[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71GKB67FEYEFQ0FMZDJJPAV":3,"skill-same:01M71GKB67FEYEFQ0FMZDJJPAV":113},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":43,"linkOnly":44,"markdownContent":45,"markdownBody":46,"frontMatter":47,"refName":48,"commitSha":49,"skillDirectory":50,"forksCount":14,"repositoryHtmlUrl":51,"repositoryHomepageUrl":6,"ownerHtmlUrl":52,"ownerBlogUrl":6,"ownerDescription":53,"updatedAt":54,"install":55,"resources":68},"01M71GKB67FEYEFQ0FMZDJJPAV","vulnerabilities-SKILL.md",null,">\n  The Common Vulnerability Scoring System (CVSS) is the industry standard framework maintained by FIRST (Forum of Incident Response and Security Teams) for assessing vulnerability severity. CVSS v4.0 (r","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvulnerabilities\u002Fprioritization\u002Fvulnerabilities\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42],"skill md","vulnerabilities","vulnerabilities SKILL md","industry","first","Industry Standard","standard","teams","system","for","severity","framework","security","cvss","common","scoring","vulnerability","incident response","incident","2026-11-10 10:12:30",false,"---\nname: vulnerabilities-SKILL.md\ndescription: \">\\n  The Common Vulnerability Scoring System (CVSS) is the industry\\\n  \\ standard framework maintained by FIRST (Forum of Incident Response and Security\\\n  \\ Teams) for assessing vulnerability severity. CVSS v4.0 (r\"\n---\n# Prioritizing Vulnerabilities with CVSS Scoring\n\n## Overview\nThe Common Vulnerability Scoring System (CVSS) is the industry standard framework maintained by FIRST (Forum of Incident Response and Security Teams) for assessing vulnerability severity. CVSS v4.0 (released November 2023) introduces refined metrics for more accurate scoring. This skill covers calculating CVSS scores, interpreting vector strings, and using CVSS alongside contextual factors like EPSS and CISA KEV for effective vulnerability prioritization.\n\n\n## When to Use\n\n- When managing security operations that require prioritizing vulnerabilities with cvss scoring\n- When improving security program maturity and operational processes\n- When establishing standardized procedures for security team workflows\n- When integrating threat intelligence or vulnerability data into operations\n\n## Prerequisites\n- Understanding of common vulnerability types (buffer overflow, injection, XSS, etc.)\n- Familiarity with networking concepts (attack vectors, protocols)\n- Access to NVD (National Vulnerability Database) for CVE lookups\n- Vulnerability scan results requiring prioritization\n\n## Core Concepts\n\n### CVSS v4.0 Metric Groups\n\n#### 1. Base Metrics (Intrinsic Severity)\nRepresent the inherent characteristics of a vulnerability:\n\n**Exploitability Metrics:**\n- **Attack Vector (AV)**: Network (N), Adjacent (A), Local (L), Physical (P)\n- **Attack Complexity (AC)**: Low (L), High (H)\n- **Attack Requirements (AT)**: None (N), Present (P) - NEW in v4.0\n- **Privileges Required (PR)**: None (N), Low (L), High (H)\n- **User Interaction (UI)**: None (N), Passive (P), Active (A) - Expanded in v4.0\n\n**Impact Metrics (Vulnerable System):**\n- **Confidentiality (VC)**: None (N), Low (L), High (H)\n- **Integrity (VI)**: None (N), Low (L), High (H)\n- **Availability (VA)**: None (N), Low (L), High (H)\n\n**Impact Metrics (Subsequent System):**\n- **Confidentiality (SC)**: None (N), Low (L), High (H)\n- **Integrity (SI)**: None (N), Low (L), High (H)\n- **Availability (SA)**: None (N), Low (L), High (H)\n\n#### 2. Threat Metrics (Dynamic Context)\n- **Exploit Maturity (E)**: Attacked (A), POC (P), Unreported (U)\n\n#### 3. Environmental Metrics (Organization-Specific)\nModified versions of base metrics reflecting local deployment context, plus:\n- **Confidentiality Requirement (CR)**: High (H), Medium (M), Low (L)\n- **Integrity Requirement (IR)**: High (H), Medium (M), Low (L)\n- **Availability Requirement (AR)**: High (H), Medium (M), Low (L)\n\n#### 4. Supplemental Metrics (Advisory Information)\n- **Safety (S)**: Present (P), Negligible (X)\n- **Automatable (AU)**: Yes (Y), No (N)\n- **Recovery (R)**: Automatic (A), User (U), Irrecoverable (I)\n- **Value Density (V)**: Diffuse (D), Concentrated (C)\n- **Vulnerability Response Effort (RE)**: Low (L), Moderate (M), High (H)\n- **Provider Urgency (U)**: Red, Amber, Green, Clear\n\n### CVSS v4.0 Severity Ratings\n| Score Range | Severity |\n|-------------|----------|\n| 0.0 | None |\n| 0.1 - 3.9 | Low |\n| 4.0 - 6.9 | Medium |\n| 7.0 - 8.9 | High |\n| 9.0 - 10.0 | Critical |\n\n### CVSS v4.0 Vector String Format\n```\nCVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N\n```\nThis example represents a network-exploitable vulnerability requiring no privileges, no user interaction, no attack requirements, with high impact on confidentiality, integrity, and availability of the vulnerable system.\n\n## Workflow\n\n### Step 1: Assess Base Metrics\nFor each vulnerability, evaluate:\n\n```\nExample: CVE-2024-3094 (XZ Utils Backdoor)\n\nAttack Vector:        Network (N)     - Exploitable over network\nAttack Complexity:    High (H)        - Specific conditions required\nAttack Requirements:  Present (P)     - Specific build\u002Fconfig needed\nPrivileges Required:  None (N)        - No authentication needed\nUser Interaction:     None (N)        - No victim action needed\n\nVulnerable System Impact:\n  Confidentiality:    High (H)        - Complete access to SSH keys\n  Integrity:          High (H)        - Arbitrary code execution\n  Availability:       High (H)        - Full system compromise\n\nSubsequent System Impact:\n  Confidentiality:    High (H)        - Lateral movement possible\n  Integrity:          High (H)        - Network-wide compromise\n  Availability:       None (N)        - No downstream availability impact\n\nVector: CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:H\u002FSI:H\u002FSA:N\n```\n\n### Step 2: Apply Threat Intelligence Context\nEnrich CVSS with real-world threat data:\n\n```\nExploit Maturity:     Attacked (A)    - Active exploitation in the wild\nEPSS Score:           0.94            - 94% probability of exploitation in 30 days\nCISA KEV:            Listed           - Mandatory remediation for federal agencies\n```\n\n### Step 3: Calculate Environmental Score\nAdjust for organizational context:\n\n```\nConfidentiality Req:  High (H)        - Handles PII\u002Ffinancial data\nIntegrity Req:        High (H)        - Critical business process\nAvailability Req:     Medium (M)      - Has DR\u002Ffailover capability\n\nModified Attack Vector: Network (N)   - Internet-facing deployment\n```\n\n### Step 4: Multi-Factor Prioritization Matrix\n\nCombine CVSS with additional prioritization factors:\n\n| Factor | Weight | Source |\n|--------|--------|--------|\n| CVSS Base Score | 25% | NVD\u002FScanner |\n| EPSS Score | 25% | FIRST EPSS API |\n| Asset Criticality | 20% | Asset inventory\u002FCMDB |\n| CISA KEV Listed | 15% | CISA catalog |\n| Network Exposure | 15% | Network segmentation data |\n\n### Step 5: Define Remediation SLAs\n\n| Priority Level | CVSS Range | EPSS | Asset Tier | SLA |\n|---------------|------------|------|------------|-----|\n| P1 - Emergency | 9.0-10.0 | >0.5 | Tier 1 | 24-48 hours |\n| P2 - Critical | 7.0-8.9 | >0.3 | Tier 1-2 | 7 days |\n| P3 - High | 7.0-8.9 | \u003C0.3 | Tier 2-3 | 14 days |\n| P4 - Medium | 4.0-6.9 | Any | Any | 30 days |\n| P5 - Low | 0.1-3.9 | Any | Any | 90 days |\n\n## Best Practices\n1. Never rely solely on CVSS base score for prioritization\n2. Always incorporate threat intelligence (EPSS, KEV, exploit databases)\n3. Maintain accurate asset criticality ratings in your CMDB\n4. Adjust environmental metrics for your specific deployment context\n5. Use CVSS v4.0 vector strings for precise communication between teams\n6. Document scoring rationale for audit trail and consistency\n7. Re-evaluate scores when new threat intelligence becomes available\n8. Train remediation teams on interpreting CVSS metrics and vector strings\n\n## Common Pitfalls\n- Treating CVSS base score as the sole prioritization factor\n- Ignoring environmental metrics that reflect organizational risk\n- Not updating threat metrics when exploit maturity changes\n- Confusing CVSS severity with actual organizational risk\n- Using outdated CVSS v2.0 scores instead of v3.1\u002Fv4.0\n- Over-relying on scanner-provided scores without validation\n\n## Related Skills\n- prioritizing-patches-with-exploit-prediction-scoring\n- implementing-risk-based-vulnerability-management\n- implementing-vulnerability-remediation-sla\n\n\n---\n\n## CyberSecSuite Integration\n\n```bash\n# Open a case before starting investigation\nmcp__cybersec__case_open --title \"vulnerabilities\" --type investigation\n\n# Persist findings to PostgreSQL\nmcp__cybersec__add_finding --title \"...\" --severity high --description \"...\"\n\n# Log IOCs\nmcp__cybersec__add_ioc --type domain --value \"...\" --confidence 0.9\n\n# Map to MITRE\nmcp__cybersec__suggest_mitre --description \"...\"\n```\n\n**Agent:** `@cybersec-agent` → delegates to appropriate specialist\n","# Prioritizing Vulnerabilities with CVSS Scoring\n\n## Overview\nThe Common Vulnerability Scoring System (CVSS) is the industry standard framework maintained by FIRST (Forum of Incident Response and Security Teams) for assessing vulnerability severity. CVSS v4.0 (released November 2023) introduces refined metrics for more accurate scoring. This skill covers calculating CVSS scores, interpreting vector strings, and using CVSS alongside contextual factors like EPSS and CISA KEV for effective vulnerability prioritization.\n\n\n## When to Use\n\n- When managing security operations that require prioritizing vulnerabilities with cvss scoring\n- When improving security program maturity and operational processes\n- When establishing standardized procedures for security team workflows\n- When integrating threat intelligence or vulnerability data into operations\n\n## Prerequisites\n- Understanding of common vulnerability types (buffer overflow, injection, XSS, etc.)\n- Familiarity with networking concepts (attack vectors, protocols)\n- Access to NVD (National Vulnerability Database) for CVE lookups\n- Vulnerability scan results requiring prioritization\n\n## Core Concepts\n\n### CVSS v4.0 Metric Groups\n\n#### 1. Base Metrics (Intrinsic Severity)\nRepresent the inherent characteristics of a vulnerability:\n\n**Exploitability Metrics:**\n- **Attack Vector (AV)**: Network (N), Adjacent (A), Local (L), Physical (P)\n- **Attack Complexity (AC)**: Low (L), High (H)\n- **Attack Requirements (AT)**: None (N), Present (P) - NEW in v4.0\n- **Privileges Required (PR)**: None (N), Low (L), High (H)\n- **User Interaction (UI)**: None (N), Passive (P), Active (A) - Expanded in v4.0\n\n**Impact Metrics (Vulnerable System):**\n- **Confidentiality (VC)**: None (N), Low (L), High (H)\n- **Integrity (VI)**: None (N), Low (L), High (H)\n- **Availability (VA)**: None (N), Low (L), High (H)\n\n**Impact Metrics (Subsequent System):**\n- **Confidentiality (SC)**: None (N), Low (L), High (H)\n- **Integrity (SI)**: None (N), Low (L), High (H)\n- **Availability (SA)**: None (N), Low (L), High (H)\n\n#### 2. Threat Metrics (Dynamic Context)\n- **Exploit Maturity (E)**: Attacked (A), POC (P), Unreported (U)\n\n#### 3. Environmental Metrics (Organization-Specific)\nModified versions of base metrics reflecting local deployment context, plus:\n- **Confidentiality Requirement (CR)**: High (H), Medium (M), Low (L)\n- **Integrity Requirement (IR)**: High (H), Medium (M), Low (L)\n- **Availability Requirement (AR)**: High (H), Medium (M), Low (L)\n\n#### 4. Supplemental Metrics (Advisory Information)\n- **Safety (S)**: Present (P), Negligible (X)\n- **Automatable (AU)**: Yes (Y), No (N)\n- **Recovery (R)**: Automatic (A), User (U), Irrecoverable (I)\n- **Value Density (V)**: Diffuse (D), Concentrated (C)\n- **Vulnerability Response Effort (RE)**: Low (L), Moderate (M), High (H)\n- **Provider Urgency (U)**: Red, Amber, Green, Clear\n\n### CVSS v4.0 Severity Ratings\n| Score Range | Severity |\n|-------------|----------|\n| 0.0 | None |\n| 0.1 - 3.9 | Low |\n| 4.0 - 6.9 | Medium |\n| 7.0 - 8.9 | High |\n| 9.0 - 10.0 | Critical |\n\n### CVSS v4.0 Vector String Format\n```\nCVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N\n```\nThis example represents a network-exploitable vulnerability requiring no privileges, no user interaction, no attack requirements, with high impact on confidentiality, integrity, and availability of the vulnerable system.\n\n## Workflow\n\n### Step 1: Assess Base Metrics\nFor each vulnerability, evaluate:\n\n```\nExample: CVE-2024-3094 (XZ Utils Backdoor)\n\nAttack Vector:        Network (N)     - Exploitable over network\nAttack Complexity:    High (H)        - Specific conditions required\nAttack Requirements:  Present (P)     - Specific build\u002Fconfig needed\nPrivileges Required:  None (N)        - No authentication needed\nUser Interaction:     None (N)        - No victim action needed\n\nVulnerable System Impact:\n  Confidentiality:    High (H)        - Complete access to SSH keys\n  Integrity:          High (H)        - Arbitrary code execution\n  Availability:       High (H)        - Full system compromise\n\nSubsequent System Impact:\n  Confidentiality:    High (H)        - Lateral movement possible\n  Integrity:          High (H)        - Network-wide compromise\n  Availability:       None (N)        - No downstream availability impact\n\nVector: CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:H\u002FSI:H\u002FSA:N\n```\n\n### Step 2: Apply Threat Intelligence Context\nEnrich CVSS with real-world threat data:\n\n```\nExploit Maturity:     Attacked (A)    - Active exploitation in the wild\nEPSS Score:           0.94            - 94% probability of exploitation in 30 days\nCISA KEV:            Listed           - Mandatory remediation for federal agencies\n```\n\n### Step 3: Calculate Environmental Score\nAdjust for organizational context:\n\n```\nConfidentiality Req:  High (H)        - Handles PII\u002Ffinancial data\nIntegrity Req:        High (H)        - Critical business process\nAvailability Req:     Medium (M)      - Has DR\u002Ffailover capability\n\nModified Attack Vector: Network (N)   - Internet-facing deployment\n```\n\n### Step 4: Multi-Factor Prioritization Matrix\n\nCombine CVSS with additional prioritization factors:\n\n| Factor | Weight | Source |\n|--------|--------|--------|\n| CVSS Base Score | 25% | NVD\u002FScanner |\n| EPSS Score | 25% | FIRST EPSS API |\n| Asset Criticality | 20% | Asset inventory\u002FCMDB |\n| CISA KEV Listed | 15% | CISA catalog |\n| Network Exposure | 15% | Network segmentation data |\n\n### Step 5: Define Remediation SLAs\n\n| Priority Level | CVSS Range | EPSS | Asset Tier | SLA |\n|---------------|------------|------|------------|-----|\n| P1 - Emergency | 9.0-10.0 | >0.5 | Tier 1 | 24-48 hours |\n| P2 - Critical | 7.0-8.9 | >0.3 | Tier 1-2 | 7 days |\n| P3 - High | 7.0-8.9 | \u003C0.3 | Tier 2-3 | 14 days |\n| P4 - Medium | 4.0-6.9 | Any | Any | 30 days |\n| P5 - Low | 0.1-3.9 | Any | Any | 90 days |\n\n## Best Practices\n1. Never rely solely on CVSS base score for prioritization\n2. Always incorporate threat intelligence (EPSS, KEV, exploit databases)\n3. Maintain accurate asset criticality ratings in your CMDB\n4. Adjust environmental metrics for your specific deployment context\n5. Use CVSS v4.0 vector strings for precise communication between teams\n6. Document scoring rationale for audit trail and consistency\n7. Re-evaluate scores when new threat intelligence becomes available\n8. Train remediation teams on interpreting CVSS metrics and vector strings\n\n## Common Pitfalls\n- Treating CVSS base score as the sole prioritization factor\n- Ignoring environmental metrics that reflect organizational risk\n- Not updating threat metrics when exploit maturity changes\n- Confusing CVSS severity with actual organizational risk\n- Using outdated CVSS v2.0 scores instead of v3.1\u002Fv4.0\n- Over-relying on scanner-provided scores without validation\n\n## Related Skills\n- prioritizing-patches-with-exploit-prediction-scoring\n- implementing-risk-based-vulnerability-management\n- implementing-vulnerability-remediation-sla\n\n\n---\n\n## CyberSecSuite Integration\n\n```bash\n# Open a case before starting investigation\nmcp__cybersec__case_open --title \"vulnerabilities\" --type investigation\n\n# Persist findings to PostgreSQL\nmcp__cybersec__add_finding --title \"...\" --severity high --description \"...\"\n\n# Log IOCs\nmcp__cybersec__add_ioc --type domain --value \"...\" --confidence 0.9\n\n# Map to MITRE\nmcp__cybersec__suggest_mitre --description \"...\"\n```\n\n**Agent:** `@cybersec-agent` → delegates to appropriate specialist\n",{"name":5,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fvulnerabilities\u002Fprioritization\u002Fvulnerabilities","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":56,"prompt":66,"zipAvailable":67},[57,60,63],{"tool":58,"command":59},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill vulnerabilities-SKILL.md",{"tool":61,"command":62},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill vulnerabilities-SKILL.md",{"tool":64,"command":65},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill vulnerabilities-SKILL.md","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvulnerabilities\u002Fprioritization\u002Fvulnerabilities\u002FSKILL.md",true,[69,75,79,85,89,92,96,100,106,109],{"path":70,"resourceType":71,"resourceTypeDesc":72,"sizeBytes":73,"sourceHtmlUrl":74},"assets\u002Findex.json","ASSET","资产文件",84,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvulnerabilities\u002Fprioritization\u002Fvulnerabilities\u002Fassets\u002Findex.json",{"path":76,"resourceType":71,"resourceTypeDesc":72,"sizeBytes":77,"sourceHtmlUrl":78},"assets\u002Ftemplate.md",1417,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvulnerabilities\u002Fprioritization\u002Fvulnerabilities\u002Fassets\u002Ftemplate.md",{"path":80,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":83,"sourceHtmlUrl":84},"index.json","REFERENCE","参考文档",1552,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvulnerabilities\u002Fprioritization\u002Fvulnerabilities\u002Findex.json",{"path":86,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":87,"sourceHtmlUrl":88},"references\u002Fapi-reference.md",1916,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvulnerabilities\u002Fprioritization\u002Fvulnerabilities\u002Freferences\u002Fapi-reference.md",{"path":90,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":73,"sourceHtmlUrl":91},"references\u002Findex.json","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvulnerabilities\u002Fprioritization\u002Fvulnerabilities\u002Freferences\u002Findex.json",{"path":93,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":94,"sourceHtmlUrl":95},"references\u002Fstandards.md",1766,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvulnerabilities\u002Fprioritization\u002Fvulnerabilities\u002Freferences\u002Fstandards.md",{"path":97,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":98,"sourceHtmlUrl":99},"references\u002Fworkflows.md",2874,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvulnerabilities\u002Fprioritization\u002Fvulnerabilities\u002Freferences\u002Fworkflows.md",{"path":101,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":104,"sourceHtmlUrl":105},"scripts\u002Fagent.py","SCRIPT","脚本",6031,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvulnerabilities\u002Fprioritization\u002Fvulnerabilities\u002Fscripts\u002Fagent.py",{"path":107,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":73,"sourceHtmlUrl":108},"scripts\u002Findex.json","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvulnerabilities\u002Fprioritization\u002Fvulnerabilities\u002Fscripts\u002Findex.json",{"path":110,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":111,"sourceHtmlUrl":112},"scripts\u002Fprocess.py",15396,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvulnerabilities\u002Fprioritization\u002Fvulnerabilities\u002Fscripts\u002Fprocess.py",[114,140,163,185,207,223],{"skillNo":115,"name":116,"nameZh":6,"description":117,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":118,"categories":119,"keywords":120,"publishedAt":43},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","cybersecurity","process-forensics",{"skillNo":141,"name":142,"nameZh":6,"description":143,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":144,"categories":145,"keywords":146,"publishedAt":43},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[147,121,148,124,149,150,151,138,152,153,154,155,156,157,126,158,159,160,161,162],"exploit","services wmi exec exploit","exec","remote","traffic","Bash","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":164,"name":165,"nameZh":6,"description":166,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":167,"categories":168,"keywords":169,"publishedAt":43},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[170,171,172,173,174,175,138,152,176,153,177,178,126,160,179,180,181,182,183,184],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":186,"name":187,"nameZh":6,"description":188,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":189,"categories":190,"keywords":191,"publishedAt":43},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[122,192,193,194,195,196,197,127,198,138,139,199,200,201,202,203,204,205,206,126],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":208,"name":209,"nameZh":6,"description":210,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":211,"categories":212,"keywords":213,"publishedAt":43},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[214,215,122,216,194,196,217,127,218,198,138,139,153,219,220,221,222,206,126,128],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":224,"name":225,"nameZh":6,"description":226,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":227,"categories":228,"keywords":229,"publishedAt":43},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[230,122,194,231,217,127,232,233,138,139,234,235,236,237,238,239,126,128,240,241],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]