[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M73DABYSD02DF426CPZ881YA":3,"skill-same:01M73DABYSD02DF426CPZ881YA":106},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":16,"sourceHtmlUrl":17,"categories":18,"keywords":19,"publishedAt":20,"linkOnly":21,"markdownContent":22,"markdownBody":23,"frontMatter":24,"refName":48,"commitSha":49,"skillDirectory":50,"forksCount":51,"repositoryHtmlUrl":52,"repositoryHomepageUrl":53,"ownerHtmlUrl":54,"ownerBlogUrl":55,"ownerDescription":56,"updatedAt":57,"install":58,"resources":71},"01M73DABYSD02DF426CPZ881YA","intercepting-mobile-traffic-with-burpsuite",null,"Intercepts and analyzes HTTP\u002FHTTPS traffic from mobile applications using Burp Suite proxy to identify insecure API communications, authentication flaws, data leakage, and server-side vulnerabilities. Use when performing mobile application penetration testing, assessing API security, or evaluating client-server communication patterns. Activates for requests involving mobile traffic interception, Burp Suite mobile proxy, API security testing, or mobile HTTPS analysis.","Horonomos-laps\u002FYana-AI","Horonomos-laps","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F355299122?v=4","01M76B3QPXE88ET2SQPDPVATZT"," Horonomos-laps","01M72ZQRJPCYPSSWT4D00VJR2A",13,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fintercepting-mobile-traffic-with-burpsuite\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fintercepting-mobile-traffic-with-burpsuite\u002FSKILL.md",[],[],"2026-11-11 15:11:14",false,"---\nname: intercepting-mobile-traffic-with-burpsuite\ndescription: 'Intercepts and analyzes HTTP\u002FHTTPS traffic from mobile applications\n  using Burp Suite proxy to identify insecure API communications, authentication flaws,\n  data leakage, and server-side vulnerabilities. Use when performing mobile application\n  penetration testing, assessing API security, or evaluating client-server communication\n  patterns. Activates for requests involving mobile traffic interception, Burp Suite\n  mobile proxy, API security testing, or mobile HTTPS analysis.\n\n  '\ndomain: cybersecurity\nsubdomain: mobile-security\nauthor: mahipal\ntags:\n- mobile-security\n- android\n- ios\n- burp-suite\n- traffic-interception\n- penetration-testing\nversion: 1.0.0\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- PR.AA-05\n- ID.RA-01\n- DE.CM-09\nmitre_attack:\n- T1059\n- T1056\n- T1036\n- T1078\nsource: https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\nsource_commit: 04450304b12645cb2b974ab96d28c0664758a88d\n---\n# Intercepting Mobile Traffic with Burp Suite\n\n## When to Use\n\nUse this skill when:\n- Testing mobile application API endpoints for authentication, authorization, and injection vulnerabilities\n- Analyzing data transmitted between mobile apps and backend servers during penetration tests\n- Evaluating certificate pinning implementations and their bypass difficulty\n- Identifying sensitive data leakage in mobile network traffic\n\n**Do not use** this skill to intercept traffic from applications you are not authorized to test -- traffic interception without authorization violates computer fraud laws.\n\n## Prerequisites\n\n- Burp Suite Professional or Community Edition installed on testing workstation\n- Android device\u002Femulator or iOS device on the same network as Burp Suite host\n- Burp Suite CA certificate installed on the target device\n- For Android 7+: Network security config modification or Magisk module for system CA trust\n- For SSL pinning bypass: Frida + Objection or custom Frida scripts\n- Wi-Fi network where proxy configuration is possible\n\n## Workflow\n\n### Step 1: Configure Burp Suite Proxy Listener\n\n```\nBurp Suite > Proxy > Options > Proxy Listeners:\n- Bind to address: All interfaces (or specific IP)\n- Bind to port: 8080\n- Enable \"Support invisible proxying\"\n```\n\nVerify the listener is active and note the workstation's IP address on the shared network.\n\n### Step 2: Configure Mobile Device Proxy\n\n**Android:**\n```\nSettings > Wi-Fi > [Network] > Advanced > Manual Proxy\n- Host: \u003Cburp_workstation_ip>\n- Port: 8080\n```\n\n**iOS:**\n```\nSettings > Wi-Fi > [Network] > Configure Proxy > Manual\n- Server: \u003Cburp_workstation_ip>\n- Port: 8080\n```\n\n### Step 3: Install Burp Suite CA Certificate\n\n**Android (below API 24):**\n```bash\n# Export Burp CA from Proxy > Options > Import\u002FExport CA Certificate\n# Transfer to device and install via Settings > Security > Install from storage\n```\n\n**Android (API 24+ \u002F Android 7+):**\nApps targeting API 24+ do not trust user-installed CAs by default. Options:\n```bash\n# Option A: Modify app's network_security_config.xml (requires APK rebuild)\n# Add to res\u002Fxml\u002Fnetwork_security_config.xml:\n# \u003Cnetwork-security-config>\n#   \u003Cdebug-overrides>\n#     \u003Ctrust-anchors>\n#       \u003Ccertificates src=\"user\" \u002F>\n#     \u003C\u002Ftrust-anchors>\n#   \u003C\u002Fdebug-overrides>\n# \u003C\u002Fnetwork-security-config>\n\n# Option B: Install as system CA (rooted device)\nopenssl x509 -inform DER -in burp-ca.der -out burp-ca.pem\nHASH=$(openssl x509 -inform PEM -subject_hash_old -in burp-ca.pem | head -1)\ncp burp-ca.pem \"$HASH.0\"\nadb push \"$HASH.0\" \u002Fsystem\u002Fetc\u002Fsecurity\u002Fcacerts\u002F\nadb shell chmod 644 \u002Fsystem\u002Fetc\u002Fsecurity\u002Fcacerts\u002F$HASH.0\n\n# Option C: Magisk module (MagiskTrustUserCerts)\n```\n\n**iOS:**\n```\n1. Navigate to http:\u002F\u002F\u003Cburp_ip>:8080 in Safari\n2. Download Burp CA certificate\n3. Settings > General > VPN & Device Management > Install profile\n4. Settings > General > About > Certificate Trust Settings > Enable full trust\n```\n\n### Step 4: Intercept and Analyze Traffic\n\nWith proxy configured, open the target app and navigate through its functionality:\n\n**Burp Suite > Proxy > HTTP History**: Review all captured requests and responses.\n\nKey areas to analyze:\n- **Authentication tokens**: JWT structure, token expiration, refresh mechanisms\n- **API endpoints**: RESTful paths, GraphQL queries, parameter patterns\n- **Sensitive data in transit**: PII, credentials, financial data\n- **Response headers**: Security headers (HSTS, CSP, X-Frame-Options)\n- **Error responses**: Stack traces, debug information, internal paths\n\n### Step 5: Test API Vulnerabilities Using Burp Repeater\n\nForward intercepted requests to Repeater for manual testing:\n\n```\nRight-click request > Send to Repeater\n\nTest categories:\n- Authentication bypass: Remove\u002Fmodify auth tokens\n- IDOR: Modify user IDs, object references\n- Injection: SQL injection, NoSQL injection in parameters\n- Rate limiting: Rapid request replay for brute force assessment\n- Business logic: Modify prices, quantities, permissions in requests\n```\n\n### Step 6: Automate Testing with Burp Scanner\n\n```\nRight-click request > Do active scan (Professional only)\n\nScanner checks:\n- SQL injection (error-based, blind, time-based)\n- XSS (reflected, stored)\n- Command injection\n- Path traversal\n- XML\u002FJSON injection\n- Authentication flaws\n```\n\n### Step 7: Handle Certificate Pinning\n\nIf traffic is not visible due to certificate pinning:\n\n```bash\n# Frida-based bypass (generic)\nfrida -U -f com.target.app -l ssl-pinning-bypass.js\n\n# Objection bypass\nobjection --gadget com.target.app explore\nios sslpinning disable  # or\nandroid sslpinning disable\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **MITM Proxy** | Man-in-the-middle proxy that terminates and re-establishes TLS connections to inspect encrypted traffic |\n| **Certificate Pinning** | Client-side validation that restricts accepted server certificates beyond the OS trust store |\n| **Network Security Config** | Android XML configuration controlling app trust anchors, cleartext traffic policy, and certificate pinning |\n| **Invisible Proxying** | Burp feature handling non-proxy-aware clients that don't send CONNECT requests |\n| **IDOR** | Insecure Direct Object Reference -- accessing resources by manipulating identifiers without authorization checks |\n\n## Tools & Systems\n\n- **Burp Suite Professional**: Full-featured web application security testing proxy with active scanner\n- **Burp Suite Community**: Free version with manual interception and basic tools\n- **Frida**: Dynamic instrumentation for runtime SSL pinning bypass\n- **mitmproxy**: Open-source alternative to Burp Suite for programmatic traffic analysis\n- **Charles Proxy**: Alternative HTTP proxy with mobile-friendly certificate installation\n\n## Common Pitfalls\n\n- **Android 7+ CA trust**: User-installed certificates are not trusted by apps targeting API 24+. Must use system CA installation or app modification.\n- **Certificate transparency**: Some apps use Certificate Transparency logs to detect MITM. Check for CT enforcement in the app.\n- **Non-HTTP protocols**: Burp Suite only handles HTTP\u002FHTTPS. Use Wireshark for WebSocket, MQTT, gRPC, or custom binary protocols.\n- **VPN-based apps**: Apps using VPN tunnels bypass device proxy settings. May need iptables rules on a rooted device to redirect traffic.\n","# Intercepting Mobile Traffic with Burp Suite\n\n## When to Use\n\nUse this skill when:\n- Testing mobile application API endpoints for authentication, authorization, and injection vulnerabilities\n- Analyzing data transmitted between mobile apps and backend servers during penetration tests\n- Evaluating certificate pinning implementations and their bypass difficulty\n- Identifying sensitive data leakage in mobile network traffic\n\n**Do not use** this skill to intercept traffic from applications you are not authorized to test -- traffic interception without authorization violates computer fraud laws.\n\n## Prerequisites\n\n- Burp Suite Professional or Community Edition installed on testing workstation\n- Android device\u002Femulator or iOS device on the same network as Burp Suite host\n- Burp Suite CA certificate installed on the target device\n- For Android 7+: Network security config modification or Magisk module for system CA trust\n- For SSL pinning bypass: Frida + Objection or custom Frida scripts\n- Wi-Fi network where proxy configuration is possible\n\n## Workflow\n\n### Step 1: Configure Burp Suite Proxy Listener\n\n```\nBurp Suite > Proxy > Options > Proxy Listeners:\n- Bind to address: All interfaces (or specific IP)\n- Bind to port: 8080\n- Enable \"Support invisible proxying\"\n```\n\nVerify the listener is active and note the workstation's IP address on the shared network.\n\n### Step 2: Configure Mobile Device Proxy\n\n**Android:**\n```\nSettings > Wi-Fi > [Network] > Advanced > Manual Proxy\n- Host: \u003Cburp_workstation_ip>\n- Port: 8080\n```\n\n**iOS:**\n```\nSettings > Wi-Fi > [Network] > Configure Proxy > Manual\n- Server: \u003Cburp_workstation_ip>\n- Port: 8080\n```\n\n### Step 3: Install Burp Suite CA Certificate\n\n**Android (below API 24):**\n```bash\n# Export Burp CA from Proxy > Options > Import\u002FExport CA Certificate\n# Transfer to device and install via Settings > Security > Install from storage\n```\n\n**Android (API 24+ \u002F Android 7+):**\nApps targeting API 24+ do not trust user-installed CAs by default. Options:\n```bash\n# Option A: Modify app's network_security_config.xml (requires APK rebuild)\n# Add to res\u002Fxml\u002Fnetwork_security_config.xml:\n# \u003Cnetwork-security-config>\n#   \u003Cdebug-overrides>\n#     \u003Ctrust-anchors>\n#       \u003Ccertificates src=\"user\" \u002F>\n#     \u003C\u002Ftrust-anchors>\n#   \u003C\u002Fdebug-overrides>\n# \u003C\u002Fnetwork-security-config>\n\n# Option B: Install as system CA (rooted device)\nopenssl x509 -inform DER -in burp-ca.der -out burp-ca.pem\nHASH=$(openssl x509 -inform PEM -subject_hash_old -in burp-ca.pem | head -1)\ncp burp-ca.pem \"$HASH.0\"\nadb push \"$HASH.0\" \u002Fsystem\u002Fetc\u002Fsecurity\u002Fcacerts\u002F\nadb shell chmod 644 \u002Fsystem\u002Fetc\u002Fsecurity\u002Fcacerts\u002F$HASH.0\n\n# Option C: Magisk module (MagiskTrustUserCerts)\n```\n\n**iOS:**\n```\n1. Navigate to http:\u002F\u002F\u003Cburp_ip>:8080 in Safari\n2. Download Burp CA certificate\n3. Settings > General > VPN & Device Management > Install profile\n4. Settings > General > About > Certificate Trust Settings > Enable full trust\n```\n\n### Step 4: Intercept and Analyze Traffic\n\nWith proxy configured, open the target app and navigate through its functionality:\n\n**Burp Suite > Proxy > HTTP History**: Review all captured requests and responses.\n\nKey areas to analyze:\n- **Authentication tokens**: JWT structure, token expiration, refresh mechanisms\n- **API endpoints**: RESTful paths, GraphQL queries, parameter patterns\n- **Sensitive data in transit**: PII, credentials, financial data\n- **Response headers**: Security headers (HSTS, CSP, X-Frame-Options)\n- **Error responses**: Stack traces, debug information, internal paths\n\n### Step 5: Test API Vulnerabilities Using Burp Repeater\n\nForward intercepted requests to Repeater for manual testing:\n\n```\nRight-click request > Send to Repeater\n\nTest categories:\n- Authentication bypass: Remove\u002Fmodify auth tokens\n- IDOR: Modify user IDs, object references\n- Injection: SQL injection, NoSQL injection in parameters\n- Rate limiting: Rapid request replay for brute force assessment\n- Business logic: Modify prices, quantities, permissions in requests\n```\n\n### Step 6: Automate Testing with Burp Scanner\n\n```\nRight-click request > Do active scan (Professional only)\n\nScanner checks:\n- SQL injection (error-based, blind, time-based)\n- XSS (reflected, stored)\n- Command injection\n- Path traversal\n- XML\u002FJSON injection\n- Authentication flaws\n```\n\n### Step 7: Handle Certificate Pinning\n\nIf traffic is not visible due to certificate pinning:\n\n```bash\n# Frida-based bypass (generic)\nfrida -U -f com.target.app -l ssl-pinning-bypass.js\n\n# Objection bypass\nobjection --gadget com.target.app explore\nios sslpinning disable  # or\nandroid sslpinning disable\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **MITM Proxy** | Man-in-the-middle proxy that terminates and re-establishes TLS connections to inspect encrypted traffic |\n| **Certificate Pinning** | Client-side validation that restricts accepted server certificates beyond the OS trust store |\n| **Network Security Config** | Android XML configuration controlling app trust anchors, cleartext traffic policy, and certificate pinning |\n| **Invisible Proxying** | Burp feature handling non-proxy-aware clients that don't send CONNECT requests |\n| **IDOR** | Insecure Direct Object Reference -- accessing resources by manipulating identifiers without authorization checks |\n\n## Tools & Systems\n\n- **Burp Suite Professional**: Full-featured web application security testing proxy with active scanner\n- **Burp Suite Community**: Free version with manual interception and basic tools\n- **Frida**: Dynamic instrumentation for runtime SSL pinning bypass\n- **mitmproxy**: Open-source alternative to Burp Suite for programmatic traffic analysis\n- **Charles Proxy**: Alternative HTTP proxy with mobile-friendly certificate installation\n\n## Common Pitfalls\n\n- **Android 7+ CA trust**: User-installed certificates are not trusted by apps targeting API 24+. Must use system CA installation or app modification.\n- **Certificate transparency**: Some apps use Certificate Transparency logs to detect MITM. Check for CT enforcement in the app.\n- **Non-HTTP protocols**: Burp Suite only handles HTTP\u002FHTTPS. Use Wireshark for WebSocket, MQTT, gRPC, or custom binary protocols.\n- **VPN-based apps**: Apps using VPN tunnels bypass device proxy settings. May need iptables rules on a rooted device to redirect traffic.\n",{"name":5,"tags":25,"author":32,"domain":33,"source":34,"license":15,"version":35,"nist_csf":36,"subdomain":26,"description":41,"mitre_attack":42,"source_commit":47},[26,27,28,29,30,31],"mobile-security","android","ios","burp-suite","traffic-interception","penetration-testing","mahipal","cybersecurity","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","1.0.0",[37,38,39,40],"PR.PS-01","PR.AA-05","ID.RA-01","DE.CM-09","Intercepts and analyzes HTTP\u002FHTTPS traffic from mobile applications using Burp Suite proxy to identify insecure API communications, authentication flaws, data leakage, and server-side vulnerabilities. Use when performing mobile application penetration testing, assessing API security, or evaluating client-server communication patterns. Activates for requests involving mobile traffic interception, Burp Suite mobile proxy, API security testing, or mobile HTTPS analysis.\n",[43,44,45,46],"T1059","T1056","T1036","T1078","04450304b12645cb2b974ab96d28c0664758a88d","main","481dcd7dd2e288b9d627a2bd017db70e64e6c6fa","core\u002Fskills\u002Fintercepting-mobile-traffic-with-burpsuite",2,"https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI","https:\u002F\u002Fyana.vutam.link\u002F","https:\u002F\u002Fgithub.com\u002FHoronomos-laps","https:\u002F\u002Fyana.vutam.link","An open-source governed runtime & execution environment for multi-agent AI systems.","2026-11-14 13:24:09",{"source":8,"skillName":5,"commands":59,"prompt":69,"zipAvailable":70},[60,63,66],{"tool":61,"command":62},"npx","npx skills add Horonomos-laps\u002FYana-AI --skill intercepting-mobile-traffic-with-burpsuite",{"tool":64,"command":65},"bunx","bunx skills add Horonomos-laps\u002FYana-AI --skill intercepting-mobile-traffic-with-burpsuite",{"tool":67,"command":68},"pnpm","pnpm dlx skills add Horonomos-laps\u002FYana-AI --skill intercepting-mobile-traffic-with-burpsuite","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fintercepting-mobile-traffic-with-burpsuite\u002FSKILL.md",true,[72,78,82,88,92,96,102],{"path":73,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":76,"sourceHtmlUrl":77},"assets\u002Ftemplate.md","ASSET","资产文件",1493,"https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fintercepting-mobile-traffic-with-burpsuite\u002Fassets\u002Ftemplate.md",{"path":79,"resourceType":79,"resourceTypeDesc":80,"sizeBytes":81,"sourceHtmlUrl":16},"LICENSE","许可证",11255,{"path":83,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":86,"sourceHtmlUrl":87},"references\u002Fapi-reference.md","REFERENCE","参考文档",1756,"https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fintercepting-mobile-traffic-with-burpsuite\u002Freferences\u002Fapi-reference.md",{"path":89,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":90,"sourceHtmlUrl":91},"references\u002Fstandards.md",2319,"https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fintercepting-mobile-traffic-with-burpsuite\u002Freferences\u002Fstandards.md",{"path":93,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":94,"sourceHtmlUrl":95},"references\u002Fworkflows.md",4174,"https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fintercepting-mobile-traffic-with-burpsuite\u002Freferences\u002Fworkflows.md",{"path":97,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":100,"sourceHtmlUrl":101},"scripts\u002Fagent.py","SCRIPT","脚本",6548,"https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fintercepting-mobile-traffic-with-burpsuite\u002Fscripts\u002Fagent.py",{"path":103,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":104,"sourceHtmlUrl":105},"scripts\u002Fprocess.py",9891,"https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fintercepting-mobile-traffic-with-burpsuite\u002Fscripts\u002Fprocess.py",[107,115,122,130,138,146],{"skillNo":108,"name":109,"nameZh":6,"description":110,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":111,"licenseFileUrl":6,"sourceHtmlUrl":112,"categories":113,"keywords":114,"publishedAt":20},"01M735GKET5YVYKAY62W2P5YXB","openai--sentry--sentry","Use when the user asks to inspect Sentry issues or events, summarize recent production errors, or pull basic Sentry health data via the Sentry API; perform read-only queries with the bundled script and require `SENTRY_AUTH_TOKEN`.","MIT","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fopenai--sentry--sentry\u002FSKILL.md",[],[],{"skillNo":116,"name":117,"nameZh":6,"description":118,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":119,"categories":120,"keywords":121,"publishedAt":20},"01M73DCAP83T17HY7SMGK7MGFE","ito-basket-compare","Compare Itô prediction-market baskets against a user's knowledge base, portfolio notes, financial context, watchlist, or research thesis. Use for read-only basket comparison and gap analysis without investment advice or live trading.","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fito-basket-compare\u002FSKILL.md",[],[],{"skillNo":123,"name":124,"nameZh":6,"description":125,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":126,"sourceHtmlUrl":127,"categories":128,"keywords":129,"publishedAt":20},"01M734CYEMZFDR3KH6SW0JP8TD","implementing-network-traffic-baselining","Build network traffic baselines from NetFlow\u002FIPFIX data using Python pandas for statistical analysis, z-score anomaly detection, and hourly\u002Fdaily traffic pattern profiling","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-network-traffic-baselining\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-network-traffic-baselining\u002FSKILL.md",[],[],{"skillNo":131,"name":132,"nameZh":6,"description":133,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":134,"sourceHtmlUrl":135,"categories":136,"keywords":137,"publishedAt":20},"01M73ASZ6NJRJM44Z2P84NGQ3Q","detecting-evasion-techniques-in-endpoint-logs","Detects defense evasion techniques used by adversaries in endpoint logs including log tampering, timestomping, process injection, and security tool disabling. Use when investigating suspicious endpoint behavior, building detection rules for evasion tactics, or conducting threat hunting for stealthy adversary activity. Activates for requests involving evasion detection, defense evasion analysis, log tampering detection, or MITRE ATT&CK TA0005.","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fdetecting-evasion-techniques-in-endpoint-logs\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fdetecting-evasion-techniques-in-endpoint-logs\u002FSKILL.md",[],[],{"skillNo":139,"name":140,"nameZh":6,"description":141,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":142,"sourceHtmlUrl":143,"categories":144,"keywords":145,"publishedAt":20},"01M734AFNXD06Z78QRK0VKGT7Q","implementing-microsegmentation-with-guardicore","Implementing microsegmentation using Akamai Guardicore Segmentation to map application dependencies, create granular network policies, visualize east-west traffic flows, and enforce least-privilege communication between workloads across data centers and cloud.","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-microsegmentation-with-guardicore\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-microsegmentation-with-guardicore\u002FSKILL.md",[],[],{"skillNo":147,"name":148,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":149,"categories":150,"keywords":151,"publishedAt":20},"01M736TK27QMCXK0DVCH25SJN5","ramdisk-tmpfs-patterns","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Framdisk-tmpfs-patterns\u002FSKILL.md",[],[]]