[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71C5QM2K73VJM471CC3KZ60":3,"skill-same:01M71C5QM2K73VJM471CC3KZ60":61},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":29,"linkOnly":30,"markdownContent":31,"markdownBody":32,"frontMatter":33,"refName":34,"commitSha":35,"skillDirectory":36,"forksCount":14,"repositoryHtmlUrl":37,"repositoryHomepageUrl":6,"ownerHtmlUrl":38,"ownerBlogUrl":6,"ownerDescription":39,"updatedAt":40,"install":41,"resources":54},"01M71C5QM2K73VJM471CC3KZ60","cloud-containers-opa",null,"6. **Test Rego policies** - Use `opa test` or Rego Playground before deploying 7.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud-containers-opa\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28],"opa","containers","cloud","cloud containers opa","cloud containers","use","cybersecurity","test","rego","playground","2026-11-10 10:12:30",false,"---\nname: cloud-containers-opa\ndescription: \"6. **Test Rego policies** - Use `opa test` or Rego Playground before deploying 7.\"\ndomain: cybersecurity\n---\n\n# Implementing OPA Gatekeeper for Policy Enforcement\n\n## Overview\n\nOPA Gatekeeper is a Kubernetes admission controller that enforces policies written in Rego. It uses ConstraintTemplates (policy blueprints with Rego logic) and Constraints (instantiated policies with parameters) to validate, mutate, or deny Kubernetes resource requests at admission time.\n\n## When to Use\n\n- When deploying or configuring implementing opa gatekeeper for policy enforcement capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Kubernetes cluster v1.24+\n- Helm 3\n- kubectl with cluster-admin access\n- Familiarity with Rego policy language\n\n## Installing Gatekeeper\n\n```bash\n# Install via Helm\nhelm repo add gatekeeper https:\u002F\u002Fopen-policy-agent.github.io\u002Fgatekeeper\u002Fcharts\nhelm repo update\n\nhelm install gatekeeper gatekeeper\u002Fgatekeeper \\\n  --namespace gatekeeper-system --create-namespace \\\n  --set replicas=3 \\\n  --set audit.replicas=1 \\\n  --set audit.logLevel=INFO\n\n# Verify\nkubectl get pods -n gatekeeper-system\nkubectl get crd | grep gatekeeper\n```\n\n### Verify Installation\n\n```bash\n# Check webhook\nkubectl get validatingwebhookconfigurations gatekeeper-validating-webhook-configuration\n\n# Check CRDs\nkubectl get crd constrainttemplates.plugins.gatekeeper.sh\nkubectl get crd configs.config.gatekeeper.sh\n```\n\n## ConstraintTemplate Examples\n\n### 1. Require Labels on Resources\n\n```yaml\n# template-required-labels.yaml\napiVersion: plugins.gatekeeper.sh\u002Fv1\nkind: ConstraintTemplate\nmetadata:\n  name: k8srequiredlabels\nspec:\n  crd:\n    spec:\n      names:\n        kind: K8sRequiredLabels\n      validation:\n        openAPIV3Schema:\n          type: object\n          properties:\n            labels:\n              type: array\n              items:\n                type: string\n  targets:\n    - target: admission.k8s.gatekeeper.sh\n      rego: |\n        package k8srequiredlabels\n\n        violation[{\"msg\": msg, \"details\": {\"missing_labels\": missing}}] {\n          provided := {label | input.review.object.metadata.labels[label]}\n          required := {label | label := input.parameters.labels[_]}\n          missing := required - provided\n          count(missing) > 0\n          msg := sprintf(\"Missing required labels: %v\", [missing])\n        }\n```\n\n```yaml\n# constraint-require-team-label.yaml\napiVersion: constraints.gatekeeper.sh\u002Fv1beta1\nkind: K8sRequiredLabels\nmetadata:\n  name: require-team-label\nspec:\n  match:\n    kinds:\n      - apiGroups: [\"\"]\n        kinds: [\"Namespace\"]\n      - apiGroups: [\"apps\"]\n        kinds: [\"Deployment\"]\n  parameters:\n    labels:\n      - \"team\"\n      - \"environment\"\n```\n\n### 2. Block Privileged Containers\n\n```yaml\n# template-block-privileged.yaml\napiVersion: plugins.gatekeeper.sh\u002Fv1\nkind: ConstraintTemplate\nmetadata:\n  name: k8sblockprivileged\nspec:\n  crd:\n    spec:\n      names:\n        kind: K8sBlockPrivileged\n  targets:\n    - target: admission.k8s.gatekeeper.sh\n      rego: |\n        package k8sblockprivileged\n\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.containers[_]\n          container.securityContext.privileged == true\n          msg := sprintf(\"Privileged container not allowed: %v\", [container.name])\n        }\n\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.initContainers[_]\n          container.securityContext.privileged == true\n          msg := sprintf(\"Privileged init container not allowed: %v\", [container.name])\n        }\n```\n\n```yaml\n# constraint-block-privileged.yaml\napiVersion: constraints.gatekeeper.sh\u002Fv1beta1\nkind: K8sBlockPrivileged\nmetadata:\n  name: block-privileged-containers\nspec:\n  match:\n    kinds:\n      - apiGroups: [\"\"]\n        kinds: [\"Pod\"]\n    namespaces:\n      - \"production\"\n      - \"staging\"\n```\n\n### 3. Restrict Container Image Registries\n\n```yaml\n# template-allowed-repos.yaml\napiVersion: plugins.gatekeeper.sh\u002Fv1\nkind: ConstraintTemplate\nmetadata:\n  name: k8sallowedrepos\nspec:\n  crd:\n    spec:\n      names:\n        kind: K8sAllowedRepos\n      validation:\n        openAPIV3Schema:\n          type: object\n          properties:\n            repos:\n              type: array\n              items:\n                type: string\n  targets:\n    - target: admission.k8s.gatekeeper.sh\n      rego: |\n        package k8sallowedrepos\n\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.containers[_]\n          not image_matches(container.image)\n          msg := sprintf(\"Container image %v is not from an allowed registry. Allowed: %v\", [container.image, input.parameters.repos])\n        }\n\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.initContainers[_]\n          not image_matches(container.image)\n          msg := sprintf(\"Init container image %v is not from an allowed registry. Allowed: %v\", [container.image, input.parameters.repos])\n        }\n\n        image_matches(image) {\n          repo := input.parameters.repos[_]\n          startswith(image, repo)\n        }\n```\n\n```yaml\n# constraint-allowed-repos.yaml\napiVersion: constraints.gatekeeper.sh\u002Fv1beta1\nkind: K8sAllowedRepos\nmetadata:\n  name: restrict-image-repos\nspec:\n  match:\n    kinds:\n      - apiGroups: [\"\"]\n        kinds: [\"Pod\"]\n  parameters:\n    repos:\n      - \"gcr.io\u002Fmy-project\u002F\"\n      - \"ghcr.io\u002Fmy-org\u002F\"\n      - \"registry.k8s.io\u002F\"\n```\n\n### 4. Enforce Resource Limits\n\n```yaml\n# template-require-limits.yaml\napiVersion: plugins.gatekeeper.sh\u002Fv1\nkind: ConstraintTemplate\nmetadata:\n  name: k8srequirelimits\nspec:\n  crd:\n    spec:\n      names:\n        kind: K8sRequireLimits\n  targets:\n    - target: admission.k8s.gatekeeper.sh\n      rego: |\n        package k8srequirelimits\n\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.containers[_]\n          not container.resources.limits.cpu\n          msg := sprintf(\"Container %v has no CPU limit\", [container.name])\n        }\n\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.containers[_]\n          not container.resources.limits.memory\n          msg := sprintf(\"Container %v has no memory limit\", [container.name])\n        }\n```\n\n### 5. Block Latest Image Tag\n\n```yaml\n# template-block-latest-tag.yaml\napiVersion: plugins.gatekeeper.sh\u002Fv1\nkind: ConstraintTemplate\nmetadata:\n  name: k8sblocklatesttag\nspec:\n  crd:\n    spec:\n      names:\n        kind: K8sBlockLatestTag\n  targets:\n    - target: admission.k8s.gatekeeper.sh\n      rego: |\n        package k8sblocklatesttag\n\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.containers[_]\n          endswith(container.image, \":latest\")\n          msg := sprintf(\"Container %v uses ':latest' tag. Use specific version tags.\", [container.name])\n        }\n\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.containers[_]\n          not contains(container.image, \":\")\n          msg := sprintf(\"Container %v has no tag (defaults to latest). Use specific version tags.\", [container.name])\n        }\n```\n\n### 6. Enforce Read-Only Root Filesystem\n\n```yaml\napiVersion: plugins.gatekeeper.sh\u002Fv1\nkind: ConstraintTemplate\nmetadata:\n  name: k8sreadonlyroot\nspec:\n  crd:\n    spec:\n      names:\n        kind: K8sReadOnlyRoot\n  targets:\n    - target: admission.k8s.gatekeeper.sh\n      rego: |\n        package k8sreadonlyroot\n\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.containers[_]\n          not container.securityContext.readOnlyRootFilesystem\n          msg := sprintf(\"Container %v must have readOnlyRootFilesystem set to true\", [container.name])\n        }\n```\n\n## Audit and Enforcement Modes\n\n```yaml\n# Dry-run mode (audit only, don't block)\napiVersion: constraints.gatekeeper.sh\u002Fv1beta1\nkind: K8sBlockPrivileged\nmetadata:\n  name: block-privileged-dryrun\nspec:\n  enforcementAction: dryrun   # dryrun | deny | warn\n  match:\n    kinds:\n      - apiGroups: [\"\"]\n        kinds: [\"Pod\"]\n```\n\n### Check Audit Violations\n\n```bash\n# List all constraint violations\nkubectl get k8sblockprivileged block-privileged-containers -o yaml | grep -A 20 violations\n\n# Check all constraints audit status\nkubectl get constraints -o json | jq '.items[] | {name: .metadata.name, violations: (.status.violations \u002F\u002F [] | length)}'\n```\n\n## Gatekeeper Config (Exempt Namespaces)\n\n```yaml\napiVersion: config.gatekeeper.sh\u002Fv1alpha1\nkind: Config\nmetadata:\n  name: config\n  namespace: gatekeeper-system\nspec:\n  match:\n    - excludedNamespaces:\n        - kube-system\n        - gatekeeper-system\n        - calico-system\n      processes:\n        - \"*\"\n```\n\n## Monitoring\n\n```bash\n# Check Gatekeeper metrics\nkubectl port-forward -n gatekeeper-system svc\u002Fgatekeeper-webhook-service 8443:443\n\n# Prometheus metrics\nkubectl get --raw \u002Fmetrics | grep gatekeeper\n```\n\n## Best Practices\n\n1. **Start with dryrun** - Deploy constraints in `dryrun` mode first, review violations, then switch to `deny`\n2. **Use the policy library** - Leverage https:\u002F\u002Fgithub.com\u002Fopen-policy-agent\u002Fgatekeeper-library for pre-built templates\n3. **Exempt system namespaces** - Always exclude kube-system and gatekeeper-system\n4. **Version control policies** - Store ConstraintTemplates and Constraints in Git\n5. **Monitor audit results** - Check constraint `.status.violations` regularly\n6. **Test Rego policies** - Use `opa test` or Rego Playground before deploying\n7. **Combine with admission webhooks** - Layer Gatekeeper with Pod Security Admission for defense in depth\n","# Implementing OPA Gatekeeper for Policy Enforcement\n\n## Overview\n\nOPA Gatekeeper is a Kubernetes admission controller that enforces policies written in Rego. It uses ConstraintTemplates (policy blueprints with Rego logic) and Constraints (instantiated policies with parameters) to validate, mutate, or deny Kubernetes resource requests at admission time.\n\n## When to Use\n\n- When deploying or configuring implementing opa gatekeeper for policy enforcement capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Kubernetes cluster v1.24+\n- Helm 3\n- kubectl with cluster-admin access\n- Familiarity with Rego policy language\n\n## Installing Gatekeeper\n\n```bash\n# Install via Helm\nhelm repo add gatekeeper https:\u002F\u002Fopen-policy-agent.github.io\u002Fgatekeeper\u002Fcharts\nhelm repo update\n\nhelm install gatekeeper gatekeeper\u002Fgatekeeper \\\n  --namespace gatekeeper-system --create-namespace \\\n  --set replicas=3 \\\n  --set audit.replicas=1 \\\n  --set audit.logLevel=INFO\n\n# Verify\nkubectl get pods -n gatekeeper-system\nkubectl get crd | grep gatekeeper\n```\n\n### Verify Installation\n\n```bash\n# Check webhook\nkubectl get validatingwebhookconfigurations gatekeeper-validating-webhook-configuration\n\n# Check CRDs\nkubectl get crd constrainttemplates.plugins.gatekeeper.sh\nkubectl get crd configs.config.gatekeeper.sh\n```\n\n## ConstraintTemplate Examples\n\n### 1. Require Labels on Resources\n\n```yaml\n# template-required-labels.yaml\napiVersion: plugins.gatekeeper.sh\u002Fv1\nkind: ConstraintTemplate\nmetadata:\n  name: k8srequiredlabels\nspec:\n  crd:\n    spec:\n      names:\n        kind: K8sRequiredLabels\n      validation:\n        openAPIV3Schema:\n          type: object\n          properties:\n            labels:\n              type: array\n              items:\n                type: string\n  targets:\n    - target: admission.k8s.gatekeeper.sh\n      rego: |\n        package k8srequiredlabels\n\n        violation[{\"msg\": msg, \"details\": {\"missing_labels\": missing}}] {\n          provided := {label | input.review.object.metadata.labels[label]}\n          required := {label | label := input.parameters.labels[_]}\n          missing := required - provided\n          count(missing) > 0\n          msg := sprintf(\"Missing required labels: %v\", [missing])\n        }\n```\n\n```yaml\n# constraint-require-team-label.yaml\napiVersion: constraints.gatekeeper.sh\u002Fv1beta1\nkind: K8sRequiredLabels\nmetadata:\n  name: require-team-label\nspec:\n  match:\n    kinds:\n      - apiGroups: [\"\"]\n        kinds: [\"Namespace\"]\n      - apiGroups: [\"apps\"]\n        kinds: [\"Deployment\"]\n  parameters:\n    labels:\n      - \"team\"\n      - \"environment\"\n```\n\n### 2. Block Privileged Containers\n\n```yaml\n# template-block-privileged.yaml\napiVersion: plugins.gatekeeper.sh\u002Fv1\nkind: ConstraintTemplate\nmetadata:\n  name: k8sblockprivileged\nspec:\n  crd:\n    spec:\n      names:\n        kind: K8sBlockPrivileged\n  targets:\n    - target: admission.k8s.gatekeeper.sh\n      rego: |\n        package k8sblockprivileged\n\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.containers[_]\n          container.securityContext.privileged == true\n          msg := sprintf(\"Privileged container not allowed: %v\", [container.name])\n        }\n\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.initContainers[_]\n          container.securityContext.privileged == true\n          msg := sprintf(\"Privileged init container not allowed: %v\", [container.name])\n        }\n```\n\n```yaml\n# constraint-block-privileged.yaml\napiVersion: constraints.gatekeeper.sh\u002Fv1beta1\nkind: K8sBlockPrivileged\nmetadata:\n  name: block-privileged-containers\nspec:\n  match:\n    kinds:\n      - apiGroups: [\"\"]\n        kinds: [\"Pod\"]\n    namespaces:\n      - \"production\"\n      - \"staging\"\n```\n\n### 3. Restrict Container Image Registries\n\n```yaml\n# template-allowed-repos.yaml\napiVersion: plugins.gatekeeper.sh\u002Fv1\nkind: ConstraintTemplate\nmetadata:\n  name: k8sallowedrepos\nspec:\n  crd:\n    spec:\n      names:\n        kind: K8sAllowedRepos\n      validation:\n        openAPIV3Schema:\n          type: object\n          properties:\n            repos:\n              type: array\n              items:\n                type: string\n  targets:\n    - target: admission.k8s.gatekeeper.sh\n      rego: |\n        package k8sallowedrepos\n\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.containers[_]\n          not image_matches(container.image)\n          msg := sprintf(\"Container image %v is not from an allowed registry. Allowed: %v\", [container.image, input.parameters.repos])\n        }\n\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.initContainers[_]\n          not image_matches(container.image)\n          msg := sprintf(\"Init container image %v is not from an allowed registry. Allowed: %v\", [container.image, input.parameters.repos])\n        }\n\n        image_matches(image) {\n          repo := input.parameters.repos[_]\n          startswith(image, repo)\n        }\n```\n\n```yaml\n# constraint-allowed-repos.yaml\napiVersion: constraints.gatekeeper.sh\u002Fv1beta1\nkind: K8sAllowedRepos\nmetadata:\n  name: restrict-image-repos\nspec:\n  match:\n    kinds:\n      - apiGroups: [\"\"]\n        kinds: [\"Pod\"]\n  parameters:\n    repos:\n      - \"gcr.io\u002Fmy-project\u002F\"\n      - \"ghcr.io\u002Fmy-org\u002F\"\n      - \"registry.k8s.io\u002F\"\n```\n\n### 4. Enforce Resource Limits\n\n```yaml\n# template-require-limits.yaml\napiVersion: plugins.gatekeeper.sh\u002Fv1\nkind: ConstraintTemplate\nmetadata:\n  name: k8srequirelimits\nspec:\n  crd:\n    spec:\n      names:\n        kind: K8sRequireLimits\n  targets:\n    - target: admission.k8s.gatekeeper.sh\n      rego: |\n        package k8srequirelimits\n\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.containers[_]\n          not container.resources.limits.cpu\n          msg := sprintf(\"Container %v has no CPU limit\", [container.name])\n        }\n\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.containers[_]\n          not container.resources.limits.memory\n          msg := sprintf(\"Container %v has no memory limit\", [container.name])\n        }\n```\n\n### 5. Block Latest Image Tag\n\n```yaml\n# template-block-latest-tag.yaml\napiVersion: plugins.gatekeeper.sh\u002Fv1\nkind: ConstraintTemplate\nmetadata:\n  name: k8sblocklatesttag\nspec:\n  crd:\n    spec:\n      names:\n        kind: K8sBlockLatestTag\n  targets:\n    - target: admission.k8s.gatekeeper.sh\n      rego: |\n        package k8sblocklatesttag\n\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.containers[_]\n          endswith(container.image, \":latest\")\n          msg := sprintf(\"Container %v uses ':latest' tag. Use specific version tags.\", [container.name])\n        }\n\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.containers[_]\n          not contains(container.image, \":\")\n          msg := sprintf(\"Container %v has no tag (defaults to latest). Use specific version tags.\", [container.name])\n        }\n```\n\n### 6. Enforce Read-Only Root Filesystem\n\n```yaml\napiVersion: plugins.gatekeeper.sh\u002Fv1\nkind: ConstraintTemplate\nmetadata:\n  name: k8sreadonlyroot\nspec:\n  crd:\n    spec:\n      names:\n        kind: K8sReadOnlyRoot\n  targets:\n    - target: admission.k8s.gatekeeper.sh\n      rego: |\n        package k8sreadonlyroot\n\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.containers[_]\n          not container.securityContext.readOnlyRootFilesystem\n          msg := sprintf(\"Container %v must have readOnlyRootFilesystem set to true\", [container.name])\n        }\n```\n\n## Audit and Enforcement Modes\n\n```yaml\n# Dry-run mode (audit only, don't block)\napiVersion: constraints.gatekeeper.sh\u002Fv1beta1\nkind: K8sBlockPrivileged\nmetadata:\n  name: block-privileged-dryrun\nspec:\n  enforcementAction: dryrun   # dryrun | deny | warn\n  match:\n    kinds:\n      - apiGroups: [\"\"]\n        kinds: [\"Pod\"]\n```\n\n### Check Audit Violations\n\n```bash\n# List all constraint violations\nkubectl get k8sblockprivileged block-privileged-containers -o yaml | grep -A 20 violations\n\n# Check all constraints audit status\nkubectl get constraints -o json | jq '.items[] | {name: .metadata.name, violations: (.status.violations \u002F\u002F [] | length)}'\n```\n\n## Gatekeeper Config (Exempt Namespaces)\n\n```yaml\napiVersion: config.gatekeeper.sh\u002Fv1alpha1\nkind: Config\nmetadata:\n  name: config\n  namespace: gatekeeper-system\nspec:\n  match:\n    - excludedNamespaces:\n        - kube-system\n        - gatekeeper-system\n        - calico-system\n      processes:\n        - \"*\"\n```\n\n## Monitoring\n\n```bash\n# Check Gatekeeper metrics\nkubectl port-forward -n gatekeeper-system svc\u002Fgatekeeper-webhook-service 8443:443\n\n# Prometheus metrics\nkubectl get --raw \u002Fmetrics | grep gatekeeper\n```\n\n## Best Practices\n\n1. **Start with dryrun** - Deploy constraints in `dryrun` mode first, review violations, then switch to `deny`\n2. **Use the policy library** - Leverage https:\u002F\u002Fgithub.com\u002Fopen-policy-agent\u002Fgatekeeper-library for pre-built templates\n3. **Exempt system namespaces** - Always exclude kube-system and gatekeeper-system\n4. **Version control policies** - Store ConstraintTemplates and Constraints in Git\n5. **Monitor audit results** - Check constraint `.status.violations` regularly\n6. **Test Rego policies** - Use `opa test` or Rego Playground before deploying\n7. **Combine with admission webhooks** - Layer Gatekeeper with Pod Security Admission for defense in depth\n",{"name":5,"domain":25,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fcloud-containers-opa","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":42,"prompt":52,"zipAvailable":53},[43,46,49],{"tool":44,"command":45},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill cloud-containers-opa",{"tool":47,"command":48},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill cloud-containers-opa",{"tool":50,"command":51},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill cloud-containers-opa","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud-containers-opa\u002FSKILL.md",true,[55],{"path":56,"resourceType":57,"resourceTypeDesc":58,"sizeBytes":59,"sourceHtmlUrl":60},"index.json","REFERENCE","参考文档",540,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud-containers-opa\u002Findex.json",[62,87,110,132,154,170],{"skillNo":63,"name":64,"nameZh":6,"description":65,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":66,"categories":67,"keywords":68,"publishedAt":29},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,25,86],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":88,"name":89,"nameZh":6,"description":90,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":91,"categories":92,"keywords":93,"publishedAt":29},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[94,69,95,72,96,97,98,25,99,100,101,102,103,104,74,105,106,107,108,109],"exploit","services wmi exec exploit","exec","remote","traffic","Bash","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":111,"name":112,"nameZh":6,"description":113,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":114,"categories":115,"keywords":116,"publishedAt":29},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[117,118,119,120,121,122,25,99,123,100,124,125,74,107,126,127,128,129,130,131],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":133,"name":134,"nameZh":6,"description":135,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":136,"categories":137,"keywords":138,"publishedAt":29},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[70,139,140,141,142,143,144,75,145,25,86,146,147,148,149,150,151,152,153,74],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":155,"name":156,"nameZh":6,"description":157,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":158,"categories":159,"keywords":160,"publishedAt":29},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[161,162,70,163,141,143,164,75,165,145,25,86,100,166,167,168,169,153,74,76],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":171,"name":172,"nameZh":6,"description":173,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":174,"categories":175,"keywords":176,"publishedAt":29},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[177,70,141,178,164,75,179,180,25,86,181,182,183,184,185,186,74,76,187,188],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]