[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skills:pro6":3,"skills:sce6":50,"skills:creators9":95,"skills:stats":193,"skills:all:stars:96:":196},[4,15,22,29,36,43],{"categoryNo":5,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":8,"categoryNameEn":9,"description":10,"level":11,"skillCount":12,"parentNo":13,"parentName":13,"children":14},"01JBSEEDCAT000000000000030","PROFESSION","适用职业","开发工程师","Software Engineer","从事软件编码、测试与运维的工程师",1,13274,null,[],{"categoryNo":16,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":17,"categoryNameEn":18,"description":19,"level":11,"skillCount":20,"parentNo":13,"parentName":13,"children":21},"01JBSEEDCAT000000000000032","设计师","Designer","视觉、交互与品牌设计人员",7775,[],{"categoryNo":23,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":24,"categoryNameEn":25,"description":26,"level":11,"skillCount":27,"parentNo":13,"parentName":13,"children":28},"01JBSEEDCAT000000000000033","数据分析师","Data Analyst","数据分析、报表与商业智能人员",4988,[],{"categoryNo":30,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":31,"categoryNameEn":32,"description":33,"level":11,"skillCount":34,"parentNo":13,"parentName":13,"children":35},"01JBSEEDCAT000000000000036","内容创作者","Content Creator","作者、编辑与自媒体创作者",3940,[],{"categoryNo":37,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":38,"categoryNameEn":39,"description":40,"level":11,"skillCount":41,"parentNo":13,"parentName":13,"children":42},"01JBSEEDCAT000000000000035","市场营销","Marketer","市场推广、增长与品牌运营人员",3446,[],{"categoryNo":44,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":45,"categoryNameEn":46,"description":47,"level":11,"skillCount":48,"parentNo":13,"parentName":13,"children":49},"01JBSEEDCAT000000000000037","律师与法务","Legal","合同、合规与法律事务人员",3316,[],[51,60,67,74,81,88],{"categoryNo":52,"taxonomyType":53,"taxonomyTypeDesc":54,"categoryName":55,"categoryNameEn":56,"description":57,"level":11,"skillCount":58,"parentNo":13,"parentName":13,"children":59},"01JBSEEDCAT000000000000022","SCENARIO","使用场景","智能体与自动化","Agents & Automation","Skill、MCP、智能体与工作流自动化",39458,[],{"categoryNo":61,"taxonomyType":53,"taxonomyTypeDesc":54,"categoryName":62,"categoryNameEn":63,"description":64,"level":11,"skillCount":65,"parentNo":13,"parentName":13,"children":66},"01JBSEEDCAT000000000000006","软件开发","Software Development","编码、测试、部署等软件研发任务",26531,[],{"categoryNo":68,"taxonomyType":53,"taxonomyTypeDesc":54,"categoryName":69,"categoryNameEn":70,"description":71,"level":11,"skillCount":72,"parentNo":13,"parentName":13,"children":73},"01JBSEEDCAT000000000000014","设计创意","Design & Creative","视觉设计、品牌与多媒体创作",13569,[],{"categoryNo":75,"taxonomyType":53,"taxonomyTypeDesc":54,"categoryName":76,"categoryNameEn":77,"description":78,"level":11,"skillCount":79,"parentNo":13,"parentName":13,"children":80},"01JBSEEDCAT000000000000001","办公效率","Office Productivity","日常办公文档、表格、演示与沟通类任务",6289,[],{"categoryNo":82,"taxonomyType":53,"taxonomyTypeDesc":54,"categoryName":83,"categoryNameEn":84,"description":85,"level":11,"skillCount":86,"parentNo":13,"parentName":13,"children":87},"01JBSEEDCAT000000000000017","内容创作","Content Creation","写作、文案与营销内容生产",6029,[],{"categoryNo":89,"taxonomyType":53,"taxonomyTypeDesc":54,"categoryName":90,"categoryNameEn":91,"description":92,"level":11,"skillCount":93,"parentNo":13,"parentName":13,"children":94},"01JBSEEDCAT000000000000020","研究与学习","Research & Learning","资料检索、知识整理与学习辅导",5531,[],{"records":96,"total":191,"current":11,"size":192},[97,111,120,130,140,150,160,169,179],{"accountNo":98,"login":99,"displayName":100,"avatarUrl":101,"accountType":102,"accountTypeDesc":103,"profileDescription":104,"skillCount":105,"repoCount":106,"professionCount":107,"scenarioCount":108,"totalStars":109,"updatedAt":110},"01M698VYDXZ6JW5WH3CRV650R8","microsoft","Microsoft","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F6154722?v=4","ORGANIZATION","组织","Open source projects and samples from Microsoft",4160,229,11,7,828772,"2026-11-13 04:10:52",{"accountNo":112,"login":113,"displayName":113,"avatarUrl":114,"accountType":102,"accountTypeDesc":103,"profileDescription":115,"skillCount":116,"repoCount":117,"professionCount":108,"scenarioCount":108,"totalStars":118,"updatedAt":119},"01M698P3FSAZ6B4R928ZF19KPT","openclaw","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F252820863?v=4","Your personal, open source AI assistant.",362,32,437711,"2026-11-13 03:02:05",{"accountNo":121,"login":122,"displayName":123,"avatarUrl":124,"accountType":102,"accountTypeDesc":103,"profileDescription":13,"skillCount":125,"repoCount":126,"professionCount":108,"scenarioCount":127,"totalStars":128,"updatedAt":129},"01M6AC29YGCR4S2NTJFV0G8B81","openai","OpenAI","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F14957082?v=4",171,23,6,342695,"2026-11-13 04:03:41",{"accountNo":131,"login":132,"displayName":133,"avatarUrl":134,"accountType":102,"accountTypeDesc":103,"profileDescription":13,"skillCount":135,"repoCount":136,"professionCount":137,"scenarioCount":108,"totalStars":138,"updatedAt":139},"01M6AC83E6K4FDKK7HZ8WNMQKE","apache","The Apache Software Foundation","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F47359?v=4",420,75,8,298176,"2026-11-13 03:14:28",{"accountNo":141,"login":142,"displayName":143,"avatarUrl":144,"accountType":102,"accountTypeDesc":103,"profileDescription":145,"skillCount":146,"repoCount":147,"professionCount":107,"scenarioCount":108,"totalStars":148,"updatedAt":149},"01M698VYEFDM0VJBZDYYJ2T83S","google","Google","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1342004?v=4","Google ❤️ Open Source",535,48,242366,"2026-11-13 04:17:09",{"accountNo":151,"login":152,"displayName":153,"avatarUrl":154,"accountType":102,"accountTypeDesc":103,"profileDescription":155,"skillCount":156,"repoCount":157,"professionCount":107,"scenarioCount":108,"totalStars":158,"updatedAt":159},"01M6AC83DS133TPXFSP1DHNCC6","github","GitHub","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F9919?v=4","How people build software.",940,28,238441,"2026-11-13 03:57:35",{"accountNo":161,"login":162,"displayName":163,"avatarUrl":164,"accountType":102,"accountTypeDesc":103,"profileDescription":13,"skillCount":165,"repoCount":166,"professionCount":107,"scenarioCount":108,"totalStars":167,"updatedAt":168},"01M697XGDPXJAVQ8391V2BCYTE","anthropics","Anthropic","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F76263028?v=4",674,17,231826,"2026-11-13 04:18:26",{"accountNo":170,"login":171,"displayName":172,"avatarUrl":173,"accountType":102,"accountTypeDesc":103,"profileDescription":13,"skillCount":174,"repoCount":175,"professionCount":176,"scenarioCount":108,"totalStars":177,"updatedAt":178},"01M6AC83EPDGBFN19MWYRREJD0","Significant-Gravitas","AutoGPT","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F130738209?v=4",86,2,10,188014,"2026-11-13 02:38:59",{"accountNo":180,"login":181,"displayName":182,"avatarUrl":183,"accountType":184,"accountTypeDesc":185,"profileDescription":186,"skillCount":187,"repoCount":188,"professionCount":127,"scenarioCount":108,"totalStars":189,"updatedAt":190},"01M6DJCCDDG53MTYYRTXAXFG17","garrytan","Garry Tan","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F19957?v=4","USER","个人作者","Writes software, dreams. ",324,3,174614,"2026-11-13 04:05:07",1910,9,{"skillCount":194,"professionCount":107,"scenarioCount":108,"creatorCount":195},196606,1912,{"records":197,"total":194,"current":594,"size":595},[198,237,256,281,295,322,341,366,387,412,435,450,469,492,515,538,559,578],{"skillNo":199,"name":200,"nameZh":13,"description":201,"descriptionZh":13,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":13,"sourceHtmlUrl":210,"categories":211,"keywords":215,"publishedAt":236},"01M6AFK88BK3ZC2PN2S0200AKJ","performing-active-directory-penetration-test","Conduct a focused Active Directory penetration test using BloodHound, Impacket, Certipy, Rubeus, and NetExec to enumerate domain objects, discover attack paths, exploit Kerberos weaknesses, escalate privileges via ADCS\u002FDCSync, and demonstrate domain compromise. Use when running an authorized AD pentest from a standard domain user foothold toward Domain Admin or Enterprise Admin.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-active-directory-penetration-test\u002FSKILL.md",[212],{"categoryNo":213,"categoryName":214,"taxonomyType":53,"taxonomyTypeDesc":54},"01JBSEEDCAT000000000000008","测试与质量",[216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235],"directory","test","performing active directory penetration test","testing","cybersecurity","admin","active-directory","certipy","privilege-escalation","Enterprise","escalation","dcsync","Impacket","bloodhound","kerberos","t1078","t1059","domain-compromise","adcs","netexec","2026-11-10 10:12:30",{"skillNo":238,"name":239,"nameZh":13,"description":240,"descriptionZh":13,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":13,"sourceHtmlUrl":241,"categories":242,"keywords":243,"publishedAt":236},"01M6AFK4MRXH7G8KA2TDZ3DZPM","performing-active-directory-forest-trust-attack","Enumerate and audit Active Directory forest trust relationships using Impacket for SID filtering analysis, trust key extraction, cross-forest SID history abuse detection, and inter-realm Kerberos ticket assessment. Use when red-teaming multi-forest AD environments or auditing forest trusts for cross-forest privilege escalation and trust ticket forgery exposure.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-active-directory-forest-trust-attack\u002FSKILL.md",[],[216,244,220,245,246,247,248,222,226,228,230,249,250,251,231,232,252,253,254,255],"performing active directory forest trust attack","assessment","extraction","audit","red-team","detection","enumeration","t1558","analysis","forest-trust","SID-filtering","trust-enumeration",{"skillNo":257,"name":258,"nameZh":13,"description":259,"descriptionZh":13,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":13,"sourceHtmlUrl":260,"categories":261,"keywords":265,"publishedAt":236},"01M6AFK0RGA1CDNFPH196GMJ82","performing-active-directory-compromise-investigation","Investigate Active Directory compromise by analyzing authentication logs, replication metadata, Group Policy changes, and Kerberos ticket anomalies to identify attacker persistence and lateral movement paths.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-active-directory-compromise-investigation\u002FSKILL.md",[262],{"categoryNo":263,"categoryName":264,"taxonomyType":53,"taxonomyTypeDesc":54},"01JBSEEDCAT000000000000010","后端与接口",[216,266,267,268,220,269,270,271,272,273,222,274,275,276,277,278,231,279,252,280],"investigation","performing active directory compromise investigation","policy","identity","authentication","logs","monitoring","server","dfir","analyzing","network","golden-ticket","lateral-movement","t1490","compromise-investigation",{"skillNo":282,"name":283,"nameZh":13,"description":284,"descriptionZh":13,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":13,"sourceHtmlUrl":285,"categories":286,"keywords":287,"publishedAt":236},"01M6AFJX7VE0TDP6CJFJ1MDR3R","performing-active-directory-bloodhound-analysis","Use BloodHound and SharpHound (or AzureHound) to enumerate Active Directory relationships and graph attack paths from a compromised user to Domain Admin. Use when performing AD red-team reconnaissance, mapping privilege-escalation chains from group memberships, ACLs, and trusts, or auditing AD for exploitable misconfigurations.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-active-directory-bloodhound-analysis\u002FSKILL.md",[],[216,229,252,288,268,220,270,221,289,248,222,224,226,231,232,290,291,292,293,294],"performing active directory bloodhound analysis","graph","sharphound","azurehound","attack-path","ad-enumeration","graph-theory",{"skillNo":296,"name":297,"nameZh":13,"description":298,"descriptionZh":13,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":13,"sourceHtmlUrl":299,"categories":300,"keywords":305,"publishedAt":236},"01M6AFJSK8GEAW5HTYNEFRZ5MN","performing-access-review-and-certification","Designs and runs access review and certification campaigns-scoping, reviewer selection, risk-based prioritization, micro-certification, and remediation tracking-to verify user access matches job roles for SOX, HIPAA, and PCI DSS compliance. Use when planning or executing periodic access recertification or preparing evidence for an IAM compliance audit.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-access-review-and-certification\u002FSKILL.md",[301,304],{"categoryNo":302,"categoryName":303,"taxonomyType":53,"taxonomyTypeDesc":54},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":44,"categoryName":45,"taxonomyType":6,"taxonomyTypeDesc":7},[306,307,308,220,269,309,310,311,247,312,313,314,315,316,317,231,318,319,320,321],"review","certification","performing access review and certification","governance","pr","planning","micro","compliance","hipaa","access-control","iam","remediation","risk","t1098","risk-based","access-review",{"skillNo":323,"name":324,"nameZh":13,"description":325,"descriptionZh":13,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":13,"sourceHtmlUrl":326,"categories":327,"keywords":330,"publishedAt":236},"01M6AFJNE8VSJVHE4X2FHYFSP9","performing-access-recertification-with-saviynt","Configure and execute access recertification campaigns in Saviynt Enterprise Identity Cloud to validate user entitlements, revoke excessive access, and maintain compliance with SOX, SOC 2, and HIPAA. Use when launching or managing certification campaigns for users\u002Fentitlements, remediating access review findings, or documenting identity governance evidence for an audit.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-access-recertification-with-saviynt\u002FSKILL.md",[328,329],{"categoryNo":302,"categoryName":303,"taxonomyType":53,"taxonomyTypeDesc":54},{"categoryNo":44,"categoryName":45,"taxonomyType":6,"taxonomyTypeDesc":7},[331,306,220,269,310,332,247,313,333,314,225,334,335,336,231,337,319,338,339,340],"performing access recertification with saviynt","development","soc","identity-governance","IGA","defense","initial-access","saviynt","access-recertification","certification-campaign",{"skillNo":342,"name":343,"nameZh":13,"description":344,"descriptionZh":13,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":13,"sourceHtmlUrl":345,"categories":346,"keywords":348,"publishedAt":236},"01M6AFJHXJNQ0P0AHTBEWE6KMK","parsing-artifacts-with-eric-zimmerman-tools","Parse Windows forensic artifacts—$MFT\u002F$J (MFTECmd), Prefetch (PECmd), registry hives (RECmd), shellbags, and Amcache—into normalized CSV\u002FJSON with Eric Zimmerman's EZ Tools, then load results into Timeline Explorer for analysis. Use during DFIR\u002Fincident-response investigations, after triage collection (e.g. with KAPE), to establish program execution, file\u002Ffolder access, and persistence evidence from acquired forensic images.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fparsing-artifacts-with-eric-zimmerman-tools\u002FSKILL.md",[347],{"categoryNo":302,"categoryName":303,"taxonomyType":53,"taxonomyTypeDesc":54},[349,350,351,220,352,353,354,274,355,356,357,358,359,360,361,362,363,252,364,365],"artifacts","Tools","parsing artifacts with eric zimmerman tools","windows","registry","file","mft","mftecmd","prefetch","amcache","eric-zimmerman","digital-forensics","shellbags","execution","collection","registry-forensics","artifact-parsing",{"skillNo":367,"name":368,"nameZh":13,"description":369,"descriptionZh":13,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":13,"sourceHtmlUrl":370,"categories":371,"keywords":373,"publishedAt":236},"01M6AFJE9GS1AQP8BD6773ME2M","orchestrating-llm-attacks-with-pyrit","Build automated multi-turn adversarial attacks against conversational LLM targets using Microsoft PyRIT's RedTeamingOrchestrator, CrescendoOrchestrator (gradual escalation), and TreeOfAttacksWithPruningOrchestrator (adaptive branching), with scorer feedback loops and persisted conversation memory. Use when single-shot LLM scanning is insufficient and you need multi-turn, scorer-driven AI red-team campaigns against a chatbot or agent.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Forchestrating-llm-attacks-with-pyrit\u002FSKILL.md",[372],{"categoryNo":302,"categoryName":303,"taxonomyType":53,"taxonomyTypeDesc":54},[374,375,376,220,99,248,377,378,226,379,380,381,382,383,384,385,386],"orchestrating llm attacks with pyrit","security","memory","conversation memory","ai-security","llm-red-teaming","jailbreak","prompt-injection","mitre-atlas","injection","pyrit","multi-turn-attacks","crescendo",{"skillNo":388,"name":389,"nameZh":13,"description":390,"descriptionZh":13,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":13,"sourceHtmlUrl":391,"categories":392,"keywords":395,"publishedAt":236},"01M6AFJAMW0XRZWJMRB6DQ1FCH","operationalizing-misp-threat-feeds","Stand up MISP, enable and cache curated threat feeds (CIRCL, abuse.ch, Feodo Tracker), apply warninglists to suppress false positives, query indicators with PyMISP, and export attributes as auto-generated Suricata\u002FSigma\u002FWazuh detection rules. Use when maturing a MISP instance to actively drive detection, curating threat feeds with quality controls, or automating IOC-to-detection pipelines for the SIEM\u002FIDS.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Foperationalizing-misp-threat-feeds\u002FSKILL.md",[393,394],{"categoryNo":263,"categoryName":264,"taxonomyType":53,"taxonomyTypeDesc":54},{"categoryNo":302,"categoryName":303,"taxonomyType":53,"taxonomyTypeDesc":54},[396,397,398,220,399,400,401,402,403,404,405,406,407,408,249,409,410,411],"MISP","feeds","operationalizing misp threat feeds","siem","cache","engineering","threat-intelligence","ioc","detection-engineering","sigma","Wazuh","ids","suricata","indicators","pymisp","threat-feeds",{"skillNo":413,"name":414,"nameZh":13,"description":415,"descriptionZh":13,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":13,"sourceHtmlUrl":416,"categories":417,"keywords":419,"publishedAt":236},"01M6AFJ7BGEDEHCWVN69XBERDC","operating-sliver-c2","Stand up a Sliver C2 server and mTLS listeners, generate cross-platform implants and beacons, and run post-exploitation, pivoting, and BOF\u002F.NET tooling via the Armory for adversary emulation. Use during authorized, rules-of-engagement-bound red-team engagements that need a full open-source C2 lifecycle spanning server setup, implant generation, and post-exploitation tradecraft.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Foperating-sliver-c2\u002FSKILL.md",[418],{"categoryNo":302,"categoryName":303,"taxonomyType":53,"taxonomyTypeDesc":54},[420,421,422,220,423,424,425,273,248,426,427,428,429,430,431,432,433,434],"c2","sliver","operating sliver c2","setup","generate","run","post-exploitation","command-and-control","pivoting","adversary-emulation","exploitation","rules-of-engagement","lifecycle","mtls","implant",{"skillNo":436,"name":437,"nameZh":13,"description":438,"descriptionZh":13,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":13,"sourceHtmlUrl":439,"categories":440,"keywords":442,"publishedAt":236},"01M6AFJ3RPMAKNAAX429HVR5PT","operating-havoc-c2","Deploy a Havoc C2 team server with Yaotl malleable profiles, generate evasive Demon agents using indirect syscalls and sleep obfuscation, and run post-exploitation and pivoting operations. Use during authorized, rules-of-engagement-bound red-team engagements for adversary emulation requiring a full C2 lifecycle (server setup, evasive implant generation, tasking, and lateral pivoting).","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Foperating-havoc-c2\u002FSKILL.md",[441],{"categoryNo":302,"categoryName":303,"taxonomyType":53,"taxonomyTypeDesc":54},[420,443,220,444,423,424,425,273,248,426,427,429,445,430,446,431,432,447,448,449],"operating havoc c2","deploy","demon-agent","obfuscation","havoc","evasion","sleep-obfuscation",{"skillNo":451,"name":452,"nameZh":13,"description":453,"descriptionZh":13,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":13,"sourceHtmlUrl":454,"categories":455,"keywords":458,"publishedAt":236},"01M6AFJ03R15AQMF1QWVKA08JG","moving-laterally-with-netexec","Use NetExec (nxc) to validate credentials, enumerate SMB shares\u002Fusers\u002Fpolicy, password-spray safely across lockout thresholds, execute commands, and dump SAM\u002FLSA\u002FNTDS credentials across SMB, WinRM, LDAP, MSSQL, SSH, and other protocol modules. Use during authorized internal penetration tests to find lateral-movement paths after obtaining credentials or hashes, or to conduct controlled password spraying and post-exploitation on in-scope hosts.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fmoving-laterally-with-netexec\u002FSKILL.md",[456,457],{"categoryNo":213,"categoryName":214,"taxonomyType":53,"taxonomyTypeDesc":54},{"categoryNo":302,"categoryName":303,"taxonomyType":53,"taxonomyTypeDesc":54},[459,219,216,268,220,460,461,462,426,222,463,464,278,430,465,466,235,467,468],"moving laterally with netexec","validate","protocol","credential-access","ldap","penetration-testing","smb","ntds","password-spraying","winrm",{"skillNo":470,"name":471,"nameZh":13,"description":472,"descriptionZh":13,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":13,"sourceHtmlUrl":473,"categories":474,"keywords":477,"publishedAt":236},"01M6AFHWW5Q08TJ70N8EPASB1M","monitoring-scada-modbus-traffic-anomalies","Monitors Modbus TCP traffic on SCADA and ICS networks to detect anomalous function code usage, unauthorized register writes, and suspicious communication patterns. The analyst uses deep packet inspection with pymodbus, Scapy, and Zeek to baseline normal PLC\u002FRTU communication behavior, then applies statistical and rule-based anomaly detection to identify reconnaissance, parameter manipulation, and denial-of-service attacks targeting Modbus devices on port 502. Activates for requests involving Modbus traffic analysis, SCADA network monitoring, ICS anomaly detection, PLC security monitoring, or OT network threat detection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fmonitoring-scada-modbus-traffic-anomalies\u002FSKILL.md",[475,476],{"categoryNo":302,"categoryName":303,"taxonomyType":53,"taxonomyTypeDesc":54},{"categoryNo":5,"categoryName":8,"taxonomyType":6,"taxonomyTypeDesc":7},[272,478,479,480,481,375,220,310,482,483,484,276,485,486,487,488,489,252,490,491],"scada","modbus","monitoring scada modbus traffic anomalies","suspicious","code","communication","tcp","scapy","Zeek","devices","ot-monitoring","deep-packet-inspection","Modbus-TCP","ICS-security",{"skillNo":493,"name":494,"nameZh":13,"description":495,"descriptionZh":13,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":13,"sourceHtmlUrl":496,"categories":497,"keywords":499,"publishedAt":236},"01M6AFHSBCBNASJ591X9D3F041","monitoring-darkweb-sources","Monitors dark web forums, marketplaces, paste sites, and ransomware leak sites for mentions of organizational assets, leaked credentials, threatened attacks, and threat actor communications to provide early warning intelligence. Use when establishing dark web monitoring coverage, investigating specific data breach claims, or enriching incident investigations with dark web context. Activates for requests involving dark web OSINT, leak site monitoring, credential exposure, Recorded Future dark web, or Tor hidden service intelligence.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fmonitoring-darkweb-sources\u002FSKILL.md",[498],{"categoryNo":302,"categoryName":303,"taxonomyType":53,"taxonomyTypeDesc":54},[272,500,220,501,502,332,503,504,402,505,506,507,508,509,510,511,337,512,513,514],"monitoring darkweb sources","customer","web","search","osint","cti","data","ransomware","tor","Recorded-Future","spiderfoot","reconnaissance","dark-web","credential-monitoring","ransomware-leaks",{"skillNo":516,"name":517,"nameZh":13,"description":518,"descriptionZh":13,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":13,"sourceHtmlUrl":519,"categories":520,"keywords":525,"publishedAt":236},"01M6AFHNMHVW3TNDDKM9HJYGGQ","modeling-threats-with-opencti","Deploy OpenCTI (Filigran) via Docker Compose and use the pycti Python client to model threat actors, intrusion sets, campaigns, and indicators as a STIX 2.1 knowledge graph with relationships (uses, attributed-to, targets). Use when building a centralized threat-intel knowledge base, correlating IOCs from multiple feeds into one adversary graph, or producing STIX bundles for detection engineering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fmodeling-threats-with-opencti\u002FSKILL.md",[521,524],{"categoryNo":522,"categoryName":523,"taxonomyType":53,"taxonomyTypeDesc":54},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":302,"categoryName":303,"taxonomyType":53,"taxonomyTypeDesc":54},[526,527,528,529,220,444,530,289,531,532,402,505,533,397,534,249,409,535,536,537],"opencti","modeling threats with opencti","python","docker","docker compose","knowledge graph","mitre-attack","stix","threat-modeling","stix2","pycti","knowledge-graph",{"skillNo":539,"name":540,"nameZh":13,"description":541,"descriptionZh":13,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":13,"sourceHtmlUrl":542,"categories":543,"keywords":546,"publishedAt":236},"01M6AFHHNFBMFTP08TK6FQE5DZ","migrating-to-post-quantum-cryptography","Build a cryptographic inventory\u002FCBOM with OpenSSL 3.5+, deploy hybrid post-quantum key exchange (X25519MLKEM768) on TLS\u002FVPN\u002FSSH endpoints, generate ML-KEM\u002FML-DSA keys and PQC\u002Fhybrid certificates, and prioritize migration by harvest-now-decrypt-later (HNDL) exposure per NIST SP 1800-38. Use when inventorying enterprise cryptography for quantum-readiness, enabling hybrid PQC key exchange, or issuing and verifying PQC\u002Fhybrid certificates.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fmigrating-to-post-quantum-cryptography\u002FSKILL.md",[544,545],{"categoryNo":522,"categoryName":523,"taxonomyType":53,"taxonomyTypeDesc":54},{"categoryNo":302,"categoryName":303,"taxonomyType":53,"taxonomyTypeDesc":54},[547,548,220,444,549,310,424,225,550,551,552,553,554,555,556,557,558],"cryptography","migrating to post quantum cryptography","ml","NIST","openssl","tls","post-quantum","ml-kem","ml-dsa","crypto-agility","cbom","quantum-readiness",{"skillNo":560,"name":561,"nameZh":13,"description":562,"descriptionZh":13,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":13,"sourceHtmlUrl":563,"categories":564,"keywords":566,"publishedAt":236},"01M6AFHENTGMYF7WX7S3VEHBJ1","mapping-mitre-attack-techniques","Maps observed adversary behaviors, security alerts, and detection rules to MITRE ATT&CK techniques and sub-techniques to quantify detection coverage and guide control prioritization. Use when building an ATT&CK-based coverage heatmap, tagging SIEM alerts with technique IDs, aligning security controls to adversary playbooks, or reporting threat exposure to executives. Activates for requests involving ATT&CK Navigator, Sigma rules, MITRE D3FEND, or coverage gap analysis.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fmapping-mitre-attack-techniques\u002FSKILL.md",[565],{"categoryNo":302,"categoryName":303,"taxonomyType":53,"taxonomyTypeDesc":54},[567,568,375,220,399,569,570,571,402,572,573,404,405,550,407,574,575,576,252,577],"mitre attack","mapping mitre attack techniques","security alerts","reporting","navigator","MITRE-ATT&CK","NIST-CSF","ATT&CK","d3fend","TTP","ATT&CK-Navigator",{"skillNo":579,"name":580,"nameZh":13,"description":581,"descriptionZh":13,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":13,"sourceHtmlUrl":582,"categories":583,"keywords":585,"publishedAt":236},"01M6AFHAJ6SFRTR289TFBKYBBC","mapping-attack-paths-with-bloodhound-ce","Collect Active Directory data with SharpHound and Entra ID data with AzureHound, ingest into BloodHound Community Edition, and analyze on-prem, cloud, and hybrid attack paths using built-in queries and custom Cypher. Use during authorized red-team or penetration-test engagements to map privilege-escalation chains toward domain\u002Ftenant compromise.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fmapping-attack-paths-with-bloodhound-ce\u002FSKILL.md",[584],{"categoryNo":302,"categoryName":303,"taxonomyType":53,"taxonomyTypeDesc":54},[229,586,216,220,217,269,587,588,248,222,224,506,589,590,591,226,592,290,291,593],"mapping attack paths with bloodhound ce","entra id","collect","entra-id","attack-paths","hybrid-identity","bloodhound-ce","cypher",96,18]