[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skills:pro6":3,"skills:stats":50,"skills:sce6":55,"skills:creators9":100,"skills:all:stars:124:":195},[4,15,22,29,36,43],{"categoryNo":5,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":8,"categoryNameEn":9,"description":10,"level":11,"skillCount":12,"parentNo":13,"parentName":13,"children":14},"01JBSEEDCAT000000000000030","PROFESSION","适用职业","开发工程师","Software Engineer","从事软件编码、测试与运维的工程师",1,13274,null,[],{"categoryNo":16,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":17,"categoryNameEn":18,"description":19,"level":11,"skillCount":20,"parentNo":13,"parentName":13,"children":21},"01JBSEEDCAT000000000000032","设计师","Designer","视觉、交互与品牌设计人员",7775,[],{"categoryNo":23,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":24,"categoryNameEn":25,"description":26,"level":11,"skillCount":27,"parentNo":13,"parentName":13,"children":28},"01JBSEEDCAT000000000000033","数据分析师","Data Analyst","数据分析、报表与商业智能人员",4988,[],{"categoryNo":30,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":31,"categoryNameEn":32,"description":33,"level":11,"skillCount":34,"parentNo":13,"parentName":13,"children":35},"01JBSEEDCAT000000000000036","内容创作者","Content Creator","作者、编辑与自媒体创作者",3940,[],{"categoryNo":37,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":38,"categoryNameEn":39,"description":40,"level":11,"skillCount":41,"parentNo":13,"parentName":13,"children":42},"01JBSEEDCAT000000000000035","市场营销","Marketer","市场推广、增长与品牌运营人员",3446,[],{"categoryNo":44,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":45,"categoryNameEn":46,"description":47,"level":11,"skillCount":48,"parentNo":13,"parentName":13,"children":49},"01JBSEEDCAT000000000000037","律师与法务","Legal","合同、合规与法律事务人员",3316,[],{"skillCount":51,"professionCount":52,"scenarioCount":53,"creatorCount":54},196852,11,7,1926,[56,65,72,79,86,93],{"categoryNo":57,"taxonomyType":58,"taxonomyTypeDesc":59,"categoryName":60,"categoryNameEn":61,"description":62,"level":11,"skillCount":63,"parentNo":13,"parentName":13,"children":64},"01JBSEEDCAT000000000000022","SCENARIO","使用场景","智能体与自动化","Agents & Automation","Skill、MCP、智能体与工作流自动化",39458,[],{"categoryNo":66,"taxonomyType":58,"taxonomyTypeDesc":59,"categoryName":67,"categoryNameEn":68,"description":69,"level":11,"skillCount":70,"parentNo":13,"parentName":13,"children":71},"01JBSEEDCAT000000000000006","软件开发","Software Development","编码、测试、部署等软件研发任务",26531,[],{"categoryNo":73,"taxonomyType":58,"taxonomyTypeDesc":59,"categoryName":74,"categoryNameEn":75,"description":76,"level":11,"skillCount":77,"parentNo":13,"parentName":13,"children":78},"01JBSEEDCAT000000000000014","设计创意","Design & Creative","视觉设计、品牌与多媒体创作",13569,[],{"categoryNo":80,"taxonomyType":58,"taxonomyTypeDesc":59,"categoryName":81,"categoryNameEn":82,"description":83,"level":11,"skillCount":84,"parentNo":13,"parentName":13,"children":85},"01JBSEEDCAT000000000000001","办公效率","Office Productivity","日常办公文档、表格、演示与沟通类任务",6289,[],{"categoryNo":87,"taxonomyType":58,"taxonomyTypeDesc":59,"categoryName":88,"categoryNameEn":89,"description":90,"level":11,"skillCount":91,"parentNo":13,"parentName":13,"children":92},"01JBSEEDCAT000000000000017","内容创作","Content Creation","写作、文案与营销内容生产",6029,[],{"categoryNo":94,"taxonomyType":58,"taxonomyTypeDesc":59,"categoryName":95,"categoryNameEn":96,"description":97,"level":11,"skillCount":98,"parentNo":13,"parentName":13,"children":99},"01JBSEEDCAT000000000000020","研究与学习","Research & Learning","资料检索、知识整理与学习辅导",5531,[],{"records":101,"total":54,"current":11,"size":194},[102,114,123,133,143,153,163,172,182],{"accountNo":103,"login":104,"displayName":105,"avatarUrl":106,"accountType":107,"accountTypeDesc":108,"profileDescription":109,"skillCount":110,"repoCount":111,"professionCount":52,"scenarioCount":53,"totalStars":112,"updatedAt":113},"01M698VYDXZ6JW5WH3CRV650R8","microsoft","Microsoft","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F6154722?v=4","ORGANIZATION","组织","Open source projects and samples from Microsoft",4160,229,828772,"2026-11-13 04:10:52",{"accountNo":115,"login":116,"displayName":116,"avatarUrl":117,"accountType":107,"accountTypeDesc":108,"profileDescription":118,"skillCount":119,"repoCount":120,"professionCount":53,"scenarioCount":53,"totalStars":121,"updatedAt":122},"01M698P3FSAZ6B4R928ZF19KPT","openclaw","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F252820863?v=4","Your personal, open source AI assistant.",362,32,437711,"2026-11-13 03:02:05",{"accountNo":124,"login":125,"displayName":126,"avatarUrl":127,"accountType":107,"accountTypeDesc":108,"profileDescription":13,"skillCount":128,"repoCount":129,"professionCount":53,"scenarioCount":130,"totalStars":131,"updatedAt":132},"01M6AC29YGCR4S2NTJFV0G8B81","openai","OpenAI","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F14957082?v=4",171,23,6,342695,"2026-11-13 04:03:41",{"accountNo":134,"login":135,"displayName":136,"avatarUrl":137,"accountType":107,"accountTypeDesc":108,"profileDescription":13,"skillCount":138,"repoCount":139,"professionCount":140,"scenarioCount":53,"totalStars":141,"updatedAt":142},"01M6AC83E6K4FDKK7HZ8WNMQKE","apache","The Apache Software Foundation","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F47359?v=4",420,75,8,298176,"2026-11-13 03:14:28",{"accountNo":144,"login":145,"displayName":146,"avatarUrl":147,"accountType":107,"accountTypeDesc":108,"profileDescription":148,"skillCount":149,"repoCount":150,"professionCount":52,"scenarioCount":53,"totalStars":151,"updatedAt":152},"01M698VYEFDM0VJBZDYYJ2T83S","google","Google","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1342004?v=4","Google ❤️ Open Source",535,48,242366,"2026-11-13 04:17:09",{"accountNo":154,"login":155,"displayName":156,"avatarUrl":157,"accountType":107,"accountTypeDesc":108,"profileDescription":158,"skillCount":159,"repoCount":160,"professionCount":52,"scenarioCount":53,"totalStars":161,"updatedAt":162},"01M6AC83DS133TPXFSP1DHNCC6","github","GitHub","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F9919?v=4","How people build software.",940,28,238441,"2026-11-13 03:57:35",{"accountNo":164,"login":165,"displayName":166,"avatarUrl":167,"accountType":107,"accountTypeDesc":108,"profileDescription":13,"skillCount":168,"repoCount":169,"professionCount":52,"scenarioCount":53,"totalStars":170,"updatedAt":171},"01M697XGDPXJAVQ8391V2BCYTE","anthropics","Anthropic","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F76263028?v=4",674,17,231826,"2026-11-13 04:18:26",{"accountNo":173,"login":174,"displayName":175,"avatarUrl":176,"accountType":107,"accountTypeDesc":108,"profileDescription":13,"skillCount":177,"repoCount":178,"professionCount":179,"scenarioCount":53,"totalStars":180,"updatedAt":181},"01M6AC83EPDGBFN19MWYRREJD0","Significant-Gravitas","AutoGPT","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F130738209?v=4",86,2,10,188014,"2026-11-13 02:38:59",{"accountNo":183,"login":184,"displayName":185,"avatarUrl":186,"accountType":187,"accountTypeDesc":188,"profileDescription":189,"skillCount":190,"repoCount":191,"professionCount":130,"scenarioCount":53,"totalStars":192,"updatedAt":193},"01M6DJCCDDG53MTYYRTXAXFG17","garrytan","Garry Tan","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F19957?v=4","USER","个人作者","Writes software, dreams. ",324,3,174614,"2026-11-13 04:05:07",9,{"records":196,"total":51,"current":546,"size":547},[197,233,254,273,286,307,324,350,366,388,416,429,449,465,480,494,510,531],{"skillNo":198,"name":199,"nameZh":13,"description":200,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":209,"categories":210,"keywords":211,"publishedAt":232},"01M6ADVA9ZTXWFCTMREHTVXC98","analyzing-windows-shellbag-artifacts","Analyze Windows Shellbag (BagMRU) registry artifacts with SBECmd and Shellbags Explorer to reconstruct folder browsing activity and prove user interaction with directories, including removable media and network shares, even after the folders are deleted. Use when reconstructing a user's folder access history or proving access to a since-removed directory in DFIR work.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-windows-shellbag-artifacts\u002FSKILL.md",[],[212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231],"windows","artifacts","analyzing","analyzing windows shellbag artifacts","directory","cybersecurity","registry","forensics","user-activity","dfir","network","removable-media","digital-forensics","windows-registry","shellbags","sbecmd","shellbags-explorer","folder-access","network-shares","bagmru","2026-11-10 10:12:30",{"skillNo":234,"name":235,"nameZh":13,"description":236,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":237,"categories":238,"keywords":245,"publishedAt":232},"01M6ADV6X0GJBWHD0HVE5JK8QZ","analyzing-windows-registry-for-artifacts","Extract and analyze Windows Registry hives with tools like RegRipper and Registry Explorer to uncover user activity, installed software, autostart\u002Fpersistence entries, and evidence of system compromise. Use when investigating registry-based persistence, reconstructing user or system activity, or performing DFIR triage on a Windows image.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-windows-registry-for-artifacts\u002FSKILL.md",[239,242],{"categoryNo":240,"categoryName":241,"taxonomyType":58,"taxonomyTypeDesc":59},"01JBSEEDCAT000000000000016","图像与多媒体",{"categoryNo":243,"categoryName":244,"taxonomyType":58,"taxonomyTypeDesc":59},"01JBSEEDCAT000000000000023","Skill与智能体开发",[212,218,213,214,246,247,217,248,249,219,250,221,251,224,225,252,253],"analyzing windows registry for artifacts","image","triage","persistence","artifact-analysis","evidence-collection","regripper","registry-explorer",{"skillNo":255,"name":256,"nameZh":13,"description":257,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":258,"categories":259,"keywords":260,"publishedAt":232},"01M6ADV3YZ7BMDE36K3NEF6KP6","analyzing-windows-prefetch-with-python","Parse Windows Prefetch (.pf) files with the windowsprefetch Python library to reconstruct application execution history, run counts, and accessed file\u002Fvolume lists. Use when investigating renamed or masquerading binaries, verifying program execution timelines, or hunting for suspicious execution patterns in incident response.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-windows-prefetch-with-python\u002FSKILL.md",[],[261,212,214,262,263,264,217,265,266,267,268,219,269,270,271,272,224],"python","prefetch","analyzing windows prefetch with python","suspicious","incident response","run","library","file","malware","malware-analysis","incident-response","execution-history",{"skillNo":274,"name":275,"nameZh":13,"description":276,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":277,"categories":278,"keywords":280,"publishedAt":232},"01M6ADV12QXR7K2SZQNGZFHJA7","analyzing-windows-lnk-files-for-artifacts","Parse Windows LNK shortcut files to extract target paths, MAC timestamps, volume serial numbers, and machine identifiers for forensic timeline reconstruction. Use when investigating recently-accessed files, tracking removable media or network paths referenced by shortcuts, or building a DFIR timeline from LNK artifacts.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-windows-lnk-files-for-artifacts\u002FSKILL.md",[279],{"categoryNo":243,"categoryName":244,"taxonomyType":58,"taxonomyTypeDesc":59},[212,213,214,281,217,219,282,221,222,283,251,284,285],"analyzing windows lnk files for artifacts","lnk-files","windows-artifacts","shortcut-analysis","timeline-reconstruction",{"skillNo":287,"name":288,"nameZh":13,"description":289,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":290,"categories":291,"keywords":293,"publishedAt":232},"01M6ADTXY3MMSZXS0YSBSKQ6YD","analyzing-windows-event-logs-in-splunk","Analyzes Windows Security, System, and Sysmon event logs in Splunk to detect authentication attacks, privilege escalation, persistence mechanisms, and lateral movement using SPL queries mapped to MITRE ATT&CK techniques. Use when SOC analysts need to investigate Windows-based threats, build detection queries, or perform forensic timeline analysis of Windows endpoints and domain controllers.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-windows-event-logs-in-splunk\u002FSKILL.md",[292],{"categoryNo":243,"categoryName":244,"taxonomyType":58,"taxonomyTypeDesc":59},[212,294,295,214,296,216,297,298,217,299,249,300,301,302,303,304,305,306],"logs","splunk","analyzing windows event logs in splunk","security","policy","authentication","active-directory","mitre-attack","soc","SPL","windows-events","sysmon","event-logs",{"skillNo":308,"name":309,"nameZh":13,"description":310,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":311,"categories":312,"keywords":314,"publishedAt":232},"01M6ADTTSSVRFK1W8HQ5HH1HW0","analyzing-windows-amcache-artifacts","Parses the Windows Amcache.hve registry hive with Eric Zimmerman's AmcacheParser and Timeline Explorer to extract evidence of program execution, application installation, and driver loading, including SHA-1 hash correlation with threat intel and timeline reconstruction. Use for Amcache forensics, program execution evidence gathering, or application compatibility cache investigations in DFIR work.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-windows-amcache-artifacts\u002FSKILL.md",[313],{"categoryNo":243,"categoryName":244,"taxonomyType":58,"taxonomyTypeDesc":59},[212,213,214,315,217,218,316,317,219,318,319,221,320,321,322,323],"analyzing windows amcache artifacts","hive","cache","windows-forensics","program-execution","timeline-analysis","amcache","AmcacheParser","eric-zimmerman",{"skillNo":325,"name":326,"nameZh":13,"description":327,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":328,"categories":329,"keywords":335,"publishedAt":232},"01M6ADTQ7VF9719K2VQ18HFH58","analyzing-web-server-logs-for-intrusion","Parse Apache and Nginx access logs to detect SQL injection attempts, local file inclusion, directory traversal, web scanner fingerprints, and brute-force patterns. Uses regex-based pattern matching against OWASP attack signatures, GeoIP enrichment for source attribution, and statistical anomaly detection for request frequency and response size outliers.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-web-server-logs-for-intrusion\u002FSKILL.md",[330,333,334],{"categoryNo":331,"categoryName":332,"taxonomyType":58,"taxonomyTypeDesc":59},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":243,"categoryName":244,"taxonomyType":58,"taxonomyTypeDesc":59},{"categoryNo":23,"categoryName":24,"taxonomyType":6,"taxonomyTypeDesc":7},[336,294,337,214,338,216,217,135,268,339,340,341,342,343,344,345,346,347,348,349],"web","server","analyzing web server logs for intrusion","nginx","security-operations","attribution","intrusion-detection","log-analysis","web-log-analysis","apache-logs","nginx-logs","sql-injection-detection","lfi-detection","directory-traversal",{"skillNo":351,"name":352,"nameZh":13,"description":353,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":354,"categories":355,"keywords":357,"publishedAt":232},"01M6ADTM4THD52APBH7N815P53","analyzing-usb-device-connection-history","Correlate Windows registry keys (USBSTOR, MountedDevices), Event Logs, and setupapi.dev.log to reconstruct USB device connection history, first\u002Flast-plugged timestamps, and drive letter mappings. Use when investigating removable media usage, tracking device provenance, or building a timeline for suspected data exfiltration.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-usb-device-connection-history\u002FSKILL.md",[356],{"categoryNo":243,"categoryName":244,"taxonomyType":58,"taxonomyTypeDesc":59},[214,358,217,212,218,359,294,219,360,361,362,363,223,364,365],"analyzing usb device connection history","dev","exfiltration","data-exfiltration","data","usb-forensics","registry-analysis","device-history",{"skillNo":367,"name":368,"nameZh":13,"description":369,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":370,"categories":371,"keywords":373,"publishedAt":232},"01M6ADTGSV7A93WE3X0P7K7ZTE","analyzing-uefi-bootkit-persistence","Analyzes UEFI bootkit persistence (SPI flash implants, ESP modifications, Secure Boot bypass, UEFI variable manipulation) using chipsec for firmware integrity verification, detecting known families like BlackLotus, LoJax, and MoonBounce. Use for UEFI malware analysis, firmware persistence investigation, or Secure Boot bypass detection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-uefi-bootkit-persistence\u002FSKILL.md",[372],{"categoryNo":243,"categoryName":244,"taxonomyType":58,"taxonomyTypeDesc":59},[249,374,375,214,376,297,217,377,378,379,380,381,382,383,269,384,385,386,387],"bootkit","UEFI","analyzing uefi bootkit persistence","secure","pr","boot","code","verification","monitoring","malware analysis","firmware","Secure-Boot","chipsec","ESP",{"skillNo":389,"name":390,"nameZh":13,"description":391,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":392,"categories":393,"keywords":399,"publishedAt":232},"01M6ADTDCEBCS6RFNCZVG89G9R","analyzing-typosquatting-domains-with-dnstwist","Generate domain permutations with dnstwist and check DNS resolution to detect typosquatting, homograph phishing, and brand impersonation domains registered against your organization. Use when asked to monitor for lookalike domains, investigate a phishing domain, or assess brand-impersonation risk.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-typosquatting-domains-with-dnstwist\u002FSKILL.md",[394,397,398],{"categoryNo":395,"categoryName":396,"taxonomyType":58,"taxonomyTypeDesc":59},"01JBSEEDCAT000000000000015","视觉设计",{"categoryNo":243,"categoryName":244,"taxonomyType":58,"taxonomyTypeDesc":59},{"categoryNo":16,"categoryName":17,"taxonomyType":6,"taxonomyTypeDesc":7},[214,400,217,401,402,403,404,405,406,407,382,408,409,410,411,412,413,414,415],"analyzing typosquatting domains with dnstwist","infrastructure","monitor","development","create","generate","search","website","threat-intelligence","phishing","domain-monitoring","dns","dnstwist","typosquatting","brand-protection","homograph",{"skillNo":417,"name":418,"nameZh":13,"description":419,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":420,"categories":421,"keywords":422,"publishedAt":232},"01M6ADT9WRHY99ZFTEJ16QQ8K0","analyzing-tls-certificate-transparency-logs","Queries Certificate Transparency logs via crt.sh and pycrtsh to detect phishing domains, unauthorized certificate issuance, and shadow IT. Monitors newly issued certificates for typosquatting and brand impersonation using Levenshtein distance. Use for proactive phishing domain detection and certificate monitoring.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-tls-certificate-transparency-logs\u002FSKILL.md",[],[294,214,423,297,217,401,403,404,406,407,382,340,424,425,409,426,427,428],"analyzing tls certificate transparency logs","certificate-transparency","ct-logs","crt-sh","phishing-detection","tls-monitoring",{"skillNo":430,"name":431,"nameZh":13,"description":432,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":433,"categories":434,"keywords":435,"publishedAt":232},"01M6ADT6NFDD0M3TJ2XFDKWHVB","analyzing-threat-landscape-with-misp","Query a MISP (Malware Information Sharing Platform) instance via PyMISP to compute event statistics, IOC type breakdowns, threat actor galaxy clusters, and tag trends, and generate threat landscape reports with temporal trends. Use when asked to analyze threat intelligence data, summarize top threat actors or malware families, or produce a CTI landscape report from MISP events.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-threat-landscape-with-misp\u002FSKILL.md",[],[436,214,437,217,438,405,439,440,441,442,443,268,408,269,444,445,362,446,447,448],"MISP","analyzing threat landscape with misp","threat intelligence","report","validation","protocol","produce","content","cti","ioc","threat-landscape","ioc-analysis","threat-sharing",{"skillNo":450,"name":451,"nameZh":13,"description":452,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":453,"categories":454,"keywords":456,"publishedAt":232},"01M6ADT3ABQM1B9ATPBK1PYRMN","analyzing-threat-intelligence-feeds","Analyzes structured and unstructured threat intelligence feeds to extract actionable indicators, adversary tactics, and campaign context. Use when ingesting commercial or open-source CTI feeds, evaluating feed quality, normalizing data into STIX 2.1 format, or enriching existing IOCs with campaign attribution. Activates for requests involving ThreatConnect, Recorded Future, Mandiant Advantage, MISP, AlienVault OTX, or automated feed aggregation pipelines.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-threat-intelligence-feeds\u002FSKILL.md",[455],{"categoryNo":243,"categoryName":244,"taxonomyType":58,"taxonomyTypeDesc":59},[438,214,457,217,458,408,444,445,459,341,460,461,436,362,462,463,464],"analyzing threat intelligence feeds","campaign attribution","stix","MITRE-ATT&CK","NIST-CSF","TAXII","ThreatConnect","Recorded-Future",{"skillNo":466,"name":467,"nameZh":13,"description":468,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":469,"categories":470,"keywords":471,"publishedAt":232},"01M6ADT08A4149DW94EFGQXZV1","analyzing-threat-actor-ttps-with-mitre-navigator","Map advanced persistent threat (APT) group TTPs to the MITRE ATT&CK framework using the attackcti Python library to query STIX\u002FTAXII data for group-technique associations, then generate ATT&CK Navigator layer files to visualize and compare defensive coverage against adversary profiles. Use when profiling an APT group's techniques, building Navigator coverage heatmaps, or assessing technique coverage gaps against a specific threat actor.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-threat-actor-ttps-with-mitre-navigator\u002FSKILL.md",[],[472,214,473,261,474,217,475,405,440,441,267,268,476,301,408,459,362,477,478,479],"navigator","analyzing threat actor ttps with mitre navigator","visualize","coverage gaps","apt","T1059.001","ttp-mapping","attackcti",{"skillNo":481,"name":482,"nameZh":13,"description":483,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":484,"categories":485,"keywords":487,"publishedAt":232},"01M6ADSX0KN81AMAS0J8RPK50M","analyzing-threat-actor-ttps-with-mitre-attack","Systematically map threat actor behavior and observed IOCs to the MITRE ATT&CK framework, build technique coverage heatmaps with the ATT&CK Navigator, identify detection gaps, and produce actionable threat intelligence reports across the Enterprise, Mobile, and ICS matrices. Use when analyzing threat actor TTPs, correlating IOCs to specific ATT&CK techniques, or assessing defensive detection coverage against adversary behavior.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-threat-actor-ttps-with-mitre-attack\u002FSKILL.md",[486],{"categoryNo":243,"categoryName":244,"taxonomyType":58,"taxonomyTypeDesc":59},[488,214,489,217,438,440,442,443,490,268,301,472,491,408,444,445,459,492,477,493],"mitre attack","analyzing threat actor ttps with mitre attack","metadata","ttp-analysis","Enterprise","threat-actors",{"skillNo":495,"name":496,"nameZh":13,"description":497,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":498,"categories":499,"keywords":501,"publishedAt":232},"01M6ADSS29BMZKSB83VW4XFQJS","analyzing-supply-chain-malware-artifacts","Investigate supply chain attack artifacts including trojanized software updates, compromised build pipelines, and sideloaded dependencies to identify intrusion vectors and scope of compromise.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-supply-chain-malware-artifacts\u002FSKILL.md",[500],{"categoryNo":243,"categoryName":244,"taxonomyType":58,"taxonomyTypeDesc":59},[213,269,214,502,217,503,270,504,505,506,507,508,509],"analyzing supply chain malware artifacts","component","supply-chain","trojanized-software","solarwinds","3cx","dependency-confusion","software-integrity",{"skillNo":511,"name":512,"nameZh":13,"description":513,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":514,"categories":515,"keywords":521,"publishedAt":232},"01M6ADSNRG3XDHFQHKWZ48CB8R","analyzing-slack-space-and-file-system-artifacts","Examine NTFS slack space, MFT entries, the USN Change Journal, and Alternate Data Streams (ADS) to recover hidden or residual data, reconstruct deleted-file metadata, and reconstruct available file-system change activity from USN records. Use during deep forensic analysis of an NTFS image when standard file recovery is insufficient, such as hunting for data hidden in ADS.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-slack-space-and-file-system-artifacts\u002FSKILL.md",[516,519,520],{"categoryNo":517,"categoryName":518,"taxonomyType":58,"taxonomyTypeDesc":59},"01JBSEEDCAT000000000000005","邮件与沟通",{"categoryNo":243,"categoryName":244,"taxonomyType":58,"taxonomyTypeDesc":59},{"categoryNo":23,"categoryName":24,"taxonomyType":6,"taxonomyTypeDesc":7},[522,213,268,214,523,247,217,524,490,219,525,526,527,362,528,529,530],"slack","analyzing slack space and file system artifacts","change","mft","ntfs","usn-journal","slack-space","alternate-data-streams","file-system-analysis",{"skillNo":532,"name":533,"nameZh":13,"description":534,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":535,"categories":536,"keywords":541,"publishedAt":232},"01M6ADSJVCZ33NXTJWB60VGQ93","analyzing-security-logs-with-splunk","Leverages Splunk Enterprise Security and SPL (Search Processing Language) to investigate security incidents through log correlation, timeline reconstruction, and anomaly detection. Covers Windows event logs, firewall logs, proxy logs, and authentication data analysis. Activates for requests involving Splunk investigation, SPL queries, SIEM log analysis, security event correlation, or log-based incident investigation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-security-logs-with-splunk\u002FSKILL.md",[537,540],{"categoryNo":538,"categoryName":539,"taxonomyType":58,"taxonomyTypeDesc":59},"01JBSEEDCAT000000000000013","分析与可视化",{"categoryNo":243,"categoryName":244,"taxonomyType":58,"taxonomyTypeDesc":59},[297,294,295,214,542,543,217,544,212,299,440,406,545,268,382,343,492,271,362,477],"analyzing security logs with splunk","data analysis","siem","proxy",124,18]