[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M73FC6KD0TMQJ7HXYHMPDYSG":3,"skill-same:01M73FC6KD0TMQJ7HXYHMPDYSG":47},{"skillNo":4,"name":5,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":18,"linkOnly":19,"markdownContent":20,"markdownBody":21,"frontMatter":22,"refName":23,"commitSha":24,"skillDirectory":25,"forksCount":26,"repositoryHtmlUrl":27,"repositoryHomepageUrl":28,"ownerHtmlUrl":29,"ownerBlogUrl":30,"ownerDescription":31,"updatedAt":32,"install":33,"resources":46},"01M73FC6KD0TMQJ7HXYHMPDYSG","raw-socket-diagnostics",null,"Horonomos-laps\u002FYana-AI","Horonomos-laps","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F355299122?v=4","01M76B3QPXE88ET2SQPDPVATZT"," Horonomos-laps","01M72ZQRJPCYPSSWT4D00VJR2A",13,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fraw-socket-diagnostics\u002FSKILL.md",[],[],"2026-11-11 15:11:14",false,"---\nname: raw-socket-diagnostics\ndescription: Raw IP packet analysis for agent network diagnostics. ICMP ping, TCP port probing, packet crafting, and network path tracing using raw sockets — for Sandbox network isolation validation. Sources: indutny\u002Fraw-socket.\norigin: yana-ai — synthesized from indutny\u002Fraw-socket (MIT), RFC 792 ICMP\nlicense: Apache-2.0\nversion: 1.0.0\ncompatibility: yana-ai >= 1.3.48\n---\n\n# \u002Fraw-socket-diagnostics\n\n## When to Use\n\n- Verify sandbox network isolation: confirm agent CANNOT reach internal IPs\n- ICMP ping without spawning subprocess (`ping` command)\n- TCP SYN probe to check port reachability for egress auditing\n- Validate that network namespace isolation is working correctly\n\n## Do NOT use for\n\n- Production agent traffic (use standard HTTP clients)\n- Environments without CAP_NET_RAW (most container environments)\n\n---\n\n## ICMP ping (verify isolation)\n\n```javascript\nimport raw from 'raw-socket'\n\nfunction icmpPing(host: string, timeoutMs = 2000): Promise\u003Cboolean> {\n  return new Promise((resolve) => {\n    \u002F\u002F Protocol 1 = ICMP\n    const socket = raw.createSocket({ protocol: raw.Protocol.ICMP })\n\n    const timer = setTimeout(() => {\n      socket.close()\n      resolve(false)  \u002F\u002F timeout = not reachable\n    }, timeoutMs)\n\n    socket.on('message', () => {\n      clearTimeout(timer)\n      socket.close()\n      resolve(true)   \u002F\u002F received ICMP reply = reachable\n    })\n\n    socket.on('error', () => {\n      clearTimeout(timer)\n      socket.close()\n      resolve(false)\n    })\n\n    \u002F\u002F Send ICMP echo request\n    const buf = Buffer.alloc(8)\n    buf.writeUInt8(8, 0)   \u002F\u002F type = echo request\n    buf.writeUInt8(0, 1)   \u002F\u002F code = 0\n    buf.writeUInt16BE(1234, 4)  \u002F\u002F identifier\n    buf.writeUInt16BE(1, 6)     \u002F\u002F sequence\n\n    socket.send(buf, 0, buf.length, host, () => {})\n  })\n}\n```\n\n---\n\n## Sandbox isolation test\n\n```bash\n#!\u002Fusr\u002Fbin\u002Fenv bash\n# validate-sandbox-isolation.sh — verify network isolation from inside sandbox\nset -euo pipefail\n\nISOLATED=true\n\n# These should all FAIL if sandbox network isolation is working\nfor target in \"169.254.169.254\" \"10.0.0.1\" \"192.168.1.1\" \"172.17.0.1\"; do\n  if ping -c1 -W1 \"$target\" &>\u002Fdev\u002Fnull; then\n    echo \"[FAIL] Can reach $target — isolation broken!\" >&2\n    ISOLATED=false\n  else\n    echo \"[OK]   Cannot reach $target\"\n  fi\ndone\n\n$ISOLATED && echo \"[PASS] Network isolation verified\"\n```\n\n---\n\n## TCP port probe\n\n```javascript\nimport net from 'net'\n\nfunction tcpProbe(host: string, port: number, timeoutMs = 2000): Promise\u003Cboolean> {\n  return new Promise((resolve) => {\n    const socket = new net.Socket()\n\n    socket.setTimeout(timeoutMs)\n    socket.connect(port, host, () => { socket.destroy(); resolve(true) })\n    socket.on('error', () => resolve(false))\n    socket.on('timeout', () => { socket.destroy(); resolve(false) })\n  })\n}\n\n\u002F\u002F Verify agent cannot reach internal Kubernetes API\nconst k8sReachable = await tcpProbe('10.96.0.1', 443, 1000)\nif (k8sReachable) throw new Error('[security] sandbox can reach k8s API — isolation broken!')\n```\n\n---\n\n## Anti-Fake-Pass Checklist\n\n```\n❌ CAP_NET_RAW required — raw sockets fail silently in containers without this cap\n❌ ICMP blocked by firewall → false negative (host exists but no ICMP reply)\n❌ DNS resolution before raw socket → DNS may succeed even when ICMP is blocked\n❌ raw-socket platform support: Linux\u002FmacOS only, not Windows\n❌ No timeout → raw socket hangs if host is in black-hole state\n❌ Testing isolation from OUTSIDE sandbox → must run the check INSIDE the sandbox\n```\n","# \u002Fraw-socket-diagnostics\n\n## When to Use\n\n- Verify sandbox network isolation: confirm agent CANNOT reach internal IPs\n- ICMP ping without spawning subprocess (`ping` command)\n- TCP SYN probe to check port reachability for egress auditing\n- Validate that network namespace isolation is working correctly\n\n## Do NOT use for\n\n- Production agent traffic (use standard HTTP clients)\n- Environments without CAP_NET_RAW (most container environments)\n\n---\n\n## ICMP ping (verify isolation)\n\n```javascript\nimport raw from 'raw-socket'\n\nfunction icmpPing(host: string, timeoutMs = 2000): Promise\u003Cboolean> {\n  return new Promise((resolve) => {\n    \u002F\u002F Protocol 1 = ICMP\n    const socket = raw.createSocket({ protocol: raw.Protocol.ICMP })\n\n    const timer = setTimeout(() => {\n      socket.close()\n      resolve(false)  \u002F\u002F timeout = not reachable\n    }, timeoutMs)\n\n    socket.on('message', () => {\n      clearTimeout(timer)\n      socket.close()\n      resolve(true)   \u002F\u002F received ICMP reply = reachable\n    })\n\n    socket.on('error', () => {\n      clearTimeout(timer)\n      socket.close()\n      resolve(false)\n    })\n\n    \u002F\u002F Send ICMP echo request\n    const buf = Buffer.alloc(8)\n    buf.writeUInt8(8, 0)   \u002F\u002F type = echo request\n    buf.writeUInt8(0, 1)   \u002F\u002F code = 0\n    buf.writeUInt16BE(1234, 4)  \u002F\u002F identifier\n    buf.writeUInt16BE(1, 6)     \u002F\u002F sequence\n\n    socket.send(buf, 0, buf.length, host, () => {})\n  })\n}\n```\n\n---\n\n## Sandbox isolation test\n\n```bash\n#!\u002Fusr\u002Fbin\u002Fenv bash\n# validate-sandbox-isolation.sh — verify network isolation from inside sandbox\nset -euo pipefail\n\nISOLATED=true\n\n# These should all FAIL if sandbox network isolation is working\nfor target in \"169.254.169.254\" \"10.0.0.1\" \"192.168.1.1\" \"172.17.0.1\"; do\n  if ping -c1 -W1 \"$target\" &>\u002Fdev\u002Fnull; then\n    echo \"[FAIL] Can reach $target — isolation broken!\" >&2\n    ISOLATED=false\n  else\n    echo \"[OK]   Cannot reach $target\"\n  fi\ndone\n\n$ISOLATED && echo \"[PASS] Network isolation verified\"\n```\n\n---\n\n## TCP port probe\n\n```javascript\nimport net from 'net'\n\nfunction tcpProbe(host: string, port: number, timeoutMs = 2000): Promise\u003Cboolean> {\n  return new Promise((resolve) => {\n    const socket = new net.Socket()\n\n    socket.setTimeout(timeoutMs)\n    socket.connect(port, host, () => { socket.destroy(); resolve(true) })\n    socket.on('error', () => resolve(false))\n    socket.on('timeout', () => { socket.destroy(); resolve(false) })\n  })\n}\n\n\u002F\u002F Verify agent cannot reach internal Kubernetes API\nconst k8sReachable = await tcpProbe('10.96.0.1', 443, 1000)\nif (k8sReachable) throw new Error('[security] sandbox can reach k8s API — isolation broken!')\n```\n\n---\n\n## Anti-Fake-Pass Checklist\n\n```\n❌ CAP_NET_RAW required — raw sockets fail silently in containers without this cap\n❌ ICMP blocked by firewall → false negative (host exists but no ICMP reply)\n❌ DNS resolution before raw socket → DNS may succeed even when ICMP is blocked\n❌ raw-socket platform support: Linux\u002FmacOS only, not Windows\n❌ No timeout → raw socket hangs if host is in black-hole state\n❌ Testing isolation from OUTSIDE sandbox → must run the check INSIDE the sandbox\n```\n",{},"main","481dcd7dd2e288b9d627a2bd017db70e64e6c6fa","core\u002Fskills\u002Fraw-socket-diagnostics",1,"https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI","https:\u002F\u002Fyana.vutam.link\u002F","https:\u002F\u002Fgithub.com\u002FHoronomos-laps","https:\u002F\u002Fyana.vutam.link","An open-source governed runtime & execution environment for multi-agent AI systems.","2026-11-11 23:56:26",{"source":7,"skillName":5,"commands":34,"prompt":44,"zipAvailable":45},[35,38,41],{"tool":36,"command":37},"npx","npx skills add Horonomos-laps\u002FYana-AI --skill raw-socket-diagnostics",{"tool":39,"command":40},"bunx","bunx skills add Horonomos-laps\u002FYana-AI --skill raw-socket-diagnostics",{"tool":42,"command":43},"pnpm","pnpm dlx skills add Horonomos-laps\u002FYana-AI --skill raw-socket-diagnostics","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fraw-socket-diagnostics\u002FSKILL.md",true,[],[48,56,63,71,79,87],{"skillNo":49,"name":50,"nameZh":6,"description":51,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":52,"licenseFileUrl":6,"sourceHtmlUrl":53,"categories":54,"keywords":55,"publishedAt":18},"01M735GKET5YVYKAY62W2P5YXB","openai--sentry--sentry","Use when the user asks to inspect Sentry issues or events, summarize recent production errors, or pull basic Sentry health data via the Sentry API; perform read-only queries with the bundled script and require `SENTRY_AUTH_TOKEN`.","MIT","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fopenai--sentry--sentry\u002FSKILL.md",[],[],{"skillNo":57,"name":58,"nameZh":6,"description":59,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":60,"categories":61,"keywords":62,"publishedAt":18},"01M73DCAP83T17HY7SMGK7MGFE","ito-basket-compare","Compare Itô prediction-market baskets against a user's knowledge base, portfolio notes, financial context, watchlist, or research thesis. Use for read-only basket comparison and gap analysis without investment advice or live trading.","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fito-basket-compare\u002FSKILL.md",[],[],{"skillNo":64,"name":65,"nameZh":6,"description":66,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":67,"sourceHtmlUrl":68,"categories":69,"keywords":70,"publishedAt":18},"01M734CYEMZFDR3KH6SW0JP8TD","implementing-network-traffic-baselining","Build network traffic baselines from NetFlow\u002FIPFIX data using Python pandas for statistical analysis, z-score anomaly detection, and hourly\u002Fdaily traffic pattern profiling","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-network-traffic-baselining\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-network-traffic-baselining\u002FSKILL.md",[],[],{"skillNo":72,"name":73,"nameZh":6,"description":74,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":75,"sourceHtmlUrl":76,"categories":77,"keywords":78,"publishedAt":18},"01M73ASZ6NJRJM44Z2P84NGQ3Q","detecting-evasion-techniques-in-endpoint-logs","Detects defense evasion techniques used by adversaries in endpoint logs including log tampering, timestomping, process injection, and security tool disabling. Use when investigating suspicious endpoint behavior, building detection rules for evasion tactics, or conducting threat hunting for stealthy adversary activity. Activates for requests involving evasion detection, defense evasion analysis, log tampering detection, or MITRE ATT&CK TA0005.","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fdetecting-evasion-techniques-in-endpoint-logs\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fdetecting-evasion-techniques-in-endpoint-logs\u002FSKILL.md",[],[],{"skillNo":80,"name":81,"nameZh":6,"description":82,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":83,"sourceHtmlUrl":84,"categories":85,"keywords":86,"publishedAt":18},"01M734AFNXD06Z78QRK0VKGT7Q","implementing-microsegmentation-with-guardicore","Implementing microsegmentation using Akamai Guardicore Segmentation to map application dependencies, create granular network policies, visualize east-west traffic flows, and enforce least-privilege communication between workloads across data centers and cloud.","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-microsegmentation-with-guardicore\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-microsegmentation-with-guardicore\u002FSKILL.md",[],[],{"skillNo":88,"name":89,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":90,"categories":91,"keywords":92,"publishedAt":18},"01M736TK27QMCXK0DVCH25SJN5","ramdisk-tmpfs-patterns","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Framdisk-tmpfs-patterns\u002FSKILL.md",[],[]]