teams to visualize and analyze chronological data from multiple sources during incident investigations. It ingests logs and artifacts from endpoints, servers, and cloud services, normalizes them into a unified searchable timeline, and provides powerful analysis capabilities including built-in analyzers, tagging, sketch annotations, and story building. Timesketch integrates with Plaso (log2timeline) for artifact parsing and supports direct CSV\u002FJSONL ingestion for rapid timeline construction during active incidents.\n\n\n## When to Use\n\n- When deploying or configuring building incident timeline with timesketch capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Familiarity with incident response concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Architecture and Components\n\n### Core Components\n- **Timesketch Server**: Web application with REST API for timeline management\n- **OpenSearch\u002FElasticsearch**: Backend storage and search engine for timeline events\n- **PostgreSQL**: Metadata storage for sketches, stories, and user data\n- **Redis**: Task queue management for background processing\n- **Celery Workers**: Asynchronous processing of timeline uploads and analyzers\n\n### Data Flow\n```\nEvidence Sources --> Plaso\u002Flog2timeline --> Plaso storage file (.plaso)\n     |                                           |\n     v                                           v\n  CSV\u002FJSONL --> Timesketch Importer --> OpenSearch Index\n                                           |\n                                           v\n                                    Timesketch Web UI\n                                    (Search, Analyze, Story)\n```\n\n## Deployment\n\n### Docker Deployment (Recommended)\n```bash\n# Clone Timesketch repository\ngit clone https:\u002F\u002Fgithub.com\u002Fgoogle\u002Ftimesketch.git\ncd timesketch\n\n# Run deployment helper script\ncd docker\nsudo docker compose up -d\n\n# Default access: https:\u002F\u002Flocalhost:443\n# Admin credentials generated during first run\n```\n\n### System Requirements\n- Minimum 8 GB RAM (16+ GB recommended for large investigations)\n- 4 CPU cores minimum\n- SSD storage for OpenSearch indices\n- Docker and Docker Compose installed\n\n## Data Ingestion Methods\n\n### Method 1: Plaso Integration (Comprehensive)\n```bash\n# Process disk image with log2timeline\nlog2timeline.py --storage-file evidence.plaso \u002Fpath\u002Fto\u002Fdisk\u002Fimage\n\n# Process Windows event logs\nlog2timeline.py --parsers winevtx --storage-file windows_events.plaso \u002Fpath\u002Fto\u002Fevtx\u002F\n\n# Process multiple evidence sources\nlog2timeline.py --parsers \"winevtx,prefetch,amcache,shimcache,userassist\" \\\n  --storage-file full_analysis.plaso \u002Fpath\u002Fto\u002Fmounted\u002Fimage\u002F\n\n# Import Plaso file into Timesketch\ntimesketch_importer -s \"Case-2025-001\" -t \"Endpoint-WKS01\" evidence.plaso\n```\n\n### Method 2: CSV Import (Quick Ingestion)\n```csv\nmessage,datetime,timestamp_desc,source,hostname\n\"User login detected\",\"2025-01-15T08:30:00Z\",\"Event Recorded\",\"Security Log\",\"DC01\"\n\"PowerShell execution\",\"2025-01-15T08:31:15Z\",\"Event Recorded\",\"PowerShell\",\"WKS042\"\n```\n\n```bash\n# Import CSV directly\ntimesketch_importer -s \"Case-2025-001\" -t \"Quick-Triage\" events.csv\n```\n\n### Method 3: JSONL Import (Structured Data)\n```json\n{\"message\": \"Suspicious logon from 10.1.2.3\", \"datetime\": \"2025-01-15T08:30:00Z\", \"timestamp_desc\": \"Event Recorded\", \"source_short\": \"Security\", \"hostname\": \"DC01\"}\n```\n\n### Method 4: Sigma Rule Integration\n```bash\n# Upload Sigma rules for automated detection\ntimesketch_importer --sigma-rules \u002Fpath\u002Fto\u002Fsigma\u002Frules\u002F\n```\n\n## Analysis Workflow\n\n### Step 1: Create Investigation Sketch\n```\n1. Log into Timesketch web interface\n2. Create new sketch (investigation case)\n3. Add relevant timelines to the sketch\n4. Set sketch description and tags\n```\n\n### Step 2: Run Built-in Analyzers\nTimesketch includes analyzers that automatically identify:\n- **Browser Search Analyzer**: Extracts search queries from browser history\n- **Chain of Events Analyzer**: Links related events (download -> execute)\n- **Domain Analyzer**: Extracts and categorizes domain names\n- **Feature Extraction Analyzer**: Identifies IPs, URLs, hashes\n- **Geo Location Analyzer**: Maps events to geographic locations\n- **Similarity Scorer**: Finds similar events across timelines\n- **Sigma Analyzer**: Matches events against Sigma detection rules\n- **Account Finder**: Identifies user account activity patterns\n- **Tagger**: Applies labels based on predefined rules\n\n### Step 3: Search and Filter\n```\n# Search examples in Timesketch query language\n\n# Find all events related to specific user\nsource_short:Security AND message:\"john.admin\"\n\n# Find PowerShell execution events\ndata_type:\"windows:evtx:record\" AND event_identifier:4104\n\n# Find lateral movement indicators\nsource_short:Security AND event_identifier:4624 AND xml_string:\"LogonType\\\">3\"\n\n# Find events within specific time range\ndatetime:[2025-01-15T00:00:00 TO 2025-01-15T23:59:59]\n\n# Find file creation events\ndata_type:\"fs:stat\" AND timestamp_desc:\"Creation Time\"\n\n# Search with tags\ntag:\"suspicious\" OR tag:\"lateral_movement\"\n```\n\n### Step 4: Build Investigation Story\n```\n1. Create new story within the sketch\n2. Add search views that support each finding\n3. Annotate key events with investigator notes\n4. Link events to MITRE ATT&CK techniques\n5. Document the attack narrative chronologically\n6. Export story for inclusion in incident report\n```\n\n## Advanced Features\n\n### Collaborative Investigation\n- Multiple analysts work on the same sketch simultaneously\n- Comments and annotations persist on events\n- Saved searches shared across the team\n- Investigation stories document findings in context\n\n### API Automation\n```python\nfrom timesketch_api_client import config\nfrom timesketch_api_client import client as ts_client\n\n# Connect to Timesketch\nts = ts_client.TimesketchApi(\n    host_uri=\"https:\u002F\u002Ftimesketch.local\",\n    username=\"analyst\",\n    password=\"password\"\n)\n\n# Get sketch\nsketch = ts.get_sketch(1)\n\n# Search events\nsearch = sketch.explore(\n    query_string='event_identifier:4624 AND LogonType:3',\n    return_fields='datetime,message,hostname,source_short'\n)\n\n# Add tags to events\nfor event in search.get('objects', []):\n    sketch.tag_event(event['_id'], ['lateral_movement'])\n```\n\n### Integration with Dissect\n```bash\n# Use Dissect for faster artifact parsing (alternative to Plaso)\ntarget-query -f timesketch:\u002F\u002Ftimesketch.local\u002Fcase-001 \\\n  targets\u002Fhostname\u002F -q \"windows.evtx\" --limit 0\n```\n\n## Key Data Sources for Timeline Building\n\n| Source | Parser | Evidence Value |\n|--------|--------|---------------|\n| Windows Event Logs (.evtx) | winevtx | Authentication, process execution, services |\n| Prefetch Files | prefetch | Program execution history |\n| MFT ($MFT) | mft | File system activity |\n| Registry Hives | winreg | System configuration, persistence |\n| Browser History | chrome\u002Ffirefox | Web activity, downloads |\n| Syslog | syslog | Linux\u002Fnetwork device events |\n| CloudTrail Logs | jsonl | AWS API activity |\n| Azure Activity Logs | jsonl | Azure resource operations |\n| Firewall Logs | csv\u002Fjsonl | Network connections |\n| Proxy Logs | csv\u002Fjsonl | HTTP\u002FHTTPS traffic |\n\n## MITRE ATT&CK Mapping\n\n| Technique | Timeline Indicators |\n|-----------|-------------------|\n| Initial Access (TA0001) | First malicious event, phishing email receipt |\n| Execution (T1059) | PowerShell\u002FCMD events, process creation |\n| Persistence (TA0003) | Registry modifications, scheduled tasks, services |\n| Lateral Movement (TA0008) | Remote logons, SMB connections, RDP sessions |\n| Exfiltration (TA0010) | Large data transfers, cloud storage uploads |\n\n## References\n\n- [Timesketch Official Documentation](https:\u002F\u002Ftimesketch.org\u002F)\n- [Timesketch GitHub Repository](https:\u002F\u002Fgithub.com\u002Fgoogle\u002Ftimesketch)\n- [CISA Timesketch Resource](https:\u002F\u002Fwww.cisa.gov\u002Fresources-tools\u002Fservices\u002Ftimesketch)\n- [Hunt and Hackett: Scalable Forensics with Dissect and Timesketch](https:\u002F\u002Fwww.huntandhackett.com\u002Fblog\u002Fscalable-forensics-timeline-analysis-using-dissect-and-timesketch)\n- [Plaso (log2timeline) Documentation](https:\u002F\u002Fplaso.readthedocs.io\u002F)\n",{"hide":49,"name":5,"source":50,"license":15,"description":7,"authorized_lab":45,"origin_frontmatter":51},true,"mukul975\u002FAnthropic-Cybersecurity-Skills","name: building-incident-timeline-with-timesketch | description: Build collaborative forensic incident timelines using Timesketch to ingest, |   normalize, and analyze multi-source event data for attack chain reconstruction and |   investigation documentation. | domain: cybersecurity | subdomain: incident-response | tags: | - timesketch | - timeline-analysis | - forensic-timeline | - plaso | - dfir | - incident-investigation | - collaborative-forensics | mitre_attack: | - T1059.001 | - T1021.002 ","main","4c6d8d65f3d6096e2fc25b0845e481dda73c2794",".claude\u002Fskills\u002Fcyber-building-incident-timeline-with-timesketch",0,"https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions","Building deterministic AI governance and continuity systems. Workflow architect + visual storyteller","2026-11-11 16:42:59",{"source":8,"skillName":5,"commands":61,"prompt":71,"zipAvailable":49},[62,65,68],{"tool":63,"command":64},"npx","npx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-building-incident-timeline-with-timesketch",{"tool":66,"command":67},"bunx","bunx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-building-incident-timeline-with-timesketch",{"tool":69,"command":70},"pnpm","pnpm dlx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-building-incident-timeline-with-timesketch","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fcyber-building-incident-timeline-with-timesketch\u002FSKILL.md",[],[74,97,121,151,178,197],{"skillNo":75,"name":76,"nameZh":6,"description":77,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":78,"licenseFileUrl":6,"sourceHtmlUrl":79,"categories":80,"keywords":81,"publishedAt":44},"01M71CG1AME5WC0A79AE65WT0X","zoom-out","Tell the agent to zoom out and give broader context or a higher-level perspective. Use when you're unfamiliar with a section of code or need to understand how it fits into the bigger picture.","MIT","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fzoom-out\u002FSKILL.md",[],[82,83,24,84,85,86,87,88,89,90,91,92,93,94,95,96],"zoom out","zoom","harness","how","section","re","true","understand","use","perspective","when","you","code","it","context",{"skillNo":98,"name":99,"nameZh":6,"description":100,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":78,"licenseFileUrl":6,"sourceHtmlUrl":101,"categories":102,"keywords":103,"publishedAt":44},"01M71CFY9ATD0BAXV6B14HFG7C","yuri-shura","6-perspective adversarial review for high-stakes turns (architecture decisions, refactor planning, deployment review) — fans out architect, adversary (7-vector attack), maintainer, ops, product, and security perspectives in parallel, then consolidates. Use when user says 'review this decision', '\u002Fshura', 'adversarial review', 'what could go wrong', 'architecture review', or 'deployment review'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-shura\u002FSKILL.md",[],[104,105,84,106,107,108,109,110,111,112,113,90,114,92,115,116,117,118,119,120],"yuri shura","parallel","architecture review","planning","for","deployment","vector","strategic review","decision","strategic","ops","workflow","decisions","architecture","review","perspectives","adversarial",{"skillNo":122,"name":123,"nameZh":6,"description":124,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":78,"licenseFileUrl":6,"sourceHtmlUrl":125,"categories":126,"keywords":132,"publishedAt":44},"01M71CFTTYW1HA2MNX38EV1GJ5","yuri-sales-intelligence","Unified sales and outreach skill generating cold outreach openers, social selling sequences, objection rebuttals, and ad creative for any paid platform — multi-persona aware, adapting tone and offer frame to buyer type. Use when user says 'write a cold email', 'outreach sequence', 'objection handling', 'ad copy', or 'sales pitch'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-sales-intelligence\u002FSKILL.md",[127],{"categoryNo":128,"categoryName":129,"taxonomyType":130,"taxonomyTypeDesc":131},"01JBSEEDCAT000000000000005","邮件与沟通","SCENARIO","使用场景",[133,134,135,136,137,138,139,140,141,92,142,143,144,145,146,147,148,108,149,150],"intelligence","sales intelligence","yuri sales intelligence","sales","cold","paid","social","persona","pitch","cold email","ad creative","write","sequences","sequence","platform","email","cold outreach","frame",{"skillNo":152,"name":153,"nameZh":6,"description":154,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":78,"licenseFileUrl":6,"sourceHtmlUrl":155,"categories":156,"keywords":163,"publishedAt":44},"01M71CFQMBFTFADJNGP0Z2WCYK","yuri-code-intelligence","Unified code quality intelligence layer that diagnoses code smells (Long Method, Feature Envy, design pattern issues), prescribes targeted Fowler refactoring techniques, and reviews code for security, performance, and clarity. Use when user says 'review this code', 'refactor this', 'what's wrong with this method', 'code smells', or 'clean this up'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-code-intelligence\u002FSKILL.md",[157,160],{"categoryNo":158,"categoryName":159,"taxonomyType":130,"taxonomyTypeDesc":131},"01JBSEEDCAT000000000000007","代码审查",{"categoryNo":161,"categoryName":162,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000030","开发工程师",[164,94,165,133,84,166,167,168,108,169,170,171,172,173,174,175,176,177,90,92],"yuri code intelligence","code intelligence","reviews","code quality","feature","performance","code review","long","up","issues","clean","techniques","improve","design",{"skillNo":179,"name":180,"nameZh":6,"description":181,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":78,"licenseFileUrl":6,"sourceHtmlUrl":182,"categories":183,"keywords":184,"publishedAt":44},"01M71CFP32RT6GD3GKNHCJP8VP","yuri-adw","Invoke when user asks to run the ADW loop \u002F agentic engineering loop \u002F software factory workflow.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-adw\u002FSKILL.md",[],[185,186,187,188,189,190,191,192,193,92,194,115,195,196],"yuri adw","run","engineering loop","software factory","software","agentic engineering","factory","loop","invoke","engineering","agentic","user",{"skillNo":198,"name":199,"nameZh":6,"description":200,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":78,"licenseFileUrl":6,"sourceHtmlUrl":201,"categories":202,"keywords":215,"publishedAt":44},"01M71CFK4VPEKY6A73237P7RSN","writing-skills","Use when creating new skills, editing existing skills, or verifying skills work before deployment","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fwriting-skills\u002FSKILL.md",[203,206,209,212],{"categoryNo":204,"categoryName":205,"taxonomyType":130,"taxonomyTypeDesc":131},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":207,"categoryName":208,"taxonomyType":130,"taxonomyTypeDesc":131},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":210,"categoryName":211,"taxonomyType":130,"taxonomyTypeDesc":131},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":213,"categoryName":214,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000036","内容创作者",[216,217,218,92,115,219,84,220,109,90,221],"writing","writing skills","new","work","editing","Existing"]