[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71DH168AFPQR20PT2T5TFPC":3,"skill-same:01M71DH168AFPQR20PT2T5TFPC":56},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":24,"linkOnly":25,"markdownContent":26,"markdownBody":27,"frontMatter":28,"refName":29,"commitSha":30,"skillDirectory":31,"forksCount":14,"repositoryHtmlUrl":32,"repositoryHomepageUrl":6,"ownerHtmlUrl":33,"ownerBlogUrl":6,"ownerDescription":34,"updatedAt":35,"install":36,"resources":49},"01M71DH168AFPQR20PT2T5TFPC","identity-provider-google",null,"Identity Provider Google.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fidentity-provider-google\u002FSKILL.md",[],[19,20,21,22,23],"google","identity","provider","identity provider google","cybersecurity","2026-11-10 10:12:30",false,"---\nname: identity-provider-google\ndescription: \"Identity Provider Google.\"\ndomain: cybersecurity\n---\n\n|\n| **Advanced Protection Program (APP)** | Google's strongest account security requiring FIDO2 security keys, blocking third-party app access, and enhanced identity verification for account recovery |\n| **Context-Aware Access** | Security policy framework that evaluates device posture, location, and user identity before granting access to Google Workspace applications |\n| **DMARC** | Domain-based Message Authentication, Reporting and Conformance protocol that prevents email domain spoofing by validating SPF and DKIM alignment |\n| **DLP Rule** | Data Loss Prevention policy that scans content in Gmail, Drive, and Chat for sensitive data patterns and triggers block, quarantine, or warn actions |\n| **OAuth App Allowlisting** | Admin control restricting which third-party applications can access organizational data through Google OAuth API scopes |\n| **2-Step Verification (2SV)** | Google's multi-factor authentication implementation supporting security keys, phone prompts, TOTP, and backup codes as second factors |\n\n## Tools & Systems\n\n- **Google Admin Console**: Web-based administration portal for managing all Google Workspace security settings, users, and organizational units\n- **GAM (Google Apps Manager)**: Open-source command-line tool for bulk Google Workspace administration and automation\n- **Google Workspace Alert Center**: Centralized dashboard for security alerts including suspicious login activity, DLP violations, and device compromise\n- **Google BeyondCorp Enterprise**: Zero-trust access solution integrated with Google Workspace for context-aware access policies\n\n## Common Scenarios\n\n### Scenario: Securing a Newly Acquired Google Workspace Tenant\n\n**Context**: Post-acquisition security audit reveals the acquired company's Google Workspace has no MFA enforcement, open external sharing, no DLP policies, and multiple unauthorized OAuth applications accessing user data.\n\n**Approach**:\n1. Immediately enforce 2SV for all super admin accounts using FIDO2 security keys\n2. Reduce super admin count to 3 (primary, secondary, break-glass)\n3. Deploy SPF, DKIM, and DMARC starting with monitoring mode (p=none)\n4. Enable all anti-phishing and anti-spoofing settings in Email Safety\n5. Audit and revoke all unauthorized OAuth application tokens\n6. Set third-party app access to blocked with allowlist of approved applications\n7. Restrict external Drive sharing to approved partner domains only\n8. Deploy DLP rules for PII, financial data, and confidential documents\n9. Enable context-aware access requiring managed devices for sensitive applications\n10. Configure security alerts and SIEM integration for ongoing monitoring\n\n**Pitfalls**:\n- Enforcing MFA without enrollment grace period locks users out of accounts\n- Setting DMARC to reject before monitoring period causes legitimate email delivery failures\n- Blocking all OAuth apps without identifying business-critical integrations disrupts workflows\n- Not auditing existing external shares before restricting sharing leaves data exposed\n\n## Output Format\n\n```\nGOOGLE WORKSPACE SECURITY ASSESSMENT REPORT\n=============================================\nTenant:            corp.com\nLicense:           Enterprise Plus\nTotal Users:       3,847\nOrganizational Units: 12\n\nAUTHENTICATION SECURITY\n2SV Enforced:           YES (all OUs)\n2SV Enrollment:         3,712 \u002F 3,847 (96.5%)\nSecurity Keys Only:     Executive OU (47 users)\nAdvanced Protection:    3 super admin accounts\nSuper Admin Count:      3 (within recommended limit)\n\nEMAIL AUTHENTICATION\nSPF:                    CONFIGURED (hard fail: -all)\nDKIM:                   CONFIGURED (2048-bit, selector: google)\nDMARC:                  ENFORCED (p=reject, 100%)\nAnti-Phishing:          ALL PROTECTIONS ENABLED\nAnti-Spoofing:          ENABLED (domain + employee name)\n\nDATA PROTECTION\nDLP Rules Active:       7\n  PII Detection:        SSN, Credit Card, Passport\n  Content Labels:       Confidential, Restricted\n  Custom Patterns:      3 organization-specific rules\nDLP Violations (30d):   89 (67 blocked, 22 warned)\n\nAPPLICATION CONTROL\nThird-Party App Policy: BLOCKED (allowlist mode)\nApproved Apps:          12\nUnauthorized Tokens:    0 (all revoked)\nAPI Scope Restrictions: ENABLED\n\nSHARING CONTROLS\nExternal Sharing:       RESTRICTED (allowlisted domains only)\nPublic Link Sharing:    DISABLED\nExternal Group Members: DISABLED\nShared Drive Creation:  ADMIN ONLY\n```\n","|\n| **Advanced Protection Program (APP)** | Google's strongest account security requiring FIDO2 security keys, blocking third-party app access, and enhanced identity verification for account recovery |\n| **Context-Aware Access** | Security policy framework that evaluates device posture, location, and user identity before granting access to Google Workspace applications |\n| **DMARC** | Domain-based Message Authentication, Reporting and Conformance protocol that prevents email domain spoofing by validating SPF and DKIM alignment |\n| **DLP Rule** | Data Loss Prevention policy that scans content in Gmail, Drive, and Chat for sensitive data patterns and triggers block, quarantine, or warn actions |\n| **OAuth App Allowlisting** | Admin control restricting which third-party applications can access organizational data through Google OAuth API scopes |\n| **2-Step Verification (2SV)** | Google's multi-factor authentication implementation supporting security keys, phone prompts, TOTP, and backup codes as second factors |\n\n## Tools & Systems\n\n- **Google Admin Console**: Web-based administration portal for managing all Google Workspace security settings, users, and organizational units\n- **GAM (Google Apps Manager)**: Open-source command-line tool for bulk Google Workspace administration and automation\n- **Google Workspace Alert Center**: Centralized dashboard for security alerts including suspicious login activity, DLP violations, and device compromise\n- **Google BeyondCorp Enterprise**: Zero-trust access solution integrated with Google Workspace for context-aware access policies\n\n## Common Scenarios\n\n### Scenario: Securing a Newly Acquired Google Workspace Tenant\n\n**Context**: Post-acquisition security audit reveals the acquired company's Google Workspace has no MFA enforcement, open external sharing, no DLP policies, and multiple unauthorized OAuth applications accessing user data.\n\n**Approach**:\n1. Immediately enforce 2SV for all super admin accounts using FIDO2 security keys\n2. Reduce super admin count to 3 (primary, secondary, break-glass)\n3. Deploy SPF, DKIM, and DMARC starting with monitoring mode (p=none)\n4. Enable all anti-phishing and anti-spoofing settings in Email Safety\n5. Audit and revoke all unauthorized OAuth application tokens\n6. Set third-party app access to blocked with allowlist of approved applications\n7. Restrict external Drive sharing to approved partner domains only\n8. Deploy DLP rules for PII, financial data, and confidential documents\n9. Enable context-aware access requiring managed devices for sensitive applications\n10. Configure security alerts and SIEM integration for ongoing monitoring\n\n**Pitfalls**:\n- Enforcing MFA without enrollment grace period locks users out of accounts\n- Setting DMARC to reject before monitoring period causes legitimate email delivery failures\n- Blocking all OAuth apps without identifying business-critical integrations disrupts workflows\n- Not auditing existing external shares before restricting sharing leaves data exposed\n\n## Output Format\n\n```\nGOOGLE WORKSPACE SECURITY ASSESSMENT REPORT\n=============================================\nTenant:            corp.com\nLicense:           Enterprise Plus\nTotal Users:       3,847\nOrganizational Units: 12\n\nAUTHENTICATION SECURITY\n2SV Enforced:           YES (all OUs)\n2SV Enrollment:         3,712 \u002F 3,847 (96.5%)\nSecurity Keys Only:     Executive OU (47 users)\nAdvanced Protection:    3 super admin accounts\nSuper Admin Count:      3 (within recommended limit)\n\nEMAIL AUTHENTICATION\nSPF:                    CONFIGURED (hard fail: -all)\nDKIM:                   CONFIGURED (2048-bit, selector: google)\nDMARC:                  ENFORCED (p=reject, 100%)\nAnti-Phishing:          ALL PROTECTIONS ENABLED\nAnti-Spoofing:          ENABLED (domain + employee name)\n\nDATA PROTECTION\nDLP Rules Active:       7\n  PII Detection:        SSN, Credit Card, Passport\n  Content Labels:       Confidential, Restricted\n  Custom Patterns:      3 organization-specific rules\nDLP Violations (30d):   89 (67 blocked, 22 warned)\n\nAPPLICATION CONTROL\nThird-Party App Policy: BLOCKED (allowlist mode)\nApproved Apps:          12\nUnauthorized Tokens:    0 (all revoked)\nAPI Scope Restrictions: ENABLED\n\nSHARING CONTROLS\nExternal Sharing:       RESTRICTED (allowlisted domains only)\nPublic Link Sharing:    DISABLED\nExternal Group Members: DISABLED\nShared Drive Creation:  ADMIN ONLY\n```\n",{"name":5,"domain":23,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fidentity-provider-google","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":37,"prompt":47,"zipAvailable":48},[38,41,44],{"tool":39,"command":40},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill identity-provider-google",{"tool":42,"command":43},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill identity-provider-google",{"tool":45,"command":46},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill identity-provider-google","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fidentity-provider-google\u002FSKILL.md",true,[50],{"path":51,"resourceType":52,"resourceTypeDesc":53,"sizeBytes":54,"sourceHtmlUrl":55},"index.json","REFERENCE","参考文档",496,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fidentity-provider-google\u002Findex.json",[57,82,105,127,149,165],{"skillNo":58,"name":59,"nameZh":6,"description":60,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":61,"categories":62,"keywords":63,"publishedAt":24},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,23,81],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":83,"name":84,"nameZh":6,"description":85,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":86,"categories":87,"keywords":88,"publishedAt":24},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[89,64,90,67,91,92,93,23,94,95,96,97,98,99,69,100,101,102,103,104],"exploit","services wmi exec exploit","exec","remote","traffic","Bash","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":106,"name":107,"nameZh":6,"description":108,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":109,"categories":110,"keywords":111,"publishedAt":24},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[112,113,114,115,116,117,23,94,118,95,119,120,69,102,121,122,123,124,125,126],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":128,"name":129,"nameZh":6,"description":130,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":131,"categories":132,"keywords":133,"publishedAt":24},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[65,134,135,136,137,138,139,70,140,23,81,141,142,143,144,145,146,147,148,69],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":150,"name":151,"nameZh":6,"description":152,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":153,"categories":154,"keywords":155,"publishedAt":24},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[156,157,65,158,136,138,159,70,160,140,23,81,95,161,162,163,164,148,69,71],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":166,"name":167,"nameZh":6,"description":168,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":169,"categories":170,"keywords":171,"publishedAt":24},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[172,65,136,173,159,70,174,175,23,81,176,177,178,179,180,181,69,71,182,183],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]