[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skills:pro6":3,"skills:sce6":50,"skills:creators9":95,"skills:stats":193,"skills:all:stars:86:":195},[4,15,22,29,36,43],{"categoryNo":5,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":8,"categoryNameEn":9,"description":10,"level":11,"skillCount":12,"parentNo":13,"parentName":13,"children":14},"01JBSEEDCAT000000000000030","PROFESSION","适用职业","开发工程师","Software Engineer","从事软件编码、测试与运维的工程师",1,13276,null,[],{"categoryNo":16,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":17,"categoryNameEn":18,"description":19,"level":11,"skillCount":20,"parentNo":13,"parentName":13,"children":21},"01JBSEEDCAT000000000000032","设计师","Designer","视觉、交互与品牌设计人员",7776,[],{"categoryNo":23,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":24,"categoryNameEn":25,"description":26,"level":11,"skillCount":27,"parentNo":13,"parentName":13,"children":28},"01JBSEEDCAT000000000000033","数据分析师","Data Analyst","数据分析、报表与商业智能人员",4988,[],{"categoryNo":30,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":31,"categoryNameEn":32,"description":33,"level":11,"skillCount":34,"parentNo":13,"parentName":13,"children":35},"01JBSEEDCAT000000000000036","内容创作者","Content Creator","作者、编辑与自媒体创作者",3940,[],{"categoryNo":37,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":38,"categoryNameEn":39,"description":40,"level":11,"skillCount":41,"parentNo":13,"parentName":13,"children":42},"01JBSEEDCAT000000000000035","市场营销","Marketer","市场推广、增长与品牌运营人员",3449,[],{"categoryNo":44,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":45,"categoryNameEn":46,"description":47,"level":11,"skillCount":48,"parentNo":13,"parentName":13,"children":49},"01JBSEEDCAT000000000000037","律师与法务","Legal","合同、合规与法律事务人员",3317,[],[51,60,67,74,81,88],{"categoryNo":52,"taxonomyType":53,"taxonomyTypeDesc":54,"categoryName":55,"categoryNameEn":56,"description":57,"level":11,"skillCount":58,"parentNo":13,"parentName":13,"children":59},"01JBSEEDCAT000000000000022","SCENARIO","使用场景","智能体与自动化","Agents & Automation","Skill、MCP、智能体与工作流自动化",39462,[],{"categoryNo":61,"taxonomyType":53,"taxonomyTypeDesc":54,"categoryName":62,"categoryNameEn":63,"description":64,"level":11,"skillCount":65,"parentNo":13,"parentName":13,"children":66},"01JBSEEDCAT000000000000006","软件开发","Software Development","编码、测试、部署等软件研发任务",26546,[],{"categoryNo":68,"taxonomyType":53,"taxonomyTypeDesc":54,"categoryName":69,"categoryNameEn":70,"description":71,"level":11,"skillCount":72,"parentNo":13,"parentName":13,"children":73},"01JBSEEDCAT000000000000014","设计创意","Design & Creative","视觉设计、品牌与多媒体创作",13572,[],{"categoryNo":75,"taxonomyType":53,"taxonomyTypeDesc":54,"categoryName":76,"categoryNameEn":77,"description":78,"level":11,"skillCount":79,"parentNo":13,"parentName":13,"children":80},"01JBSEEDCAT000000000000001","办公效率","Office Productivity","日常办公文档、表格、演示与沟通类任务",6291,[],{"categoryNo":82,"taxonomyType":53,"taxonomyTypeDesc":54,"categoryName":83,"categoryNameEn":84,"description":85,"level":11,"skillCount":86,"parentNo":13,"parentName":13,"children":87},"01JBSEEDCAT000000000000017","内容创作","Content Creation","写作、文案与营销内容生产",6033,[],{"categoryNo":89,"taxonomyType":53,"taxonomyTypeDesc":54,"categoryName":90,"categoryNameEn":91,"description":92,"level":11,"skillCount":93,"parentNo":13,"parentName":13,"children":94},"01JBSEEDCAT000000000000020","研究与学习","Research & Learning","资料检索、知识整理与学习辅导",5531,[],{"records":96,"total":191,"current":11,"size":192},[97,111,120,130,140,150,160,169,179],{"accountNo":98,"login":99,"displayName":100,"avatarUrl":101,"accountType":102,"accountTypeDesc":103,"profileDescription":104,"skillCount":105,"repoCount":106,"professionCount":107,"scenarioCount":108,"totalStars":109,"updatedAt":110},"01M698VYDXZ6JW5WH3CRV650R8","microsoft","Microsoft","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F6154722?v=4","ORGANIZATION","组织","Open source projects and samples from Microsoft",4166,229,11,7,828075,"2026-11-12 04:48:47",{"accountNo":112,"login":113,"displayName":113,"avatarUrl":114,"accountType":102,"accountTypeDesc":103,"profileDescription":115,"skillCount":116,"repoCount":117,"professionCount":108,"scenarioCount":108,"totalStars":118,"updatedAt":119},"01M698P3FSAZ6B4R928ZF19KPT","openclaw","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F252820863?v=4","Your personal, open source AI assistant.",362,32,437637,"2026-11-12 03:04:11",{"accountNo":121,"login":122,"displayName":123,"avatarUrl":124,"accountType":102,"accountTypeDesc":103,"profileDescription":13,"skillCount":125,"repoCount":126,"professionCount":108,"scenarioCount":127,"totalStars":128,"updatedAt":129},"01M6AC29YGCR4S2NTJFV0G8B81","openai","OpenAI","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F14957082?v=4",171,23,6,341786,"2026-11-12 03:20:15",{"accountNo":131,"login":132,"displayName":133,"avatarUrl":134,"accountType":102,"accountTypeDesc":103,"profileDescription":13,"skillCount":135,"repoCount":136,"professionCount":137,"scenarioCount":108,"totalStars":138,"updatedAt":139},"01M6AC83E6K4FDKK7HZ8WNMQKE","apache","The Apache Software Foundation","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F47359?v=4",420,75,8,298091,"2026-11-12 05:32:19",{"accountNo":141,"login":142,"displayName":143,"avatarUrl":144,"accountType":102,"accountTypeDesc":103,"profileDescription":145,"skillCount":146,"repoCount":147,"professionCount":107,"scenarioCount":108,"totalStars":148,"updatedAt":149},"01M698VYEFDM0VJBZDYYJ2T83S","google","Google","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1342004?v=4","Google ❤️ Open Source",535,48,241637,"2026-11-12 03:57:04",{"accountNo":151,"login":152,"displayName":153,"avatarUrl":154,"accountType":102,"accountTypeDesc":103,"profileDescription":155,"skillCount":156,"repoCount":157,"professionCount":107,"scenarioCount":108,"totalStars":158,"updatedAt":159},"01M6AC83DS133TPXFSP1DHNCC6","github","GitHub","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F9919?v=4","How people build software.",936,27,238133,"2026-11-12 03:23:28",{"accountNo":161,"login":162,"displayName":163,"avatarUrl":164,"accountType":102,"accountTypeDesc":103,"profileDescription":13,"skillCount":165,"repoCount":166,"professionCount":107,"scenarioCount":108,"totalStars":167,"updatedAt":168},"01M697XGDPXJAVQ8391V2BCYTE","anthropics","Anthropic","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F76263028?v=4",674,17,231455,"2026-11-12 03:40:35",{"accountNo":170,"login":171,"displayName":172,"avatarUrl":173,"accountType":102,"accountTypeDesc":103,"profileDescription":13,"skillCount":174,"repoCount":175,"professionCount":176,"scenarioCount":108,"totalStars":177,"updatedAt":178},"01M6AC83EPDGBFN19MWYRREJD0","Significant-Gravitas","AutoGPT","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F130738209?v=4",86,2,10,187999,"2026-11-12 03:17:01",{"accountNo":180,"login":181,"displayName":182,"avatarUrl":183,"accountType":184,"accountTypeDesc":185,"profileDescription":186,"skillCount":187,"repoCount":188,"professionCount":127,"scenarioCount":108,"totalStars":189,"updatedAt":190},"01M6DJCCDDG53MTYYRTXAXFG17","garrytan","Garry Tan","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F19957?v=4","USER","个人作者","Writes software, dreams. ",324,3,174404,"2026-11-12 05:14:59",1905,9,{"skillCount":194,"professionCount":107,"scenarioCount":108,"creatorCount":191},196622,{"records":196,"total":194,"current":174,"size":612},[197,236,260,285,304,326,350,376,399,417,436,461,486,505,526,548,571,588],{"skillNo":198,"name":199,"nameZh":13,"description":200,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":209,"categories":210,"keywords":214,"publishedAt":235},"01M6AG7B5GPVXFKCPDD9C5G66B","reverse-engineering-ransomware-encryption-routine","Reverse engineer ransomware encryption routines to identify cryptographic algorithms, key generation flaws, and potential decryption opportunities using static and dynamic analysis.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35925,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Freverse-engineering-ransomware-encryption-routine\u002FSKILL.md",[211],{"categoryNo":212,"categoryName":213,"taxonomyType":53,"taxonomyTypeDesc":54},"01JBSEEDCAT000000000000023","Skill与智能体开发",[215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234],"engineering","ransomware","encryption","reverse engineering ransomware encryption routine","routines","cybersecurity","validation","verification","file","reverse-engineering","malware","malware-analysis","cryptanalysis","cryptocurrency","hardening","Tools","aes","rsa","analysis","decryption","2026-11-10 10:12:30",{"skillNo":237,"name":238,"nameZh":13,"description":239,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":240,"categories":241,"keywords":247,"publishedAt":235},"01M6AG77GZX9WV2AGCT6R9Y86Q","reverse-engineering-malware-with-ghidra","Reverse engineers malware binaries using NSA's Ghidra disassembler and decompiler to study internal logic, cryptographic routines, C2 protocols, and evasion techniques at the assembly and pseudo-C level. Use when static or dynamic analysis flags suspicious functionality needing deeper code review, such as reversing C2 protocols, encryption algorithms, custom obfuscation, or a sample's exploit mechanism.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Freverse-engineering-malware-with-ghidra\u002FSKILL.md",[242,245,246],{"categoryNo":243,"categoryName":244,"taxonomyType":53,"taxonomyTypeDesc":54},"01JBSEEDCAT000000000000007","代码审查",{"categoryNo":212,"categoryName":213,"taxonomyType":53,"taxonomyTypeDesc":54},{"categoryNo":5,"categoryName":8,"taxonomyType":6,"taxonomyTypeDesc":7},[215,225,248,249,250,251,252,219,220,253,254,224,255,226,256,217,257,233,258,259],"ghidra","reverse engineering malware with ghidra","code review","review","suspicious","code","protocols","c2","disassembly","obfuscation","evasion","decompilation",{"skillNo":261,"name":262,"nameZh":13,"description":263,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":264,"categories":265,"keywords":271,"publishedAt":235},"01M6AG73MZCP6HXWECFT68MA1Q","reverse-engineering-ios-app-with-frida","Reverse engineers iOS applications using Frida dynamic instrumentation to understand internal logic, extract encryption keys, bypass security controls, and discover hidden functionality without source code access. Use when performing authorized iOS penetration testing, analyzing proprietary protocols, understanding obfuscated logic, or extracting runtime secrets from iOS binaries. Activates for requests involving iOS reverse engineering, Frida iOS hooking, Objective-C\u002FSwift method tracing, or iOS binary analysis.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Freverse-engineering-ios-app-with-frida\u002FSKILL.md",[266,269,270],{"categoryNo":267,"categoryName":268,"taxonomyType":53,"taxonomyTypeDesc":54},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":212,"categoryName":213,"taxonomyType":53,"taxonomyTypeDesc":54},{"categoryNo":5,"categoryName":8,"taxonomyType":6,"taxonomyTypeDesc":7},[215,272,273,274,275,220,276,253,254,277,224,278,279,280,217,281,282,283,233,284],"ios","frida","reverse engineering ios app with frida","testing","pr","penetration testing","mobile-security","owasp-mobile","analyzing","t1078","t1059","applications","secrets",{"skillNo":286,"name":287,"nameZh":13,"description":288,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":289,"categories":290,"keywords":293,"publishedAt":235},"01M6AG704W7YJ0JTGHZAB26WH7","reverse-engineering-dotnet-malware-with-dnspy","Reverse engineers .NET malware samples using the dnSpy decompiler and debugger to read C#\u002FVB.NET source, deobfuscate code protected by tools like ConfuserEx or SmartAssembly, and extract hardcoded C2 configurations, keys, and credentials. Use when a sample is identified as a .NET assembly (e.g. AgentTesla, AsyncRAT, RedLine Stealer, Quasar RAT) and needs decompilation, deobfuscation, or config extraction.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Freverse-engineering-dotnet-malware-with-dnspy\u002FSKILL.md",[291,292],{"categoryNo":212,"categoryName":213,"taxonomyType":53,"taxonomyTypeDesc":54},{"categoryNo":5,"categoryName":8,"taxonomyType":6,"taxonomyTypeDesc":7},[294,215,225,295,296,220,297,253,298,224,255,226,299,300,230,301,302,233,303,259],"dotnet","dnSpy","reverse engineering dotnet malware with dnspy","config","extraction","deobfuscation","t1055","rat","debugger","credentials",{"skillNo":305,"name":306,"nameZh":13,"description":307,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":308,"categories":309,"keywords":311,"publishedAt":235},"01M6AG6WS63AGWZWF05157NV51","reverse-engineering-android-malware-with-jadx","Reverse engineers malicious Android APK files using the JADX decompiler to read Java\u002FKotlin source, inspect manifest permissions, receivers, services, and native libraries, and identify data theft, C2 communication, privilege escalation, or overlay-attack behavior. Use when analyzing a suspected Android banking trojan, spyware, SMS stealer, or other flagged APK, or when investigating mobile malware or Android threats generally.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Freverse-engineering-android-malware-with-jadx\u002FSKILL.md",[310],{"categoryNo":212,"categoryName":213,"taxonomyType":53,"taxonomyTypeDesc":54},[312,215,313,225,314,315,220,316,317,318,319,320,321,322,224,280,323,324,325,233],"android","jadx","reverse engineering android malware with jadx","malicious","libraries","permissions","communication","java","services","APK","mobile-malware","data","escalation","manifest",{"skillNo":327,"name":328,"nameZh":13,"description":329,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":330,"categories":331,"keywords":334,"publishedAt":235},"01M6AG6RKJM30QXKTAJY0WPJSJ","remediating-s3-bucket-misconfiguration","Provides step-by-step procedures for remediating Amazon S3 bucket misconfigurations that expose sensitive data: enabling S3 Block Public Access, auditing bucket policies and ACLs, enforcing encryption, configuring access logging, and deploying automated remediation with AWS Config and Lambda. Use when AWS Config or Security Hub flags public or unencrypted S3 buckets, or preparing audit evidence for storage security controls.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fremediating-s3-bucket-misconfiguration\u002FSKILL.md",[332,333],{"categoryNo":212,"categoryName":213,"taxonomyType":53,"taxonomyTypeDesc":54},{"categoryNo":23,"categoryName":24,"taxonomyType":6,"taxonomyTypeDesc":7},[335,336,337,338,220,339,297,340,341,342,323,217,343,344,345,281,346,347,348,349],"s3","misconfiguration","remediating s3 bucket misconfiguration","security","storage","logging","audit","cloud-security","remediation","lambda","public-access","s3-security","bucket-misconfiguration","public-access-block","aws-config",{"skillNo":351,"name":352,"nameZh":13,"description":353,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":354,"categories":355,"keywords":357,"publishedAt":235},"01M6AG6NC62BFKASMS7N8Z575M","relaying-ntlm-for-adcs-esc8","Uses Impacket's ntlmrelayx.py with a coercion tool (PetitPotam, Coercer, printerbug) to relay NTLM authentication from a coerced domain controller into the AD CS HTTP web-enrollment endpoint (ESC8), obtaining a DC certificate usable via Certipy for PKINIT\u002FDCSync. Use during internal AD penetration tests or purple-team exercises when AD CS Web Enrollment lacks Extended Protection for Authentication.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frelaying-ntlm-for-adcs-esc8\u002FSKILL.md",[356],{"categoryNo":212,"categoryName":213,"taxonomyType":53,"taxonomyTypeDesc":54},[358,359,360,361,220,362,363,364,365,324,366,367,368,369,370,371,372,373,374,375],"esc8","adcs","relaying ntlm for adcs esc8","directory","http","authentication","red-team","active-directory","coercion","petitpotam","coercer","ntlm-relay","dcsync","purple-team","controller","Impacket","endpoint","certificate",{"skillNo":377,"name":378,"nameZh":13,"description":379,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":380,"categories":381,"keywords":383,"publishedAt":235},"01M6AG6HTGQ9AW8GBEMPJ3FF8X","red-teaming-llms-with-garak","Runs NVIDIA garak probe suites (jailbreak, prompt injection, data leakage, toxicity, and more) against an LLM endpoint - Hugging Face models, OpenAI-compatible APIs, or Bedrock - then interprets the resulting hit-rate report for triage. Use when baselining LLM security before\u002Fafter deployment, validating that a guardrail or fine-tune reduces jailbreak\u002Finjection success rates, or producing evidence for an AI risk assessment.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fred-teaming-llms-with-garak\u002FSKILL.md",[382],{"categoryNo":212,"categoryName":213,"taxonomyType":53,"taxonomyTypeDesc":54},[384,385,386,387,338,220,388,389,122,390,323,391,374,392,393,394,395,396,397,398],"llms","red teaming llms with garak","llm security","prompt injection","risk assessment","assessment","NVIDIA","vulnerability-scanning","llm-red-teaming","jailbreak","injection","risk","vulnerability","garak","data-leakage",{"skillNo":400,"name":401,"nameZh":13,"description":402,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":403,"categories":404,"keywords":406,"publishedAt":235},"01M6AG6EC1AA9ERA1PWEP324AP","recovering-from-ransomware-attack","Executes structured ransomware incident recovery following NIST\u002FCISA frameworks: environment isolation, forensic evidence preservation, clean infrastructure rebuild, prioritized restoration from verified backups, credential reset, and Active Directory\u002Fdatabase recovery in dependency order. Use when recovering from a ransomware attack, performing post-encryption restoration, or executing disaster recovery after ransomware encryption.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frecovering-from-ransomware-attack\u002FSKILL.md",[405],{"categoryNo":212,"categoryName":213,"taxonomyType":53,"taxonomyTypeDesc":54},[216,407,361,220,276,408,409,410,217,228,411,412,413,414,281,230,282,415,416],"recovering from ransomware attack","infrastructure","database","incident-response","CISA","NIST","defense","t1003","backup","recovery",{"skillNo":418,"name":419,"nameZh":13,"description":420,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":421,"categories":422,"keywords":424,"publishedAt":235},"01M6AG6B898ARXRAJMMR090YEG","recovering-deleted-files-with-photorec","Recovers deleted files from disk images and storage media using PhotoRec's file signature-based carving engine, which works regardless of file system damage or corruption. Use when recovering deleted or lost files from a forensic disk image, damaged storage device, or corrupted file system during evidence recovery.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frecovering-deleted-files-with-photorec\u002FSKILL.md",[423],{"categoryNo":212,"categoryName":213,"taxonomyType":53,"taxonomyTypeDesc":54},[425,426,220,339,223,427,428,323,429,282,430,416,431,432,433,434,435],"recovering deleted files with photorec","image","forensics","file-recovery","digital-forensics","t1074","file-carving","data-recovery","evidence-recovery","Media","photorec",{"skillNo":437,"name":438,"nameZh":13,"description":439,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":440,"categories":441,"keywords":443,"publishedAt":235},"01M6AG67EETPNN39JYXH82BZJB","profiling-threat-actor-groups","Develops comprehensive threat actor profiles for APT groups, criminal organizations, and hacktivist collectives by aggregating TTP documentation, historical campaign data, tooling fingerprints, and attribution indicators from multiple intelligence sources. Use when briefing executives on sector-specific threats, updating threat model assumptions, or prioritizing defensive controls against specific adversaries. Activates for requests involving MITRE ATT&CK Groups, Mandiant APT profiles, CrowdStrike adversary naming, or sector-specific threat briefings.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprofiling-threat-actor-groups\u002FSKILL.md",[442],{"categoryNo":212,"categoryName":213,"taxonomyType":53,"taxonomyTypeDesc":54},[444,220,445,446,447,448,449,450,451,452,453,323,412,454,455,456,457,458,459,460],"profiling threat actor groups","documentation","threat model","apt","threat-actor","threat-intelligence","attribution","kill-chain","MITRE-ATT&CK","NIST-CSF","ATT&CK","CrowdStrike","indicators","TTP","t1566","csf","Mandiant",{"skillNo":462,"name":463,"nameZh":13,"description":464,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":465,"categories":466,"keywords":468,"publishedAt":235},"01M6AG63N61W0DEQZFS0G3V3M7","processing-stix-taxii-feeds","Processes STIX 2.1 threat intelligence bundles delivered via TAXII 2.1 servers, normalizing objects into platform-native schemas and routing them to appropriate consuming systems. Use when onboarding new TAXII collection endpoints, automating bi-directional intelligence sharing with ISACs, or building pipeline validation for malformed STIX bundles. Activates for requests involving OASIS STIX, TAXII server configuration, MISP TAXII, or Cortex XSOAR feed integrations.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprocessing-stix-taxii-feeds\u002FSKILL.md",[467],{"categoryNo":212,"categoryName":213,"taxonomyType":53,"taxonomyTypeDesc":54},[469,470,471,472,220,473,474,449,475,476,477,478,412,479,480,481,482,483,484,485],"stix","TAXII","feeds","processing stix taxii feeds","threat intelligence","server","cti","ioc","MISP","pipeline","xsoar","cortex","oasis","collection","NIST-SP-800-150","STIX-2.1","TAXII-2.1",{"skillNo":487,"name":488,"nameZh":13,"description":489,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":490,"categories":491,"keywords":493,"publishedAt":235},"01M6AG5ZY2ZEHFB9JB5NZMZH0Y","prioritizing-vulnerabilities-with-cvss-scoring","The Common Vulnerability Scoring System (CVSS) is the industry standard framework maintained by FIRST (Forum of Incident Response and Security Teams) for assessing vulnerability severity. CVSS v4.0 (r","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprioritizing-vulnerabilities-with-cvss-scoring\u002FSKILL.md",[492],{"categoryNo":212,"categoryName":213,"taxonomyType":53,"taxonomyTypeDesc":54},[494,495,496,338,220,497,498,499,500,412,501,502,395,503,396,504],"vulnerabilities","cvss","prioritizing vulnerabilities with cvss scoring","incident response","teams","framework","cve","severity","vulnerability-management","first","prioritization",{"skillNo":506,"name":507,"nameZh":13,"description":508,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":509,"categories":510,"keywords":512,"publishedAt":235},"01M6AG5WCTT4P2Q8NXWC1Z5B89","post-exploiting-microsoft-graph-with-graphrunner","Runs GraphRunner, a PowerShell post-exploitation toolset built on the Microsoft Graph API, to perform tenant recon, establish persistence (OAuth app injection, inbox rules), escalate privilege via group manipulation, and pillage mailboxes, SharePoint, and Teams data from a foothold Graph token. Use during authorized red-team engagements against Microsoft 365\u002FEntra ID tenants once you hold a Graph token.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fpost-exploiting-microsoft-graph-with-graphrunner\u002FSKILL.md",[511],{"categoryNo":212,"categoryName":213,"taxonomyType":53,"taxonomyTypeDesc":54},[99,513,514,220,515,516,276,498,517,364,518,323,519,394,520,521,522,523,524,525],"graph","post exploiting microsoft graph with graphrunner","identity","entra id","inbox","post-exploitation","powershell","t1098","account-manipulation","api","graphrunner","oauth-abuse","m365",{"skillNo":527,"name":528,"nameZh":13,"description":529,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":530,"categories":531,"keywords":534,"publishedAt":235},"01M6AG5REX81NHNZKKNZN8G51M","performing-yara-rule-development-for-detection","Develops precise YARA and YARA-X rules for malware detection by identifying unique strings, byte sequences, PE header traits, and behavioral indicators in unpacked malware artifacts while minimizing false positives. Use when building detection signatures for threat hunting, classifying malware families, or authoring rules from IOCs such as C2 URLs, mutex names, and encryption constants.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-yara-rule-development-for-detection\u002FSKILL.md",[532,533],{"categoryNo":267,"categoryName":268,"taxonomyType":53,"taxonomyTypeDesc":54},{"categoryNo":212,"categoryName":213,"taxonomyType":53,"taxonomyTypeDesc":54},[535,536,537,538,220,539,540,541,225,255,226,217,456,542,233,543,544,545,546,547],"development","yara","detection","performing yara rule development for detection","threat hunting","artifacts","threat-hunting","mutex","pattern-matching","malware-detection","signature-development","yara-x","indicator-development",{"skillNo":549,"name":550,"nameZh":13,"description":551,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":552,"categories":553,"keywords":555,"publishedAt":235},"01M6AG5MRD5TWDYNPAK792VE0C","performing-wireless-security-assessment-with-kismet","Conduct wireless network security assessments using Kismet to detect rogue access points, hidden SSIDs, weak encryption, and unauthorized clients through passive RF monitoring.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-wireless-security-assessment-with-kismet\u002FSKILL.md",[554],{"categoryNo":212,"categoryName":213,"taxonomyType":53,"taxonomyTypeDesc":54},[338,389,556,557,220,276,558,559,560,217,561,562,563,564,565,566,567,568,569,570],"performing wireless security assessment with kismet","network security","monitoring","network","network-security","ids","wifi","rogue-AP","802.11","Kismet","wifi-assessment","wardriving","wids","wireless-ids","rf-monitoring",{"skillNo":572,"name":573,"nameZh":13,"description":574,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":575,"categories":576,"keywords":578,"publishedAt":235},"01M6AG5H8H6XP2MJY9PNWW0XA3","performing-wireless-network-penetration-test","Execute a wireless network penetration test to assess WiFi security by capturing handshakes, cracking WPA2\u002FWPA3 keys, detecting rogue access points, and testing wireless segmentation using Aircrack-ng and related tools.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-wireless-network-penetration-test\u002FSKILL.md",[577],{"categoryNo":267,"categoryName":268,"taxonomyType":53,"taxonomyTypeDesc":54},[579,559,580,275,338,220,581,582,583,584,585,281,230,282,586,562,587,563,564,565],"test","performing wireless network penetration test","penetration-testing","wireless-pentest","WPA2","WPA3","evil-twin","segmentation","aircrack-ng",{"skillNo":589,"name":590,"nameZh":13,"description":591,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":592,"categories":593,"keywords":595,"publishedAt":235},"01M6AG5DK0C0X49VQTZZTYR2S1","performing-windows-artifact-analysis-with-eric-zimmerman-tools","Performs comprehensive Windows forensic artifact analysis using Eric Zimmerman's open-source EZ Tools suite (KAPE, MFTECmd, PECmd, LECmd, JLECmd, Timeline Explorer) to parse registry hives, prefetch files, event logs, and file system metadata. Use during DFIR investigations that need a timeline of program execution, file access, and persistence built from Windows artifacts.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-windows-artifact-analysis-with-eric-zimmerman-tools\u002FSKILL.md",[594],{"categoryNo":212,"categoryName":213,"taxonomyType":53,"taxonomyTypeDesc":54},[596,230,233,597,598,220,599,600,601,602,603,604,605,606,607,430,608,609,610,611],"windows","performing windows artifact analysis with eric zimmerman tools","file access","registry","logs","artifact-analysis","lecmd","jlecmd","windows-forensics","mftecmd","prefetch","eric-zimmerman","ez-tools","kape","pecmd","timeline-explorer",18]