[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M755MNPDYZAVGWAF9G920B1C":3,"skill-same:01M755MNPDYZAVGWAF9G920B1C":90},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":16,"sourceHtmlUrl":17,"categories":18,"keywords":19,"publishedAt":20,"linkOnly":21,"markdownContent":22,"markdownBody":23,"frontMatter":24,"refName":36,"commitSha":37,"skillDirectory":5,"forksCount":14,"repositoryHtmlUrl":38,"repositoryHomepageUrl":6,"ownerHtmlUrl":39,"ownerBlogUrl":40,"ownerDescription":6,"updatedAt":41,"install":42,"resources":55},"01M755MNPDYZAVGWAF9G920B1C","performing-memory-forensics-with-volatility3-plugins",null,"Analyze memory dumps using Volatility3 plugins to detect injected code, rootkits, credential theft, and malware artifacts in Windows, Linux, and macOS memory images.","SamuelChien\u002Fmega-skills-collection","SamuelChien","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F4652114?v=4","01M74KK34WVHA0P5ZYSJRDDFMG","Samuel Chien","01M74KK35FQN1N9VZ9EPTH3P2S",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fperforming-memory-forensics-with-volatility3-plugins\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fperforming-memory-forensics-with-volatility3-plugins\u002FSKILL.md",[],[],"2026-11-12 13:55:43",false,"---\nname: performing-memory-forensics-with-volatility3-plugins\ndescription: Analyze memory dumps using Volatility3 plugins to detect injected code, rootkits, credential theft, and malware artifacts in Windows, Linux, and macOS memory images.\ndomain: cybersecurity\nsubdomain: malware-analysis\ntags: [memory-forensics, volatility3, malware-analysis, incident-response, process-injection, rootkit-detection, dfir]\nversion: \"1.0\"\nauthor: mahipal\nlicense: Apache-2.0\n---\n# Performing Memory Forensics with Volatility3 Plugins\n\n## Overview\n\nVolatility3 (v2.26.0+, feature parity release May 2025) is the standard framework for memory forensics, replacing the deprecated Volatility2. It analyzes RAM dumps from Windows, Linux, and macOS to detect malicious processes, code injection, rootkits, credential harvesting, and network connections that disk-based forensics cannot reveal. Key plugins include `windows.malfind` (detecting RWX memory regions indicating injection), `windows.psscan` (finding hidden processes), `windows.dlllist` (enumerating loaded modules), `windows.netscan` (active network connections), and `windows.handles` (open file\u002Fregistry handles). The 2024 Plugin Contest introduced ETW Scan for extracting Event Tracing for Windows data from memory.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing memory forensics with volatility3 plugins\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Python 3.9+ with `volatility3` framework installed\n- Memory dump files (`.raw`, `.dmp`, `.vmem`, `.lime`)\n- Windows symbol tables (ISF files, auto-downloaded)\n- Understanding of Windows process memory architecture\n- YARA integration for in-memory pattern scanning\n\n## Workflow\n\n### Step 1: Process Analysis for Malware Detection\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Volatility3-based memory forensics automation for malware analysis.\"\"\"\nimport subprocess\nimport json\nimport sys\nimport os\n\n\nclass Vol3Analyzer:\n    \"\"\"Automate Volatility3 plugin execution for malware analysis.\"\"\"\n\n    def __init__(self, dump_path, vol3_path=\"vol\"):\n        self.dump_path = dump_path\n        self.vol3 = vol3_path\n        self.results = {}\n\n    def run_plugin(self, plugin, extra_args=None):\n        \"\"\"Execute a Volatility3 plugin and capture output.\"\"\"\n        cmd = [\n            self.vol3, \"-f\", self.dump_path,\n            \"-r\", \"json\", plugin,\n        ]\n        if extra_args:\n            cmd.extend(extra_args)\n\n        try:\n            result = subprocess.run(\n                cmd, capture_output=True, text=True, timeout=300\n            )\n            if result.returncode == 0:\n                return json.loads(result.stdout)\n        except (subprocess.TimeoutExpired, json.JSONDecodeError) as e:\n            print(f\"  [!] {plugin} failed: {e}\")\n        return None\n\n    def detect_process_injection(self):\n        \"\"\"Use malfind to detect injected code regions.\"\"\"\n        print(\"[+] Running windows.malfind (code injection detection)\")\n        results = self.run_plugin(\"windows.malfind\")\n\n        injected = []\n        if results:\n            for entry in results:\n                injected.append({\n                    \"pid\": entry.get(\"PID\"),\n                    \"process\": entry.get(\"Process\"),\n                    \"address\": entry.get(\"Start VPN\"),\n                    \"protection\": entry.get(\"Protection\"),\n                    \"hexdump\": entry.get(\"Hexdump\", \"\")[:200],\n                })\n                print(f\"  [!] Injection in PID {entry.get('PID')} \"\n                      f\"({entry.get('Process')}) at {entry.get('Start VPN')}\")\n\n        self.results[\"injected_processes\"] = injected\n        return injected\n\n    def find_hidden_processes(self):\n        \"\"\"Compare pslist vs psscan to find hidden processes.\"\"\"\n        print(\"[+] Running process comparison (pslist vs psscan)\")\n\n        pslist = self.run_plugin(\"windows.pslist\")\n        psscan = self.run_plugin(\"windows.psscan\")\n\n        if not pslist or not psscan:\n            return []\n\n        list_pids = {e.get(\"PID\") for e in pslist}\n        scan_pids = {e.get(\"PID\") for e in psscan}\n\n        hidden = scan_pids - list_pids\n        if hidden:\n            print(f\"  [!] {len(hidden)} hidden processes found!\")\n            for entry in psscan:\n                if entry.get(\"PID\") in hidden:\n                    print(f\"    PID {entry['PID']}: {entry.get('ImageFileName')}\")\n\n        self.results[\"hidden_processes\"] = list(hidden)\n        return list(hidden)\n\n    def analyze_network(self):\n        \"\"\"Extract active network connections.\"\"\"\n        print(\"[+] Running windows.netscan\")\n        results = self.run_plugin(\"windows.netscan\")\n\n        connections = []\n        if results:\n            for entry in results:\n                conn = {\n                    \"pid\": entry.get(\"PID\"),\n                    \"process\": entry.get(\"Owner\"),\n                    \"local\": f\"{entry.get('LocalAddr')}:{entry.get('LocalPort')}\",\n                    \"remote\": f\"{entry.get('ForeignAddr')}:{entry.get('ForeignPort')}\",\n                    \"state\": entry.get(\"State\"),\n                    \"protocol\": entry.get(\"Proto\"),\n                }\n                connections.append(conn)\n\n        self.results[\"network_connections\"] = connections\n        return connections\n\n    def extract_dlls(self, pid=None):\n        \"\"\"List loaded DLLs per process.\"\"\"\n        print(f\"[+] Running windows.dlllist{f' (PID {pid})' if pid else ''}\")\n        args = [\"--pid\", str(pid)] if pid else None\n        results = self.run_plugin(\"windows.dlllist\", args)\n\n        dlls = []\n        if results:\n            for entry in results:\n                dlls.append({\n                    \"pid\": entry.get(\"PID\"),\n                    \"process\": entry.get(\"Process\"),\n                    \"base\": entry.get(\"Base\"),\n                    \"name\": entry.get(\"Name\"),\n                    \"path\": entry.get(\"Path\"),\n                    \"size\": entry.get(\"Size\"),\n                })\n\n        self.results[\"loaded_dlls\"] = dlls\n        return dlls\n\n    def scan_with_yara(self, rules_path):\n        \"\"\"Scan memory with YARA rules.\"\"\"\n        print(f\"[+] Running windows.yarascan with {rules_path}\")\n        results = self.run_plugin(\n            \"windows.yarascan\",\n            [\"--yara-file\", rules_path]\n        )\n\n        matches = []\n        if results:\n            for entry in results:\n                matches.append({\n                    \"rule\": entry.get(\"Rule\"),\n                    \"pid\": entry.get(\"PID\"),\n                    \"process\": entry.get(\"Process\"),\n                    \"offset\": entry.get(\"Offset\"),\n                })\n\n        self.results[\"yara_matches\"] = matches\n        return matches\n\n    def full_triage(self):\n        \"\"\"Run full malware-focused memory triage.\"\"\"\n        print(f\"[*] Full memory triage: {self.dump_path}\")\n        print(\"=\" * 60)\n\n        self.detect_process_injection()\n        self.find_hidden_processes()\n        self.analyze_network()\n\n        return self.results\n\n\nif __name__ == \"__main__\":\n    if len(sys.argv) \u003C 2:\n        print(f\"Usage: {sys.argv[0]} \u003Cmemory_dump>\")\n        sys.exit(1)\n\n    analyzer = Vol3Analyzer(sys.argv[1])\n    results = analyzer.full_triage()\n    print(json.dumps(results, indent=2, default=str))\n```\n\n## Validation Criteria\n\n- Memory dump successfully parsed with correct OS profile\n- Injected processes detected via malfind with RWX regions\n- Hidden processes identified through pslist\u002Fpsscan comparison\n- Network connections reveal C2 communication endpoints\n- YARA rules match known malware signatures in memory\n- Credential artifacts extracted from lsass process memory\n\n## References\n\n- [Volatility Foundation](https:\u002F\u002Fvolatilityfoundation.org\u002F)\n- [Volatility3 GitHub](https:\u002F\u002Fgithub.com\u002Fvolatilityfoundation\u002Fvolatility3)\n- [2024 Volatility Plugin Contest](https:\u002F\u002Fvolatilityfoundation.org\u002Fthe-2024-volatility-plugin-contest-results-are-in\u002F)\n- [Memory Forensics with Volatility 3](https:\u002F\u002Fnewtonpaul.com\u002Fmalware-analysis-memory-forensics-with-volatility-3\u002F)\n- [MITRE ATT&CK T1055 - Process Injection](https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1055\u002F)\n","# Performing Memory Forensics with Volatility3 Plugins\n\n## Overview\n\nVolatility3 (v2.26.0+, feature parity release May 2025) is the standard framework for memory forensics, replacing the deprecated Volatility2. It analyzes RAM dumps from Windows, Linux, and macOS to detect malicious processes, code injection, rootkits, credential harvesting, and network connections that disk-based forensics cannot reveal. Key plugins include `windows.malfind` (detecting RWX memory regions indicating injection), `windows.psscan` (finding hidden processes), `windows.dlllist` (enumerating loaded modules), `windows.netscan` (active network connections), and `windows.handles` (open file\u002Fregistry handles). The 2024 Plugin Contest introduced ETW Scan for extracting Event Tracing for Windows data from memory.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing memory forensics with volatility3 plugins\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Python 3.9+ with `volatility3` framework installed\n- Memory dump files (`.raw`, `.dmp`, `.vmem`, `.lime`)\n- Windows symbol tables (ISF files, auto-downloaded)\n- Understanding of Windows process memory architecture\n- YARA integration for in-memory pattern scanning\n\n## Workflow\n\n### Step 1: Process Analysis for Malware Detection\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Volatility3-based memory forensics automation for malware analysis.\"\"\"\nimport subprocess\nimport json\nimport sys\nimport os\n\n\nclass Vol3Analyzer:\n    \"\"\"Automate Volatility3 plugin execution for malware analysis.\"\"\"\n\n    def __init__(self, dump_path, vol3_path=\"vol\"):\n        self.dump_path = dump_path\n        self.vol3 = vol3_path\n        self.results = {}\n\n    def run_plugin(self, plugin, extra_args=None):\n        \"\"\"Execute a Volatility3 plugin and capture output.\"\"\"\n        cmd = [\n            self.vol3, \"-f\", self.dump_path,\n            \"-r\", \"json\", plugin,\n        ]\n        if extra_args:\n            cmd.extend(extra_args)\n\n        try:\n            result = subprocess.run(\n                cmd, capture_output=True, text=True, timeout=300\n            )\n            if result.returncode == 0:\n                return json.loads(result.stdout)\n        except (subprocess.TimeoutExpired, json.JSONDecodeError) as e:\n            print(f\"  [!] {plugin} failed: {e}\")\n        return None\n\n    def detect_process_injection(self):\n        \"\"\"Use malfind to detect injected code regions.\"\"\"\n        print(\"[+] Running windows.malfind (code injection detection)\")\n        results = self.run_plugin(\"windows.malfind\")\n\n        injected = []\n        if results:\n            for entry in results:\n                injected.append({\n                    \"pid\": entry.get(\"PID\"),\n                    \"process\": entry.get(\"Process\"),\n                    \"address\": entry.get(\"Start VPN\"),\n                    \"protection\": entry.get(\"Protection\"),\n                    \"hexdump\": entry.get(\"Hexdump\", \"\")[:200],\n                })\n                print(f\"  [!] Injection in PID {entry.get('PID')} \"\n                      f\"({entry.get('Process')}) at {entry.get('Start VPN')}\")\n\n        self.results[\"injected_processes\"] = injected\n        return injected\n\n    def find_hidden_processes(self):\n        \"\"\"Compare pslist vs psscan to find hidden processes.\"\"\"\n        print(\"[+] Running process comparison (pslist vs psscan)\")\n\n        pslist = self.run_plugin(\"windows.pslist\")\n        psscan = self.run_plugin(\"windows.psscan\")\n\n        if not pslist or not psscan:\n            return []\n\n        list_pids = {e.get(\"PID\") for e in pslist}\n        scan_pids = {e.get(\"PID\") for e in psscan}\n\n        hidden = scan_pids - list_pids\n        if hidden:\n            print(f\"  [!] {len(hidden)} hidden processes found!\")\n            for entry in psscan:\n                if entry.get(\"PID\") in hidden:\n                    print(f\"    PID {entry['PID']}: {entry.get('ImageFileName')}\")\n\n        self.results[\"hidden_processes\"] = list(hidden)\n        return list(hidden)\n\n    def analyze_network(self):\n        \"\"\"Extract active network connections.\"\"\"\n        print(\"[+] Running windows.netscan\")\n        results = self.run_plugin(\"windows.netscan\")\n\n        connections = []\n        if results:\n            for entry in results:\n                conn = {\n                    \"pid\": entry.get(\"PID\"),\n                    \"process\": entry.get(\"Owner\"),\n                    \"local\": f\"{entry.get('LocalAddr')}:{entry.get('LocalPort')}\",\n                    \"remote\": f\"{entry.get('ForeignAddr')}:{entry.get('ForeignPort')}\",\n                    \"state\": entry.get(\"State\"),\n                    \"protocol\": entry.get(\"Proto\"),\n                }\n                connections.append(conn)\n\n        self.results[\"network_connections\"] = connections\n        return connections\n\n    def extract_dlls(self, pid=None):\n        \"\"\"List loaded DLLs per process.\"\"\"\n        print(f\"[+] Running windows.dlllist{f' (PID {pid})' if pid else ''}\")\n        args = [\"--pid\", str(pid)] if pid else None\n        results = self.run_plugin(\"windows.dlllist\", args)\n\n        dlls = []\n        if results:\n            for entry in results:\n                dlls.append({\n                    \"pid\": entry.get(\"PID\"),\n                    \"process\": entry.get(\"Process\"),\n                    \"base\": entry.get(\"Base\"),\n                    \"name\": entry.get(\"Name\"),\n                    \"path\": entry.get(\"Path\"),\n                    \"size\": entry.get(\"Size\"),\n                })\n\n        self.results[\"loaded_dlls\"] = dlls\n        return dlls\n\n    def scan_with_yara(self, rules_path):\n        \"\"\"Scan memory with YARA rules.\"\"\"\n        print(f\"[+] Running windows.yarascan with {rules_path}\")\n        results = self.run_plugin(\n            \"windows.yarascan\",\n            [\"--yara-file\", rules_path]\n        )\n\n        matches = []\n        if results:\n            for entry in results:\n                matches.append({\n                    \"rule\": entry.get(\"Rule\"),\n                    \"pid\": entry.get(\"PID\"),\n                    \"process\": entry.get(\"Process\"),\n                    \"offset\": entry.get(\"Offset\"),\n                })\n\n        self.results[\"yara_matches\"] = matches\n        return matches\n\n    def full_triage(self):\n        \"\"\"Run full malware-focused memory triage.\"\"\"\n        print(f\"[*] Full memory triage: {self.dump_path}\")\n        print(\"=\" * 60)\n\n        self.detect_process_injection()\n        self.find_hidden_processes()\n        self.analyze_network()\n\n        return self.results\n\n\nif __name__ == \"__main__\":\n    if len(sys.argv) \u003C 2:\n        print(f\"Usage: {sys.argv[0]} \u003Cmemory_dump>\")\n        sys.exit(1)\n\n    analyzer = Vol3Analyzer(sys.argv[1])\n    results = analyzer.full_triage()\n    print(json.dumps(results, indent=2, default=str))\n```\n\n## Validation Criteria\n\n- Memory dump successfully parsed with correct OS profile\n- Injected processes detected via malfind with RWX regions\n- Hidden processes identified through pslist\u002Fpsscan comparison\n- Network connections reveal C2 communication endpoints\n- YARA rules match known malware signatures in memory\n- Credential artifacts extracted from lsass process memory\n\n## References\n\n- [Volatility Foundation](https:\u002F\u002Fvolatilityfoundation.org\u002F)\n- [Volatility3 GitHub](https:\u002F\u002Fgithub.com\u002Fvolatilityfoundation\u002Fvolatility3)\n- [2024 Volatility Plugin Contest](https:\u002F\u002Fvolatilityfoundation.org\u002Fthe-2024-volatility-plugin-contest-results-are-in\u002F)\n- [Memory Forensics with Volatility 3](https:\u002F\u002Fnewtonpaul.com\u002Fmalware-analysis-memory-forensics-with-volatility-3\u002F)\n- [MITRE ATT&CK T1055 - Process Injection](https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1055\u002F)\n",{"name":5,"tags":25,"author":33,"domain":34,"license":15,"version":35,"subdomain":28,"description":7},[26,27,28,29,30,31,32],"memory-forensics","volatility3","malware-analysis","incident-response","process-injection","rootkit-detection","dfir","mahipal","cybersecurity","1.0","main","c2b1fdccc779e99ac814e55fb69ca8d71215dd0f","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection","https:\u002F\u002Fgithub.com\u002FSamuelChien","http:\u002F\u002Fsamuelchien.com\u002F","2026-05-26 08:27:14",{"source":8,"skillName":5,"commands":43,"prompt":53,"zipAvailable":54},[44,47,50],{"tool":45,"command":46},"npx","npx skills add SamuelChien\u002Fmega-skills-collection --skill performing-memory-forensics-with-volatility3-plugins",{"tool":48,"command":49},"bunx","bunx skills add SamuelChien\u002Fmega-skills-collection --skill performing-memory-forensics-with-volatility3-plugins",{"tool":51,"command":52},"pnpm","pnpm dlx skills add SamuelChien\u002Fmega-skills-collection --skill performing-memory-forensics-with-volatility3-plugins","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fperforming-memory-forensics-with-volatility3-plugins\u002FSKILL.md",true,[56,62,66,72,76,80,86],{"path":57,"resourceType":58,"resourceTypeDesc":59,"sizeBytes":60,"sourceHtmlUrl":61},"assets\u002Ftemplate.md","ASSET","资产文件",651,"https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fperforming-memory-forensics-with-volatility3-plugins\u002Fassets\u002Ftemplate.md",{"path":63,"resourceType":63,"resourceTypeDesc":64,"sizeBytes":65,"sourceHtmlUrl":16},"LICENSE","许可证",11255,{"path":67,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":70,"sourceHtmlUrl":71},"references\u002Fapi-reference.md","REFERENCE","参考文档",1852,"https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fperforming-memory-forensics-with-volatility3-plugins\u002Freferences\u002Fapi-reference.md",{"path":73,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":74,"sourceHtmlUrl":75},"references\u002Fstandards.md",1128,"https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fperforming-memory-forensics-with-volatility3-plugins\u002Freferences\u002Fstandards.md",{"path":77,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":78,"sourceHtmlUrl":79},"references\u002Fworkflows.md",722,"https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fperforming-memory-forensics-with-volatility3-plugins\u002Freferences\u002Fworkflows.md",{"path":81,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":84,"sourceHtmlUrl":85},"scripts\u002Fagent.py","SCRIPT","脚本",7377,"https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fperforming-memory-forensics-with-volatility3-plugins\u002Fscripts\u002Fagent.py",{"path":87,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":88,"sourceHtmlUrl":89},"scripts\u002Fprocess.py",1877,"https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fperforming-memory-forensics-with-volatility3-plugins\u002Fscripts\u002Fprocess.py",[91,99,106,113,120,127],{"skillNo":92,"name":93,"nameZh":6,"description":94,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":95,"licenseFileUrl":6,"sourceHtmlUrl":96,"categories":97,"keywords":98,"publishedAt":20},"01M76R4WZQZAXGGXMQCA0FZ716","zustand-store-ts","Create Zustand stores with TypeScript, subscribeWithSelector middleware, and proper state\u002Faction separation. Use when building React state management, creating global stores, or implementing reactive state patterns with Zustand.","MIT","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fzustand-store-ts\u002FSKILL.md",[],[],{"skillNo":100,"name":101,"nameZh":6,"description":102,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":95,"licenseFileUrl":6,"sourceHtmlUrl":103,"categories":104,"keywords":105,"publishedAt":20},"01M76R4T9KENDH7FENGZQHBW4G","zustand-store-creator","Zustand Store Creator - Auto-activating skill for Frontend Development.\nTriggers on: zustand store creator, zustand store creator\nPart of the Frontend Development skill category.","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fzustand-store-creator\u002FSKILL.md",[],[],{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":95,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":112,"publishedAt":20},"01M76R3YWN84B7SANJ52X799ZE","zero-trust-config-helper","Zero Trust Config Helper - Auto-activating skill for Security Advanced.\nTriggers on: zero trust config helper, zero trust config helper\nPart of the Security Advanced skill category.","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fzero-trust-config-helper\u002FSKILL.md",[],[],{"skillNo":114,"name":115,"nameZh":6,"description":116,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":95,"licenseFileUrl":6,"sourceHtmlUrl":117,"categories":118,"keywords":119,"publishedAt":20},"01M76R3HNSV2AEYSKHM915GJ58","zapier-integration-helper","Zapier Integration Helper - Auto-activating skill for Business Automation.\nTriggers on: zapier integration helper, zapier integration helper\nPart of the Business Automation skill category.","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fzapier-integration-helper\u002FSKILL.md",[],[],{"skillNo":121,"name":122,"nameZh":6,"description":123,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":124,"categories":125,"keywords":126,"publishedAt":20},"01M76R3DJSKAT4FA7DV4BF3GCE","zai-cli","Execute z.AI CLI providing vision, search, reader, and GitHub exploration via CLI and MCP.\nUse when user needs image\u002Fvideo analysis, OCR, UI-to-code conversion, error diagnosis,\nreal-time web search, web page to markdown extraction, or GitHub code exploration.\nTrigger with phrases like \"analyze this image\", \"search the web for\", \"read this page\",\n\"explore this repo\", or \"use zai\". Requires Z_AI_API_KEY.","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fzai-cli\u002FSKILL.md",[],[],{"skillNo":128,"name":129,"nameZh":6,"description":130,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":95,"licenseFileUrl":6,"sourceHtmlUrl":131,"categories":132,"keywords":133,"publishedAt":20},"01M76R2KAM699XE9AJVAWE4H2E","yt-research","Research competitor YouTube channels, niches, and trending topics for your content strategy.\nUse this skill whenever the user says \"research channels\", \"analyze competitors\", \"find trending topics\",\n\"niche analysis\", \"competitive research\", \"what are other creators doing\", \"scrape YouTube channels\",\nor wants to understand the competitive landscape for a specific tool or topic area. Use when working with yt research. Trigger with 'yt', 'research'.","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fyt-research\u002FSKILL.md",[],[]]