[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ADW6R49S0YE4423EBG4PY8":3,"skill-same:01M6ADW6R49S0YE4423EBG4PY8":157},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":34,"publishedAt":55,"linkOnly":56,"markdownContent":57,"markdownBody":58,"frontMatter":59,"refName":72,"commitSha":73,"skillDirectory":74,"forksCount":75,"repositoryHtmlUrl":76,"repositoryHomepageUrl":77,"ownerHtmlUrl":78,"ownerBlogUrl":79,"ownerDescription":80,"updatedAt":81,"install":82,"resources":95},"01M6ADW6R49S0YE4423EBG4PY8","auditing-foundry-smart-contract-security",null,"Pre-deployment security audit of Solidity smart contracts in a Foundry project. Combines static analysis (Slither, Aderyn), symbolic execution (Mythril), and property-based testing (forge fuzz + invariant tests with handlers) to catch reentrancy, access-control, oracle\u002Fprice manipulation, and arithmetic bugs BEFORE deploying to an EVM chain. Also enforces key hygiene (no plaintext private keys, encrypted cast keystore) and a secure deploy workflow. Use when writing, reviewing, testing, or deploying Solidity\u002FFoundry contracts, building a dApp, or working with forge\u002Fcast\u002Fanvil, MetaMask, or Web3\u002FDeFi code.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fauditing-foundry-smart-contract-security\u002FSKILL.md",[18,23,26,29],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":30,"categoryName":31,"taxonomyType":32,"taxonomyTypeDesc":33},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54],"auditing foundry smart contract security","security","foundry","ethereum","invariant-testing","web3","reentrancy","aderyn","forge","analyzing","smart-contract","solidity","testing","audit","code","secure","workflow","cybersecurity","oracle","writing","2026-11-10 10:12:30",false,"---\nname: auditing-foundry-smart-contract-security\ndescription: >-\n  Pre-deployment security audit of Solidity smart contracts in a Foundry project.\n  Combines static analysis (Slither, Aderyn), symbolic execution (Mythril), and\n  property-based testing (forge fuzz + invariant tests with handlers) to catch\n  reentrancy, access-control, oracle\u002Fprice manipulation, and arithmetic bugs\n  BEFORE deploying to an EVM chain. Also enforces key hygiene (no plaintext\n  private keys, encrypted cast keystore) and a secure deploy workflow. Use when\n  writing, reviewing, testing, or deploying Solidity\u002FFoundry contracts, building\n  a dApp, or working with forge\u002Fcast\u002Fanvil, MetaMask, or Web3\u002FDeFi code.\ndomain: cybersecurity\nsubdomain: blockchain-security\ntags:\n  - solidity\n  - foundry\n  - forge\n  - smart-contract\n  - slither\n  - aderyn\n  - mythril\n  - reentrancy\n  - defi\n  - web3\n  - invariant-testing\n  - audit\nversion: \"1.0\"\nauthor: devredious\nlicense: Apache-2.0\nbased_on: mukul975\u002Fanalyzing-ethereum-smart-contract-vulnerabilities\nswc_registry: https:\u002F\u002Fswcregistry.io\u002F\nmitre_attack:\n  - T1190\n  - T1059\n---\n\n# Auditing Foundry Smart Contract Security\n\n## Overview\n\nDeployed smart contracts are **immutable** and custody **real funds**, so a bug\nshipped to mainnet cannot be patched — it can only be exploited. Most catastrophic\nDeFi losses come from a small set of recurring classes: reentrancy, broken access\ncontrol, oracle\u002Fprice manipulation, and unchecked arithmetic or external calls.\n\nThis skill runs a **defense-in-depth, pre-deployment audit** of a Foundry project,\nlayering four independent techniques that each catch what the others miss:\n\n1. **Static analysis** — `slither` (90+ detectors) and `aderyn` (Cyfrin, Rust) scan\n   the AST\u002FIR in seconds for known anti-patterns.\n2. **Symbolic execution** — `mythril` (optional, slow) explores execution paths and\n   SMT-solves for deep arithmetic\u002Freentrancy bugs.\n3. **Property-based testing** — `forge test` with **fuzzing** (`testFuzz_*`) and\n   **invariant tests** (`invariant_*` + handler contracts with ghost variables)\n   proves protocol-level properties hold across millions of random sequences.\n4. **Manual review + key hygiene** — a structured checklist (see\n   `references\u002Fvulnerability-checklist.md`) and a secrets\u002Fkeystore audit so no\n   private key ever lives in plaintext and deployment goes through an encrypted\n   `cast` keystore (see `references\u002Fsecure-deployment-and-keys.md`).\n\nThe skill is **dev-side and pre-deployment** — it is run by the engineer building\nthe contract, not by a SOC after an incident. Findings gate the deploy: any\nhigh\u002Fcritical static finding, failing test, leaked key, or low coverage = **FAIL**.\n\n## When to Use\n\n- Before deploying any Solidity contract to a testnet or mainnet EVM chain.\n- When writing or reviewing a Foundry project (`foundry.toml`, `src\u002F`, `test\u002F`, `script\u002F`).\n- When a contract handles value: tokens (ERC-20\u002F721\u002F1155), vaults, staking, AMMs, bridges, governance.\n- When adding fuzz or invariant tests, or when coverage of value-moving functions is unknown.\n- When wiring deployment scripts — to verify keys are in an encrypted keystore, not `.env` plaintext.\n- When integrating a price oracle, external call, `delegatecall`, or upgradeable proxy.\n- When triaging a Slither\u002FAderyn report and needing to separate real bugs from false positives.\n\n## Prerequisites\n\n- **Foundry** installed (`forge`, `cast`, `anvil`): `curl -L https:\u002F\u002Ffoundry.paradigm.xyz | bash && foundryup`\n- **Slither** + solc: `pip install slither-analyzer` and `solc-select install \u003Cver> && solc-select use \u003Cver>`\n- **Aderyn** (recommended): `cargo install aderyn` (or `npm i -g @cyfrin\u002Faderyn`)\n- **Mythril** (optional, slow symbolic exec): `pip install mythril`\n- **gitleaks** (key-leak scan): see the companion `implementing-secret-scanning-with-gitleaks` skill\n- A Foundry project that **compiles** (`forge build` succeeds) — analyzers need build artifacts.\n- Solidity ^0.8.x is assumed (built-in overflow checks); pre-0.8 contracts need extra SafeMath review.\n\n> Install the Python tools in a virtualenv (recommended on externally-managed distros). Never run\n> analysis against untrusted contract source on a machine with funded wallets unlocked.\n\n## Steps\n\n### Step 1: Build and sanity-check the project\n\n```bash\nforge build                    # analyzers require fresh artifacts\nforge fmt --check              # style gate (optional)\ncat foundry.toml               # note solc version, optimizer, remappings, evm_version\n```\n\n### Step 2: Static analysis (fast, run every time)\n\n```bash\n# Slither — full project (uses foundry.toml + remappings automatically)\nslither . --json slither-report.json\n\n# Aderyn — Cyfrin Rust analyzer, complementary detectors\naderyn . -o aderyn-report.json\n```\n\nOr run the bundled orchestrator that runs both, deduplicates, and gates the result:\n\n```bash\npython3 scripts\u002Fagent.py --project . --output audit-report.json\n```\n\n### Step 3: Symbolic execution on critical contracts (optional, slow)\n\n```bash\n# Only on the highest-value contract(s) — Mythril is path-explosive\nmyth analyze src\u002FVault.sol --solc-json mythril.config.json --execution-timeout 300 -o json\n# or: python3 scripts\u002Fagent.py --project . --mythril src\u002FVault.sol\n```\n\n### Step 4: Property-based testing — fuzz + invariants\n\n```bash\nforge test -vvv                                  # unit + fuzz tests\nforge coverage --report summary                  # coverage of value-moving code\nforge test --match-test invariant_ -vvv          # invariant suite (handler-based)\n```\n\nEvery value-moving contract should have **invariant tests with a handler** (bounded\ninputs, ghost variables, `targetContract(handler)`) — not just unit tests. See\n`references\u002Fapi-reference.md` for the handler pattern, and write a\n`test_RevertWhen_*` (with `vm.expectRevert`) for each access-control guard.\n\n### Step 5: Manual review against the checklist\n\nWalk `references\u002Fvulnerability-checklist.md` for every contract: reentrancy\n(checks-effects-interactions \u002F `nonReentrant`), access control, oracle manipulation,\n`delegatecall`\u002Fproxy storage layout, unchecked return values, `tx.origin`, weak\nrandomness, DoS, front-running\u002FMEV, and ERC-specific pitfalls (approve race,\nfee-on-transfer, rebasing).\n\n### Step 6: Key hygiene & secure deploy\n\n```bash\ngitleaks detect --no-banner            # no private keys \u002F mnemonics \u002F .env committed\ngit ls-files | grep -E '\\.env$|keystore' && echo \"WARN: secrets tracked by git\"\n\n# Import the deploy key ONCE into an encrypted keystore — never a plaintext PRIVATE_KEY env\ncast wallet import deployer --interactive\n\n# Deploy via the keystore account (testnet first), simulate before --broadcast\nforge script script\u002FDeploy.s.sol --account deployer --rpc-url \u003Ctestnet> --broadcast --verify\n```\n\nSee `references\u002Fsecure-deployment-and-keys.md` for the full hardening rules\n(MetaMask hygiene, hardware wallet for mainnet, RPC trust, post-deploy verification).\n\n### Step 7: Triage and report\n\nCombine Slither + Aderyn + Mythril + test results, deduplicate by (file, line),\ndrop confirmed false positives, rank by exploitability × financial impact, and map\neach to its SWC id. The orchestrator emits `audit-report.json` with a PASS\u002FFAIL gate.\n\n## Expected Output\n\nA JSON audit report listing findings with **SWC identifiers**, severity, tool source,\naffected contract\u002Ffunction\u002Fline, and remediation; plus the test\u002Fcoverage summary and a\nsingle **PASS \u002F FAIL** deploy gate. FAIL on any high\u002Fcritical static finding, failing\ntest, leaked secret, or coverage below the configured threshold on value-moving code.\n","# Auditing Foundry Smart Contract Security\n\n## Overview\n\nDeployed smart contracts are **immutable** and custody **real funds**, so a bug\nshipped to mainnet cannot be patched — it can only be exploited. Most catastrophic\nDeFi losses come from a small set of recurring classes: reentrancy, broken access\ncontrol, oracle\u002Fprice manipulation, and unchecked arithmetic or external calls.\n\nThis skill runs a **defense-in-depth, pre-deployment audit** of a Foundry project,\nlayering four independent techniques that each catch what the others miss:\n\n1. **Static analysis** — `slither` (90+ detectors) and `aderyn` (Cyfrin, Rust) scan\n   the AST\u002FIR in seconds for known anti-patterns.\n2. **Symbolic execution** — `mythril` (optional, slow) explores execution paths and\n   SMT-solves for deep arithmetic\u002Freentrancy bugs.\n3. **Property-based testing** — `forge test` with **fuzzing** (`testFuzz_*`) and\n   **invariant tests** (`invariant_*` + handler contracts with ghost variables)\n   proves protocol-level properties hold across millions of random sequences.\n4. **Manual review + key hygiene** — a structured checklist (see\n   `references\u002Fvulnerability-checklist.md`) and a secrets\u002Fkeystore audit so no\n   private key ever lives in plaintext and deployment goes through an encrypted\n   `cast` keystore (see `references\u002Fsecure-deployment-and-keys.md`).\n\nThe skill is **dev-side and pre-deployment** — it is run by the engineer building\nthe contract, not by a SOC after an incident. Findings gate the deploy: any\nhigh\u002Fcritical static finding, failing test, leaked key, or low coverage = **FAIL**.\n\n## When to Use\n\n- Before deploying any Solidity contract to a testnet or mainnet EVM chain.\n- When writing or reviewing a Foundry project (`foundry.toml`, `src\u002F`, `test\u002F`, `script\u002F`).\n- When a contract handles value: tokens (ERC-20\u002F721\u002F1155), vaults, staking, AMMs, bridges, governance.\n- When adding fuzz or invariant tests, or when coverage of value-moving functions is unknown.\n- When wiring deployment scripts — to verify keys are in an encrypted keystore, not `.env` plaintext.\n- When integrating a price oracle, external call, `delegatecall`, or upgradeable proxy.\n- When triaging a Slither\u002FAderyn report and needing to separate real bugs from false positives.\n\n## Prerequisites\n\n- **Foundry** installed (`forge`, `cast`, `anvil`): `curl -L https:\u002F\u002Ffoundry.paradigm.xyz | bash && foundryup`\n- **Slither** + solc: `pip install slither-analyzer` and `solc-select install \u003Cver> && solc-select use \u003Cver>`\n- **Aderyn** (recommended): `cargo install aderyn` (or `npm i -g @cyfrin\u002Faderyn`)\n- **Mythril** (optional, slow symbolic exec): `pip install mythril`\n- **gitleaks** (key-leak scan): see the companion `implementing-secret-scanning-with-gitleaks` skill\n- A Foundry project that **compiles** (`forge build` succeeds) — analyzers need build artifacts.\n- Solidity ^0.8.x is assumed (built-in overflow checks); pre-0.8 contracts need extra SafeMath review.\n\n> Install the Python tools in a virtualenv (recommended on externally-managed distros). Never run\n> analysis against untrusted contract source on a machine with funded wallets unlocked.\n\n## Steps\n\n### Step 1: Build and sanity-check the project\n\n```bash\nforge build                    # analyzers require fresh artifacts\nforge fmt --check              # style gate (optional)\ncat foundry.toml               # note solc version, optimizer, remappings, evm_version\n```\n\n### Step 2: Static analysis (fast, run every time)\n\n```bash\n# Slither — full project (uses foundry.toml + remappings automatically)\nslither . --json slither-report.json\n\n# Aderyn — Cyfrin Rust analyzer, complementary detectors\naderyn . -o aderyn-report.json\n```\n\nOr run the bundled orchestrator that runs both, deduplicates, and gates the result:\n\n```bash\npython3 scripts\u002Fagent.py --project . --output audit-report.json\n```\n\n### Step 3: Symbolic execution on critical contracts (optional, slow)\n\n```bash\n# Only on the highest-value contract(s) — Mythril is path-explosive\nmyth analyze src\u002FVault.sol --solc-json mythril.config.json --execution-timeout 300 -o json\n# or: python3 scripts\u002Fagent.py --project . --mythril src\u002FVault.sol\n```\n\n### Step 4: Property-based testing — fuzz + invariants\n\n```bash\nforge test -vvv                                  # unit + fuzz tests\nforge coverage --report summary                  # coverage of value-moving code\nforge test --match-test invariant_ -vvv          # invariant suite (handler-based)\n```\n\nEvery value-moving contract should have **invariant tests with a handler** (bounded\ninputs, ghost variables, `targetContract(handler)`) — not just unit tests. See\n`references\u002Fapi-reference.md` for the handler pattern, and write a\n`test_RevertWhen_*` (with `vm.expectRevert`) for each access-control guard.\n\n### Step 5: Manual review against the checklist\n\nWalk `references\u002Fvulnerability-checklist.md` for every contract: reentrancy\n(checks-effects-interactions \u002F `nonReentrant`), access control, oracle manipulation,\n`delegatecall`\u002Fproxy storage layout, unchecked return values, `tx.origin`, weak\nrandomness, DoS, front-running\u002FMEV, and ERC-specific pitfalls (approve race,\nfee-on-transfer, rebasing).\n\n### Step 6: Key hygiene & secure deploy\n\n```bash\ngitleaks detect --no-banner            # no private keys \u002F mnemonics \u002F .env committed\ngit ls-files | grep -E '\\.env$|keystore' && echo \"WARN: secrets tracked by git\"\n\n# Import the deploy key ONCE into an encrypted keystore — never a plaintext PRIVATE_KEY env\ncast wallet import deployer --interactive\n\n# Deploy via the keystore account (testnet first), simulate before --broadcast\nforge script script\u002FDeploy.s.sol --account deployer --rpc-url \u003Ctestnet> --broadcast --verify\n```\n\nSee `references\u002Fsecure-deployment-and-keys.md` for the full hardening rules\n(MetaMask hygiene, hardware wallet for mainnet, RPC trust, post-deploy verification).\n\n### Step 7: Triage and report\n\nCombine Slither + Aderyn + Mythril + test results, deduplicate by (file, line),\ndrop confirmed false positives, rank by exploitability × financial impact, and map\neach to its SWC id. The orchestrator emits `audit-report.json` with a PASS\u002FFAIL gate.\n\n## Expected Output\n\nA JSON audit report listing findings with **SWC identifiers**, severity, tool source,\naffected contract\u002Ffunction\u002Fline, and remediation; plus the test\u002Fcoverage summary and a\nsingle **PASS \u002F FAIL** deploy gate. FAIL on any high\u002Fcritical static finding, failing\ntest, leaked secret, or coverage below the configured threshold on value-moving code.\n",{"name":5,"tags":60,"author":64,"domain":52,"license":15,"version":65,"based_on":66,"subdomain":67,"description":7,"mitre_attack":68,"swc_registry":71},[46,37,43,45,61,42,62,41,63,40,39,48],"slither","mythril","defi","devredious","1.0","mukul975\u002Fanalyzing-ethereum-smart-contract-vulnerabilities","blockchain-security",[69,70],"T1190","T1059","https:\u002F\u002Fswcregistry.io\u002F","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fauditing-foundry-smart-contract-security",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":83,"prompt":93,"zipAvailable":94},[84,87,90],{"tool":85,"command":86},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill auditing-foundry-smart-contract-security",{"tool":88,"command":89},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill auditing-foundry-smart-contract-security",{"tool":91,"command":92},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill auditing-foundry-smart-contract-security","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fauditing-foundry-smart-contract-security\u002FSKILL.md",true,[96,101,107,111,115,119,123,127,131,135,139,143,149,153],{"path":97,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":99,"sourceHtmlUrl":100},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fauditing-foundry-smart-contract-security\u002FLICENSE",{"path":102,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":105,"sourceHtmlUrl":106},"references\u002Fapi-reference.md","REFERENCE","参考文档",6604,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fauditing-foundry-smart-contract-security\u002Freferences\u002Fapi-reference.md",{"path":108,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":109,"sourceHtmlUrl":110},"references\u002Fbenchmarking.md",5841,"https:\u002F\u002Fgithub.com\u002FNVIDIA\u002FModel-Optimizer\u002Fblob\u002Fmain\u002Fplugins\u002Fmodelopt\u002Fskills\u002Fdeployment\u002Freferences\u002Fbenchmarking.md",{"path":112,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":113,"sourceHtmlUrl":114},"references\u002Fsecure-deployment-and-keys.md",4171,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fauditing-foundry-smart-contract-security\u002Freferences\u002Fsecure-deployment-and-keys.md",{"path":116,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":117,"sourceHtmlUrl":118},"references\u002Fsetup.md",2491,"https:\u002F\u002Fgithub.com\u002FNVIDIA\u002FModel-Optimizer\u002Fblob\u002Fmain\u002Fplugins\u002Fmodelopt\u002Fskills\u002Fdeployment\u002Freferences\u002Fsetup.md",{"path":120,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":121,"sourceHtmlUrl":122},"references\u002Fsglang.md",4765,"https:\u002F\u002Fgithub.com\u002FNVIDIA\u002FModel-Optimizer\u002Fblob\u002Fmain\u002Fplugins\u002Fmodelopt\u002Fskills\u002Fdeployment\u002Freferences\u002Fsglang.md",{"path":124,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":125,"sourceHtmlUrl":126},"references\u002Fsupport-matrix.md",3286,"https:\u002F\u002Fgithub.com\u002FNVIDIA\u002FModel-Optimizer\u002Fblob\u002Fmain\u002Fplugins\u002Fmodelopt\u002Fskills\u002Fdeployment\u002Freferences\u002Fsupport-matrix.md",{"path":128,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":129,"sourceHtmlUrl":130},"references\u002Ftrtllm.md",3382,"https:\u002F\u002Fgithub.com\u002FNVIDIA\u002FModel-Optimizer\u002Fblob\u002Fmain\u002Fplugins\u002Fmodelopt\u002Fskills\u002Fdeployment\u002Freferences\u002Ftrtllm.md",{"path":132,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":133,"sourceHtmlUrl":134},"references\u002Funsupported-models.md",4886,"https:\u002F\u002Fgithub.com\u002FNVIDIA\u002FModel-Optimizer\u002Fblob\u002Fmain\u002Fplugins\u002Fmodelopt\u002Fskills\u002Fdeployment\u002Freferences\u002Funsupported-models.md",{"path":136,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":137,"sourceHtmlUrl":138},"references\u002Fvllm.md",2586,"https:\u002F\u002Fgithub.com\u002FNVIDIA\u002FModel-Optimizer\u002Fblob\u002Fmain\u002Fplugins\u002Fmodelopt\u002Fskills\u002Fdeployment\u002Freferences\u002Fvllm.md",{"path":140,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":141,"sourceHtmlUrl":142},"references\u002Fvulnerability-checklist.md",4955,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fauditing-foundry-smart-contract-security\u002Freferences\u002Fvulnerability-checklist.md",{"path":144,"resourceType":145,"resourceTypeDesc":146,"sizeBytes":147,"sourceHtmlUrl":148},"scripts\u002Fagent.py","SCRIPT","脚本",13779,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fauditing-foundry-smart-contract-security\u002Fscripts\u002Fagent.py",{"path":150,"resourceType":145,"resourceTypeDesc":146,"sizeBytes":151,"sourceHtmlUrl":152},"scripts\u002Fdeploy.sh",19486,"https:\u002F\u002Fgithub.com\u002FNVIDIA\u002FModel-Optimizer\u002Fblob\u002Fmain\u002Fplugins\u002Fmodelopt\u002Fskills\u002Fdeployment\u002Fscripts\u002Fdeploy.sh",{"path":154,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":155,"sourceHtmlUrl":156},"tests\u002Fevals.json",3055,"https:\u002F\u002Fgithub.com\u002FNVIDIA\u002FModel-Optimizer\u002Fblob\u002Fmain\u002Fplugins\u002Fmodelopt\u002Fskills\u002Fdeployment\u002Ftests\u002Fevals.json",[158,183,207,232,258,285],{"skillNo":159,"name":160,"nameZh":6,"description":161,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":162,"categories":163,"keywords":165,"publishedAt":55},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[164],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[166,167,168,169,36,52,170,171,172,49,173,174,175,176,177,178,179,180,181,182],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","pr","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":184,"name":185,"nameZh":6,"description":186,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":187,"categories":188,"keywords":190,"publishedAt":55},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[189],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[191,179,192,193,36,194,52,172,195,196,197,198,199,200,201,202,203,204,205,206],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":208,"name":209,"nameZh":6,"description":210,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":211,"categories":212,"keywords":215,"publishedAt":55},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[213,214],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[201,216,217,218,47,52,219,220,195,221,222,223,224,225,226,227,228,229,230,231],"backup","recovery","validating backup integrity for recovery","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":233,"name":234,"nameZh":6,"description":235,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":236,"categories":237,"keywords":239,"publishedAt":55},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[238],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[240,241,242,52,243,244,245,246,247,248,249,250,251,252,253,254,198,255,256,257],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":259,"name":260,"nameZh":6,"description":261,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":262,"categories":263,"keywords":265,"publishedAt":55},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[264],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[266,267,268,52,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":286,"name":287,"nameZh":6,"description":288,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":289,"categories":290,"keywords":292,"publishedAt":55},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[291],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[36,293,52,294,295,296,297,298,299,300,301,227,302,228,303,304,305,306,307,308],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]