devel-jb-gws-keep
Use `gws schema` output to build your `--params` and `--json` flags.
- License 许可
- MIT
- 最近更新
- 2026-09-01
- Stars
- ★ 0
- Forks
- 0
01 前言 Front Matter
- name
- devel-jb-gws-keep
- domain
- cybersecurity
- description
- Use `gws schema` output to build your `--params` and `--json` flags.
02 资源文件 1
- 参考文档index.json518 B
03 SKILL.md 正文
keep (v1)
PREREQUISITE: Read
../gws-shared/SKILL.mdfor auth, global flags, and security rules. If missing, rungws generate-skillsto create it.
gws keep <resource> <method> [flags]
API Resources
media
download— Gets an attachment. To download attachment media via REST requires the alt=media query parameter. Returns a 400 bad request error if attachment media is not available in the requested MIME type.
notes
create— Creates a new note.delete— Deletes a note. Caller must have theOWNERrole on the note to delete. Deleting a note removes the resource immediately and cannot be undone. Any collaborators will lose access to the note.get— Gets a note.list— Lists notes. Every list call returns a page of results withpage_sizeas the upper bound of returned items. Apage_sizeof zero allows the server to choose the upper bound. The ListNotesResponse contains at mostpage_sizeentries. If there are more things left to list, it provides anext_page_tokenvalue. (Page tokens are opaque values.) To get the next page of results, copy the result'snext_page_tokeninto the next request'spage_token.permissions— Operations on the 'permissions' resource
Discovering Commands
Before calling any API method, inspect it:
# Browse resources and methods
gws keep --help
# Inspect a method's required params, types, and defaults
gws schema keep.<resource>.<method>
Use gws schema output to build your --params and --json flags.
04 同仓库更多 Skills
services-wmi-persistence-detect
Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.
services-wmi-exec-exploit
Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.
registry-artifact-extract
Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.
processes-token-impersonate-detect
Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.
processes-thread-injection-detect
Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.
processes-hollow-technique-detect
Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.