[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skills:stats":3,"skills:pro6":8,"skills:sce6":55,"skills:creators9":100,"skills:all:stars:109:":195},{"skillCount":4,"professionCount":5,"scenarioCount":6,"creatorCount":7},196852,11,7,1926,[9,20,27,34,41,48],{"categoryNo":10,"taxonomyType":11,"taxonomyTypeDesc":12,"categoryName":13,"categoryNameEn":14,"description":15,"level":16,"skillCount":17,"parentNo":18,"parentName":18,"children":19},"01JBSEEDCAT000000000000030","PROFESSION","适用职业","开发工程师","Software Engineer","从事软件编码、测试与运维的工程师",1,13274,null,[],{"categoryNo":21,"taxonomyType":11,"taxonomyTypeDesc":12,"categoryName":22,"categoryNameEn":23,"description":24,"level":16,"skillCount":25,"parentNo":18,"parentName":18,"children":26},"01JBSEEDCAT000000000000032","设计师","Designer","视觉、交互与品牌设计人员",7775,[],{"categoryNo":28,"taxonomyType":11,"taxonomyTypeDesc":12,"categoryName":29,"categoryNameEn":30,"description":31,"level":16,"skillCount":32,"parentNo":18,"parentName":18,"children":33},"01JBSEEDCAT000000000000033","数据分析师","Data Analyst","数据分析、报表与商业智能人员",4988,[],{"categoryNo":35,"taxonomyType":11,"taxonomyTypeDesc":12,"categoryName":36,"categoryNameEn":37,"description":38,"level":16,"skillCount":39,"parentNo":18,"parentName":18,"children":40},"01JBSEEDCAT000000000000036","内容创作者","Content Creator","作者、编辑与自媒体创作者",3940,[],{"categoryNo":42,"taxonomyType":11,"taxonomyTypeDesc":12,"categoryName":43,"categoryNameEn":44,"description":45,"level":16,"skillCount":46,"parentNo":18,"parentName":18,"children":47},"01JBSEEDCAT000000000000035","市场营销","Marketer","市场推广、增长与品牌运营人员",3446,[],{"categoryNo":49,"taxonomyType":11,"taxonomyTypeDesc":12,"categoryName":50,"categoryNameEn":51,"description":52,"level":16,"skillCount":53,"parentNo":18,"parentName":18,"children":54},"01JBSEEDCAT000000000000037","律师与法务","Legal","合同、合规与法律事务人员",3316,[],[56,65,72,79,86,93],{"categoryNo":57,"taxonomyType":58,"taxonomyTypeDesc":59,"categoryName":60,"categoryNameEn":61,"description":62,"level":16,"skillCount":63,"parentNo":18,"parentName":18,"children":64},"01JBSEEDCAT000000000000022","SCENARIO","使用场景","智能体与自动化","Agents & Automation","Skill、MCP、智能体与工作流自动化",39458,[],{"categoryNo":66,"taxonomyType":58,"taxonomyTypeDesc":59,"categoryName":67,"categoryNameEn":68,"description":69,"level":16,"skillCount":70,"parentNo":18,"parentName":18,"children":71},"01JBSEEDCAT000000000000006","软件开发","Software Development","编码、测试、部署等软件研发任务",26531,[],{"categoryNo":73,"taxonomyType":58,"taxonomyTypeDesc":59,"categoryName":74,"categoryNameEn":75,"description":76,"level":16,"skillCount":77,"parentNo":18,"parentName":18,"children":78},"01JBSEEDCAT000000000000014","设计创意","Design & Creative","视觉设计、品牌与多媒体创作",13569,[],{"categoryNo":80,"taxonomyType":58,"taxonomyTypeDesc":59,"categoryName":81,"categoryNameEn":82,"description":83,"level":16,"skillCount":84,"parentNo":18,"parentName":18,"children":85},"01JBSEEDCAT000000000000001","办公效率","Office Productivity","日常办公文档、表格、演示与沟通类任务",6289,[],{"categoryNo":87,"taxonomyType":58,"taxonomyTypeDesc":59,"categoryName":88,"categoryNameEn":89,"description":90,"level":16,"skillCount":91,"parentNo":18,"parentName":18,"children":92},"01JBSEEDCAT000000000000017","内容创作","Content Creation","写作、文案与营销内容生产",6029,[],{"categoryNo":94,"taxonomyType":58,"taxonomyTypeDesc":59,"categoryName":95,"categoryNameEn":96,"description":97,"level":16,"skillCount":98,"parentNo":18,"parentName":18,"children":99},"01JBSEEDCAT000000000000020","研究与学习","Research & Learning","资料检索、知识整理与学习辅导",5531,[],{"records":101,"total":7,"current":16,"size":194},[102,114,123,133,143,153,163,172,182],{"accountNo":103,"login":104,"displayName":105,"avatarUrl":106,"accountType":107,"accountTypeDesc":108,"profileDescription":109,"skillCount":110,"repoCount":111,"professionCount":5,"scenarioCount":6,"totalStars":112,"updatedAt":113},"01M698VYDXZ6JW5WH3CRV650R8","microsoft","Microsoft","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F6154722?v=4","ORGANIZATION","组织","Open source projects and samples from Microsoft",4160,229,828772,"2026-11-13 04:10:52",{"accountNo":115,"login":116,"displayName":116,"avatarUrl":117,"accountType":107,"accountTypeDesc":108,"profileDescription":118,"skillCount":119,"repoCount":120,"professionCount":6,"scenarioCount":6,"totalStars":121,"updatedAt":122},"01M698P3FSAZ6B4R928ZF19KPT","openclaw","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F252820863?v=4","Your personal, open source AI assistant.",362,32,437711,"2026-11-13 03:02:05",{"accountNo":124,"login":125,"displayName":126,"avatarUrl":127,"accountType":107,"accountTypeDesc":108,"profileDescription":18,"skillCount":128,"repoCount":129,"professionCount":6,"scenarioCount":130,"totalStars":131,"updatedAt":132},"01M6AC29YGCR4S2NTJFV0G8B81","openai","OpenAI","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F14957082?v=4",171,23,6,342695,"2026-11-13 04:03:41",{"accountNo":134,"login":135,"displayName":136,"avatarUrl":137,"accountType":107,"accountTypeDesc":108,"profileDescription":18,"skillCount":138,"repoCount":139,"professionCount":140,"scenarioCount":6,"totalStars":141,"updatedAt":142},"01M6AC83E6K4FDKK7HZ8WNMQKE","apache","The Apache Software Foundation","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F47359?v=4",420,75,8,298176,"2026-11-13 03:14:28",{"accountNo":144,"login":145,"displayName":146,"avatarUrl":147,"accountType":107,"accountTypeDesc":108,"profileDescription":148,"skillCount":149,"repoCount":150,"professionCount":5,"scenarioCount":6,"totalStars":151,"updatedAt":152},"01M698VYEFDM0VJBZDYYJ2T83S","google","Google","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1342004?v=4","Google ❤️ Open Source",535,48,242366,"2026-11-13 04:17:09",{"accountNo":154,"login":155,"displayName":156,"avatarUrl":157,"accountType":107,"accountTypeDesc":108,"profileDescription":158,"skillCount":159,"repoCount":160,"professionCount":5,"scenarioCount":6,"totalStars":161,"updatedAt":162},"01M6AC83DS133TPXFSP1DHNCC6","github","GitHub","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F9919?v=4","How people build software.",940,28,238441,"2026-11-13 03:57:35",{"accountNo":164,"login":165,"displayName":166,"avatarUrl":167,"accountType":107,"accountTypeDesc":108,"profileDescription":18,"skillCount":168,"repoCount":169,"professionCount":5,"scenarioCount":6,"totalStars":170,"updatedAt":171},"01M697XGDPXJAVQ8391V2BCYTE","anthropics","Anthropic","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F76263028?v=4",674,17,231826,"2026-11-13 04:18:26",{"accountNo":173,"login":174,"displayName":175,"avatarUrl":176,"accountType":107,"accountTypeDesc":108,"profileDescription":18,"skillCount":177,"repoCount":178,"professionCount":179,"scenarioCount":6,"totalStars":180,"updatedAt":181},"01M6AC83EPDGBFN19MWYRREJD0","Significant-Gravitas","AutoGPT","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F130738209?v=4",86,2,10,188014,"2026-11-13 02:38:59",{"accountNo":183,"login":184,"displayName":185,"avatarUrl":186,"accountType":187,"accountTypeDesc":188,"profileDescription":189,"skillCount":190,"repoCount":191,"professionCount":130,"scenarioCount":6,"totalStars":192,"updatedAt":193},"01M6DJCCDDG53MTYYRTXAXFG17","garrytan","Garry Tan","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F19957?v=4","USER","个人作者","Writes software, dreams. ",324,3,174614,"2026-11-13 04:05:07",9,{"records":196,"total":4,"current":582,"size":583},[197,234,248,280,307,333,355,368,389,413,431,449,469,491,511,531,549,562],{"skillNo":198,"name":199,"nameZh":18,"description":200,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":209,"categories":210,"keywords":214,"publishedAt":233},"01M6AESNFVSJ732HQTKE6XTWDN","hardening-docker-daemon-configuration","Hardens the Docker daemon (dockerd) through \u002Fetc\u002Fdocker\u002Fdaemon.json with user namespace remapping, TLS client authentication, seccomp profiles, and CIS Docker Benchmark controls such as icc, no-new-privileges, and live-restore. Use when securing a Docker host's daemon to prevent privilege escalation, breakout, or lateral movement, or when auditing daemon settings against CIS requirements. Keywords: dockerd, daemon.json, userns-remap, no-new-privileges, icc, live-restore, TLS socket. Do not use for hardening images and per-container runtime flags - use hardening-docker-containers-for-production.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhardening-docker-daemon-configuration\u002FSKILL.md",[211],{"categoryNo":212,"categoryName":213,"taxonomyType":58,"taxonomyTypeDesc":59},"01JBSEEDCAT000000000000011","运维与部署",[215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232],"docker","hardening","hardening docker daemon configuration","containers","security","cybersecurity","pr","benchmark","authentication","container-security","cis-benchmark","Production","escalation","tls","breakout","daemon-hardening","rootless","userns-remap","2026-11-10 10:12:30",{"skillNo":235,"name":236,"nameZh":18,"description":237,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":238,"categories":239,"keywords":244,"publishedAt":233},"01M6AESHY9MV7GYFSJNHB8Z86B","hardening-docker-containers-for-production","Hardens Dockerfiles, images, and per-container runtime settings against the CIS Docker Benchmark v1.8.0: non-root users, dropped capabilities, read-only root filesystem, seccomp and AppArmor profiles, and minimal multi-stage builds, validated with docker-bench-security, Hadolint, and Dockle. Use when preparing a container or Dockerfile for production, or auditing images and runtime flags against CIS Docker controls. Keywords: Dockerfile, USER, --cap-drop, read-only rootfs, seccomp, AppArmor, multi-stage, Hadolint, Dockle. Do not use for the Docker daemon's own configuration - use hardening-docker-daemon-configuration.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhardening-docker-containers-for-production\u002FSKILL.md",[240,241],{"categoryNo":212,"categoryName":213,"taxonomyType":58,"taxonomyTypeDesc":59},{"categoryNo":242,"categoryName":243,"taxonomyType":58,"taxonomyTypeDesc":59},"01JBSEEDCAT000000000000023","Skill与智能体开发",[218,215,216,226,245,219,220,246,221,222,247,224,225],"hardening docker containers for production","dockerfile","capabilities",{"skillNo":249,"name":250,"nameZh":18,"description":251,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":252,"categories":253,"keywords":262,"publishedAt":233},"01M6AESEEKCFK7SGTG2NDTC02T","generating-threat-intelligence-reports","Generates structured cyber threat intelligence reports at strategic, operational, and tactical levels tailored to specific audiences including executives, security operations teams, and technical analysts. Use when producing finished intelligence products from raw collection data, creating sector threat briefings, or delivering post-incident intelligence assessments. Activates for requests involving CTI report writing, threat briefings, intelligence products, finished intelligence, or executive security reporting.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fgenerating-threat-intelligence-reports\u002FSKILL.md",[254,257,258,261],{"categoryNo":255,"categoryName":256,"taxonomyType":58,"taxonomyTypeDesc":59},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":242,"categoryName":243,"taxonomyType":58,"taxonomyTypeDesc":59},{"categoryNo":259,"categoryName":260,"taxonomyType":11,"taxonomyTypeDesc":12},"01JBSEEDCAT000000000000034","行政与办公人员",{"categoryNo":35,"categoryName":36,"taxonomyType":11,"taxonomyTypeDesc":12},[263,264,265,219,220,266,267,268,269,270,271,272,273,274,275,276,277,278,279],"threat intelligence","generating threat intelligence reports","writing","security operations","teams","report","reporting","threat-intelligence","cti","NIST-CSF","data","NIST","post-incident","intelligence-products","TLP","PIR","report-writing",{"skillNo":281,"name":282,"nameZh":18,"description":283,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":284,"categories":285,"keywords":287,"publishedAt":233},"01M6AESBB6VEKMFQAAB5J3Z4YY","generating-forensic-timelines-with-hayabusa","Run Hayabusa against collected Windows EVTX files to apply Sigma detection rules and produce a prioritized, chronological CSV\u002FJSON timeline with severity levels, MITRE ATT&CK mappings, and per-host\u002Fper-Event-ID metrics. Use during DFIR triage to turn raw event logs into a fast, SIEM-free incident timeline, or to export results into Timesketch or Timeline Explorer for collaborative analysis.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fgenerating-forensic-timelines-with-hayabusa\u002FSKILL.md",[286],{"categoryNo":242,"categoryName":243,"taxonomyType":58,"taxonomyTypeDesc":59},[288,289,220,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306],"hayabusa","generating forensic timelines with hayabusa","siem","windows","run","metrics","produce","logs","csv","threat-hunting","dfir","T1059.001","event-logs","digital-forensics","sigma","severity","ATT&CK","windows-event-logs","t1059",{"skillNo":308,"name":309,"nameZh":18,"description":310,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":311,"categories":312,"keywords":315,"publishedAt":233},"01M6AES89CC519FP3H3WMYC728","generating-and-analyzing-sboms","Generate CycloneDX and SPDX SBOMs from container images and filesystems with Syft, correlate them to CVEs with Grype, and sign\u002Fattest them with Cosign. Use when you need a machine-readable dependency inventory for supply-chain risk, want to scan images or SBOMs for known vulnerabilities, or are embedding SBOM generation and vulnerability gating into CI\u002FCD.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fgenerating-and-analyzing-sboms\u002FSKILL.md",[313,314],{"categoryNo":212,"categoryName":213,"taxonomyType":58,"taxonomyTypeDesc":59},{"categoryNo":242,"categoryName":243,"taxonomyType":58,"taxonomyTypeDesc":59},[316,317,318,219,220,319,320,321,322,323,324,325,326,327,328,329,330,331,332],"analyzing","generating and analyzing sboms","devsecops","vulnerabilities","container images","generate","dependency inventory","ci","SBOM","CycloneDX","SPDX","supply-chain","syft","grype","vulnerability-management","supply-chain-security","risk",{"skillNo":334,"name":335,"nameZh":18,"description":336,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":337,"categories":338,"keywords":341,"publishedAt":233},"01M6AES43T4HEP7358DGPPMTRZ","fleet-hunting-with-velociraptor","Deploy a Velociraptor server and agents, then author VQL (Velociraptor Query Language) artifacts and run them as fleet-wide hunts, on-demand forensic collections, or standalone offline collectors. Use when hunting a TTP across hundreds or thousands of endpoints, collecting forensic artifacts during incident response without re-imaging, or generating collectors for unmanaged\u002Fair-gapped hosts.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ffleet-hunting-with-velociraptor\u002FSKILL.md",[339,340],{"categoryNo":212,"categoryName":213,"taxonomyType":58,"taxonomyTypeDesc":59},{"categoryNo":242,"categoryName":243,"taxonomyType":58,"taxonomyTypeDesc":59},[342,220,343,344,292,345,346,347,348,297,298,349,301,350,306,351,352,353,354],"fleet hunting with velociraptor","incident response","deploy","artifacts","offline","server","forensics","incident-response","endpoint","velociraptor","vql","endpoint-visibility","fleet-collection",{"skillNo":356,"name":357,"nameZh":18,"description":358,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":359,"categories":360,"keywords":362,"publishedAt":233},"01M6AES0E39RA258WTHE7SQBB6","extracting-windows-event-logs-artifacts","Extract, parse, and analyze Windows Event Logs (EVTX) using Chainsaw, Hayabusa, and EvtxECmd to detect lateral movement, persistence, and privilege escalation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fextracting-windows-event-logs-artifacts\u002FSKILL.md",[361],{"categoryNo":242,"categoryName":243,"taxonomyType":58,"taxonomyTypeDesc":59},[291,345,295,363,220,364,348,349,300,301,302,227,365,305,366,367,288],"extracting windows event logs artifacts","persistence","sigma-rules","evtx","chainsaw",{"skillNo":369,"name":370,"nameZh":18,"description":371,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":372,"categories":373,"keywords":375,"publishedAt":233},"01M6AERX0HBSMDPJHVJ0Y2Q0GM","extracting-memory-artifacts-with-rekall","Uses Rekall memory forensics framework to analyze memory dumps for process hollowing, injected code via VAD anomalies, hidden processes, and rootkit detection. Applies plugins like pslist, psscan, vadinfo, malfind, and dlllist to extract forensic artifacts from Windows memory images. Use during incident response memory analysis.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fextracting-memory-artifacts-with-rekall\u002FSKILL.md",[374],{"categoryNo":10,"categoryName":13,"taxonomyType":11,"taxonomyTypeDesc":12},[376,345,377,220,343,291,378,379,348,380,381,382,349,383,384,306,385,386,387,388],"memory","extracting memory artifacts with rekall","code","plugins","security-operations","rootkit","memory-forensics","detection","t1078","injection","rekall","code-injection","vad-analysis",{"skillNo":390,"name":391,"nameZh":18,"description":392,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":393,"categories":394,"keywords":396,"publishedAt":233},"01M6AERSNAP9TGEE9C757BNVC4","extracting-iocs-from-malware-samples","Extracts indicators of compromise (IOCs) from malware samples, including file hashes, network indicators (IPs, domains, URLs, PCAP indicators), host artifacts (file paths, registry keys, mutexes), and behavioral patterns, using tools like CyberChef, then defangs and exports them in standard threat-intel formats. Use for IOC extraction, threat indicator harvesting, or building detection content from a sample.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fextracting-iocs-from-malware-samples\u002FSKILL.md",[395],{"categoryNo":242,"categoryName":243,"taxonomyType":58,"taxonomyTypeDesc":59},[397,398,220,399,345,400,401,402,270,403,404,405,406,407,408,383,409,410,411,412],"malware","extracting iocs from malware samples","registry","content","extraction","file","ioc","malware-analysis","network","pcap","indicator","ips","t1055","Tools","IOC-extraction","indicators",{"skillNo":414,"name":415,"nameZh":18,"description":416,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":417,"categories":418,"keywords":420,"publishedAt":233},"01M6AERNVJH7SGPSZG8KYXYT67","extracting-credentials-from-memory-dump","Extracts cached credentials, password hashes, Kerberos tickets, and authentication tokens from Windows memory dumps using Volatility 3, Mimikatz, and pypykatz. Use when performing memory forensics or incident response on an LSASS or full memory dump and you need to recover credentials or Kerberos material for investigation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fextracting-credentials-from-memory-dump\u002FSKILL.md",[419],{"categoryNo":242,"categoryName":243,"taxonomyType":58,"taxonomyTypeDesc":59},[376,421,220,343,422,291,223,401,423,348,382,349,424,301,425,426,427,428,429,430],"extracting credentials from memory dump","web","mimikatz","Volatility","reconnaissance","kerberos","lsass","t1003","credential-extraction","password-hashes",{"skillNo":432,"name":433,"nameZh":18,"description":434,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":435,"categories":436,"keywords":438,"publishedAt":233},"01M6AERHVY2APJW8V9SMBSXR92","extracting-config-from-agent-tesla-rat","Extracts embedded configuration from Agent Tesla RAT samples, including SMTP\u002FFTP\u002FTelegram exfiltration credentials, keylogger settings, and C2 endpoints, via .NET decompilation and memory analysis. Use when analyzing a suspected or confirmed Agent Tesla sample and you need to recover its exfiltration channel and C2 configuration for threat intelligence or incident response.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fextracting-config-from-agent-tesla-rat\u002FSKILL.md",[437],{"categoryNo":242,"categoryName":243,"taxonomyType":58,"taxonomyTypeDesc":59},[439,440,376,220,343,263,441,401,397,442,404,443,444,316,445,428,409,446,447,448],"config","extracting config from agent tesla rat","dotnet","c2","config-extraction","exfiltration","credential-theft","agent-tesla","rat","keylogger",{"skillNo":450,"name":451,"nameZh":18,"description":452,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":453,"categories":454,"keywords":456,"publishedAt":233},"01M6AEREMMA9TBWBT223RCHQZ2","extracting-browser-history-artifacts","Extracts and analyzes browser history, cookies, cache, downloads, and bookmarks from Chrome, Firefox, and Edge using sqlite3, DB Browser for SQLite, Hindsight, and NirSoft tools (BrowsingHistoryView, ChromeCacheView, MZCacheView). Use when performing digital forensics or incident response on a disk image or live system and you need timeline evidence of a user's web activity.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fextracting-browser-history-artifacts\u002FSKILL.md",[455],{"categoryNo":242,"categoryName":243,"taxonomyType":58,"taxonomyTypeDesc":59},[345,457,458,459,220,343,460,461,422,462,463,348,464,465,466,301,410,306,467,468],"browser","extracting browser history artifacts","image","chrome","firefox","cache","edge","hindsight","cookies","downloads","web-history","artifact-extraction",{"skillNo":470,"name":471,"nameZh":18,"description":472,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":473,"categories":474,"keywords":475,"publishedAt":233},"01M6AERAKMP0E82K74W8PYZBG5","exploiting-zerologon-vulnerability-cve-2020-1472","Exploits the Zerologon vulnerability (CVE-2020-1472) in the Netlogon Remote Protocol using Impacket to reset a domain controller's machine account password to empty, then runs DCSync via secretsdump.py to dump domain credentials. Use when red-teaming or validating unpatched Active Directory domain controllers for Zerologon, including restoring the machine account password afterward.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-zerologon-vulnerability-cve-2020-1472\u002FSKILL.md",[],[476,477,478,220,378,479,480,481,482,227,483,484,485,384,306,486,487,488,489,490],"cve","exploiting zerologon vulnerability cve 2020 1472","directory","verification","monitoring","active-directory","privilege-escalation","dcsync","controller","Impacket","zerologon","cve-2020-1472","netlogon","domain-controller","ms-nrpc",{"skillNo":492,"name":493,"nameZh":18,"description":494,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":495,"categories":496,"keywords":501,"publishedAt":233},"01M6AER75R8DSRMZAD77GA23RB","exploiting-websocket-vulnerabilities","Testing WebSocket implementations for authentication bypass, cross-site hijacking, injection attacks, and insecure message handling during authorized security assessments.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-websocket-vulnerabilities\u002FSKILL.md",[497,500],{"categoryNo":498,"categoryName":499,"taxonomyType":58,"taxonomyTypeDesc":59},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":242,"categoryName":243,"taxonomyType":58,"taxonomyTypeDesc":59},[319,502,503,219,220,422,221,223,504,505,409,506,306,385,507,508,509,510],"exploiting websocket vulnerabilities","testing","penetration-testing","owasp","web-application-security","web-security","burpsuite","websocket","real-time",{"skillNo":512,"name":513,"nameZh":18,"description":514,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":515,"categories":516,"keywords":519,"publishedAt":233},"01M6AER3EQ9B7C923V0NFC6Y8J","exploiting-vulnerabilities-with-metasploit-framework","Uses the Metasploit Framework (msfconsole and its exploit, auxiliary, and post-exploitation modules) to validate that identified CVEs and vulnerabilities are actually exploitable, gather post-exploitation evidence, and confirm patch remediation. Use when performing vulnerability management validation, penetration testing, or post-patch verification and you need to prove real-world exploitability rather than rely on a scanner score alone.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-vulnerabilities-with-metasploit-framework\u002FSKILL.md",[517,518],{"categoryNo":498,"categoryName":499,"taxonomyType":58,"taxonomyTypeDesc":59},{"categoryNo":242,"categoryName":243,"taxonomyType":58,"taxonomyTypeDesc":59},[319,520,521,522,503,220,523,524,525,479,476,526,527,528,504,330,529,530,332],"framework","Metasploit","exploiting vulnerabilities with metasploit framework","validate","patch verification","validation","vulnerability management","post-exploitation","penetration testing","remediation","exploitation",{"skillNo":532,"name":533,"nameZh":18,"description":534,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":535,"categories":536,"keywords":539,"publishedAt":233},"01M6AEQZXRFC5HVASBK9605SBF","exploiting-type-juggling-vulnerabilities","Exploits PHP type juggling vulnerabilities caused by loose (==) comparison operators to bypass authentication, defeat hash verification via magic hashes, and manipulate application logic through type coercion. Use when pentesting PHP applications that compare user input with ==, in_array, or hash functions without strict type checks.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-type-juggling-vulnerabilities\u002FSKILL.md",[537,538],{"categoryNo":498,"categoryName":499,"taxonomyType":58,"taxonomyTypeDesc":59},{"categoryNo":242,"categoryName":243,"taxonomyType":58,"taxonomyTypeDesc":59},[319,540,219,220,422,221,223,479,541,542,543,506,306,507,544,545,546,547,548],"exploiting type juggling vulnerabilities","authentication-bypass","coercion","pentesting","type-juggling","php-security","loose-comparison","magic-hash","type-coercion",{"skillNo":550,"name":551,"nameZh":18,"description":552,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":553,"categories":554,"keywords":557,"publishedAt":233},"01M6AEQWJK2SAKPGS6JEGK85VC","exploiting-template-injection-vulnerabilities","Detects and exploits Server-Side Template Injection (SSTI) vulnerabilities across Jinja2, Twig, Freemarker, and other template engines to achieve remote code execution. Use when pentesting a web application that renders user input through a server-side template engine and you need to confirm and weaponize SSTI.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-template-injection-vulnerabilities\u002FSKILL.md",[555,556],{"categoryNo":498,"categoryName":499,"taxonomyType":58,"taxonomyTypeDesc":59},{"categoryNo":242,"categoryName":243,"taxonomyType":58,"taxonomyTypeDesc":59},[319,385,558,503,219,220,422,221,378,347,504,505,543,409,506,559,306,507,560,561],"exploiting template injection vulnerabilities","execution","rce","ssti",{"skillNo":563,"name":564,"nameZh":18,"description":565,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":566,"categories":567,"keywords":574,"publishedAt":233},"01M6AEQS8B6WSV0YS0NGM3ESYD","exploiting-sql-injection-with-sqlmap","Detecting and exploiting SQL injection vulnerabilities using sqlmap to extract database contents during authorized penetration tests.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-sql-injection-with-sqlmap\u002FSKILL.md",[568,569,572,573],{"categoryNo":498,"categoryName":499,"taxonomyType":58,"taxonomyTypeDesc":59},{"categoryNo":570,"categoryName":571,"taxonomyType":58,"taxonomyTypeDesc":59},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":242,"categoryName":243,"taxonomyType":58,"taxonomyTypeDesc":59},{"categoryNo":28,"categoryName":29,"taxonomyType":11,"taxonomyTypeDesc":12},[575,385,576,577,503,219,220,319,422,221,578,504,505,409,506,306,507,579,580,581],"sql","sqlmap","exploiting sql injection with sqlmap","database","database-security","SQL-injection","exploiting sql injection vulnerabilities",109,18]