[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71C7C2DPZX642FEM2N21513":3,"skill-same:01M71C7C2DPZX642FEM2N21513":56},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":24,"linkOnly":25,"markdownContent":26,"markdownBody":27,"frontMatter":28,"refName":29,"commitSha":30,"skillDirectory":31,"forksCount":14,"repositoryHtmlUrl":32,"repositoryHomepageUrl":6,"ownerHtmlUrl":33,"ownerBlogUrl":6,"ownerDescription":34,"updatedAt":35,"install":36,"resources":49},"01M71C7C2DPZX642FEM2N21513","cloud-gcp-forseti",null,"Cloud Gcp Forseti.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud-gcp-forseti\u002FSKILL.md",[],[19,20,21,22,23],"cloud","gcp","forseti","cloud gcp forseti","cybersecurity","2026-11-10 10:12:30",false,"---\nname: cloud-gcp-forseti\ndescription: \"Cloud Gcp Forseti.\"\ndomain: cybersecurity\n---\n\n|\n| Security Command Center | GCP-native security and risk management platform that provides asset inventory, vulnerability detection, and threat monitoring |\n| Forseti Security | Open-source GCP security toolkit (now deprecated in favor of SCC) that provided inventory, scanning, enforcement, and notification capabilities |\n| Cloud Asset Inventory | GCP service that provides a complete inventory of cloud resources with metadata, IAM policies, and org policy configurations |\n| CIS GCP Foundations Benchmark | Security best practice guidelines from Center for Internet Security specific to Google Cloud Platform configuration |\n| Uniform Bucket-Level Access | GCP storage setting that disables legacy ACLs and enforces access exclusively through IAM policies for consistent access control |\n| Organization Policy | GCP constraint-based governance mechanism that restricts resource configurations across the organization hierarchy |\n\n## Tools & Systems\n\n- **Security Command Center**: GCP-native CSPM providing asset inventory, vulnerability findings, and compliance scoring\n- **ScoutSuite**: Multi-cloud security auditing tool with comprehensive GCP checks for IAM, compute, storage, and networking\n- **gcloud CLI**: Primary command-line interface for querying GCP resource configurations and security settings\n- **Cloud Asset Inventory**: API for searching and exporting resource metadata and IAM policies across GCP projects\n- **Forseti Security**: Legacy open-source GCP security toolkit, superseded by SCC but still referenced in compliance frameworks\n\n## Common Scenarios\n\n### Scenario: Assessing a Newly Acquired GCP Organization\n\n**Context**: After a company acquisition, the security team needs to assess the security posture of the acquired company's GCP organization with 30+ projects.\n\n**Approach**:\n1. Enable Cloud Asset API and export full resource inventory to BigQuery for analysis\n2. Run `gcloud asset search-all-iam-policies` to find all Owner\u002FEditor bindings and public access grants\n3. Audit firewall rules across all projects for overly permissive ingress from `0.0.0.0\u002F0`\n4. Check all storage buckets for public access using `gsutil iam get`\n5. Run ScoutSuite for a comprehensive automated assessment with HTML report\n6. Enable SCC and review all CRITICAL and HIGH findings\n7. Generate a risk-prioritized remediation roadmap for the integration team\n\n**Pitfalls**: GCP IAM bindings are inherited from organization to folder to project. A permissive binding at the organization level affects all downstream projects. Always audit IAM at every level of the hierarchy, not just at the project level.\n\n## Output Format\n\n```\nGCP Security Assessment Report\n=================================\nOrganization: acme-acquired-org (ORG_ID: 123456789)\nProjects Assessed: 34\nAssessment Date: 2026-02-23\nStandards: CIS GCP Foundations 2.0\n\nIAM FINDINGS:\n  Users with Owner role at org level:       3\n  Service accounts with Editor role:        12\n  Resources with allUsers binding:           5\n  Service account keys > 90 days:           18\n\nNETWORK FINDINGS:\n  Firewall rules allowing 0.0.0.0\u002F0:       14\n  SSH open to internet:                      7\n  RDP open to internet:                      2\n  Subnets without VPC flow logs:            22\n\nSTORAGE FINDINGS:\n  Publicly accessible buckets:               5\n  Buckets without CMEK encryption:          28\n  Buckets without uniform access:           15\n\nCRITICAL FINDINGS: 12\nHIGH FINDINGS: 34\nMEDIUM FINDINGS: 78\nLOW FINDINGS: 145\n\nTOP REMEDIATION PRIORITIES:\n  1. Remove allUsers bindings from 5 storage buckets (CRITICAL)\n  2. Restrict 0.0.0.0\u002F0 firewall rules to specific CIDRs (HIGH)\n  3. Rotate 18 service account keys older than 90 days (HIGH)\n  4. Enable VPC flow logs on 22 subnets (MEDIUM)\n```\n","|\n| Security Command Center | GCP-native security and risk management platform that provides asset inventory, vulnerability detection, and threat monitoring |\n| Forseti Security | Open-source GCP security toolkit (now deprecated in favor of SCC) that provided inventory, scanning, enforcement, and notification capabilities |\n| Cloud Asset Inventory | GCP service that provides a complete inventory of cloud resources with metadata, IAM policies, and org policy configurations |\n| CIS GCP Foundations Benchmark | Security best practice guidelines from Center for Internet Security specific to Google Cloud Platform configuration |\n| Uniform Bucket-Level Access | GCP storage setting that disables legacy ACLs and enforces access exclusively through IAM policies for consistent access control |\n| Organization Policy | GCP constraint-based governance mechanism that restricts resource configurations across the organization hierarchy |\n\n## Tools & Systems\n\n- **Security Command Center**: GCP-native CSPM providing asset inventory, vulnerability findings, and compliance scoring\n- **ScoutSuite**: Multi-cloud security auditing tool with comprehensive GCP checks for IAM, compute, storage, and networking\n- **gcloud CLI**: Primary command-line interface for querying GCP resource configurations and security settings\n- **Cloud Asset Inventory**: API for searching and exporting resource metadata and IAM policies across GCP projects\n- **Forseti Security**: Legacy open-source GCP security toolkit, superseded by SCC but still referenced in compliance frameworks\n\n## Common Scenarios\n\n### Scenario: Assessing a Newly Acquired GCP Organization\n\n**Context**: After a company acquisition, the security team needs to assess the security posture of the acquired company's GCP organization with 30+ projects.\n\n**Approach**:\n1. Enable Cloud Asset API and export full resource inventory to BigQuery for analysis\n2. Run `gcloud asset search-all-iam-policies` to find all Owner\u002FEditor bindings and public access grants\n3. Audit firewall rules across all projects for overly permissive ingress from `0.0.0.0\u002F0`\n4. Check all storage buckets for public access using `gsutil iam get`\n5. Run ScoutSuite for a comprehensive automated assessment with HTML report\n6. Enable SCC and review all CRITICAL and HIGH findings\n7. Generate a risk-prioritized remediation roadmap for the integration team\n\n**Pitfalls**: GCP IAM bindings are inherited from organization to folder to project. A permissive binding at the organization level affects all downstream projects. Always audit IAM at every level of the hierarchy, not just at the project level.\n\n## Output Format\n\n```\nGCP Security Assessment Report\n=================================\nOrganization: acme-acquired-org (ORG_ID: 123456789)\nProjects Assessed: 34\nAssessment Date: 2026-02-23\nStandards: CIS GCP Foundations 2.0\n\nIAM FINDINGS:\n  Users with Owner role at org level:       3\n  Service accounts with Editor role:        12\n  Resources with allUsers binding:           5\n  Service account keys > 90 days:           18\n\nNETWORK FINDINGS:\n  Firewall rules allowing 0.0.0.0\u002F0:       14\n  SSH open to internet:                      7\n  RDP open to internet:                      2\n  Subnets without VPC flow logs:            22\n\nSTORAGE FINDINGS:\n  Publicly accessible buckets:               5\n  Buckets without CMEK encryption:          28\n  Buckets without uniform access:           15\n\nCRITICAL FINDINGS: 12\nHIGH FINDINGS: 34\nMEDIUM FINDINGS: 78\nLOW FINDINGS: 145\n\nTOP REMEDIATION PRIORITIES:\n  1. Remove allUsers bindings from 5 storage buckets (CRITICAL)\n  2. Restrict 0.0.0.0\u002F0 firewall rules to specific CIDRs (HIGH)\n  3. Rotate 18 service account keys older than 90 days (HIGH)\n  4. Enable VPC flow logs on 22 subnets (MEDIUM)\n```\n",{"name":5,"domain":23,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fcloud-gcp-forseti","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":37,"prompt":47,"zipAvailable":48},[38,41,44],{"tool":39,"command":40},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill cloud-gcp-forseti",{"tool":42,"command":43},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill cloud-gcp-forseti",{"tool":45,"command":46},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill cloud-gcp-forseti","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud-gcp-forseti\u002FSKILL.md",true,[50],{"path":51,"resourceType":52,"resourceTypeDesc":53,"sizeBytes":54,"sourceHtmlUrl":55},"index.json","REFERENCE","参考文档",468,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud-gcp-forseti\u002Findex.json",[57,82,105,127,149,165],{"skillNo":58,"name":59,"nameZh":6,"description":60,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":61,"categories":62,"keywords":63,"publishedAt":24},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,23,81],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":83,"name":84,"nameZh":6,"description":85,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":86,"categories":87,"keywords":88,"publishedAt":24},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[89,64,90,67,91,92,93,23,94,95,96,97,98,99,69,100,101,102,103,104],"exploit","services wmi exec exploit","exec","remote","traffic","Bash","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":106,"name":107,"nameZh":6,"description":108,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":109,"categories":110,"keywords":111,"publishedAt":24},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[112,113,114,115,116,117,23,94,118,95,119,120,69,102,121,122,123,124,125,126],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":128,"name":129,"nameZh":6,"description":130,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":131,"categories":132,"keywords":133,"publishedAt":24},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[65,134,135,136,137,138,139,70,140,23,81,141,142,143,144,145,146,147,148,69],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":150,"name":151,"nameZh":6,"description":152,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":153,"categories":154,"keywords":155,"publishedAt":24},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[156,157,65,158,136,138,159,70,160,140,23,81,95,161,162,163,164,148,69,71],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":166,"name":167,"nameZh":6,"description":168,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":169,"categories":170,"keywords":171,"publishedAt":24},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[172,65,136,173,159,70,174,175,23,81,176,177,178,179,180,181,69,71,182,183],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]