[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AE5M7GQH1VA5WMQ2G2KPB6":3,"skill-same:01M6AE5M7GQH1VA5WMQ2G2KPB6":153},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":31,"publishedAt":50,"linkOnly":51,"markdownContent":52,"markdownBody":53,"frontMatter":54,"refName":88,"commitSha":89,"skillDirectory":90,"forksCount":91,"repositoryHtmlUrl":92,"repositoryHomepageUrl":93,"ownerHtmlUrl":94,"ownerBlogUrl":95,"ownerDescription":96,"updatedAt":97,"install":98,"resources":111},"01M6AE5M7GQH1VA5WMQ2G2KPB6","configuring-oauth2-authorization-flow",null,"Configures secure OAuth 2.0 authorization flows, including Authorization Code with PKCE, Client Credentials, and Device Authorization Grant, covering flow selection, PKCE implementation, token lifecycle management, and scope design per OAuth 2.1. Use when implementing or hardening OAuth 2.0 authentication\u002Fauthorization for web, mobile, SPA, or machine-to-machine clients.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconfiguring-oauth2-authorization-flow\u002FSKILL.md",[18,23,26],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000015","视觉设计","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49],"configuring oauth2 authorization flow","flow","OAuth","pkce","oidc","oauth2","authorization","hardening","iam","access-control","design","authentication","code","pr","secure","identity","web","cybersecurity","2026-11-10 10:12:30",false,"---\nname: configuring-oauth2-authorization-flow\ndescription: Configures secure OAuth 2.0 authorization flows, including Authorization\n  Code with PKCE, Client Credentials, and Device Authorization Grant, covering flow\n  selection, PKCE implementation, token lifecycle management, and scope design per\n  OAuth 2.1. Use when implementing or hardening OAuth 2.0 authentication\u002Fauthorization\n  for web, mobile, SPA, or machine-to-machine clients.\ndomain: cybersecurity\nsubdomain: identity-access-management\ntags:\n- iam\n- identity\n- access-control\n- authentication\n- authorization\n- oauth2\n- oidc\n- pkce\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.AA-01\n- PR.AA-02\n- PR.AA-05\n- PR.AA-06\nmitre_attack:\n- T1528\n- T1550.001\n- T1539\n- T1606.001\n- T1212\nmitre_f3:\n  version: '1.1'\n  tactics:\n  - initial-access\n  - positioning\n  techniques:\n  - id: T1550.001\n    name: 'Use Alternate Authentication Material: Application Access Token'\n    tactic: initial-access\n    source: attack\n  - id: F1004\n    name: Access with Stolen Session Cookie\n    tactic: initial-access\n    source: f3\n  - id: F1006\n    name: Account Takeover\n    tactic: initial-access\n    source: f3\n  - id: T1539\n    name: Steal Web Session Cookie\n    tactic: positioning\n    source: attack\n---\n# Configuring OAuth 2.0 Authorization Flow\n\n## Overview\nConfigure secure OAuth 2.0 authorization flows including Authorization Code with PKCE, Client Credentials, and Device Authorization Grant. This skill covers flow selection, PKCE implementation, token lifecycle management, scope design, and alignment with OAuth 2.1 security requirements.\n\n\n## When to Use\n\n- When deploying or configuring configuring oauth2 authorization flow capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Familiarity with identity access management concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Objectives\n- Implement Authorization Code flow with PKCE for public and confidential clients\n- Configure Client Credentials flow for machine-to-machine communication\n- Design least-privilege scope hierarchies\n- Implement secure token storage, refresh, and revocation\n- Apply OAuth 2.1 best practices and RFC 9700 security recommendations\n- Validate token integrity and prevent common OAuth attacks\n\n## Key Concepts\n\n### OAuth 2.0 Grant Types\n1. **Authorization Code + PKCE**: Recommended for all client types (web, mobile, SPA). PKCE is mandatory in OAuth 2.1.\n2. **Client Credentials**: Machine-to-machine authentication without user context.\n3. **Device Authorization Grant (RFC 8628)**: For input-constrained devices (smart TVs, CLI tools).\n4. **Refresh Token**: Long-lived token to obtain new access tokens without re-authentication.\n\n### PKCE (Proof Key for Code Exchange)\nPKCE (RFC 7636) prevents authorization code interception attacks:\n1. Client generates random `code_verifier` (43-128 characters, unreserved URI chars)\n2. Client computes `code_challenge = BASE64URL(SHA256(code_verifier))`\n3. Authorization request includes `code_challenge` and `code_challenge_method=S256`\n4. Token request includes original `code_verifier`\n5. Server validates `SHA256(code_verifier)` matches stored `code_challenge`\n\n### Token Types\n- **Access Token**: Short-lived (5-60 min), bearer or DPoP-bound\n- **Refresh Token**: Long-lived, single-use with rotation\n- **ID Token (OIDC)**: JWT containing user identity claims\n\n## Workflow\n\n### Step 1: Authorization Code Flow with PKCE\n1. Generate cryptographically random code_verifier (min 43 chars)\n2. Compute code_challenge using S256 method\n3. Redirect user to authorization endpoint with parameters:\n   - response_type=code\n   - client_id, redirect_uri, scope, state\n   - code_challenge, code_challenge_method=S256\n4. User authenticates and consents\n5. Authorization server redirects with authorization code\n6. Exchange code + code_verifier for tokens at token endpoint\n7. Validate state parameter matches original value\n\n### Step 2: Scope Design\n- Define granular scopes: `read:users`, `write:orders`, `admin:settings`\n- Follow least-privilege: request minimum scopes needed\n- Implement scope validation on resource server\n- Document scope hierarchy and consent requirements\n\n### Step 3: Token Security\n- Store tokens securely (httpOnly cookies for web, keychain for mobile)\n- Implement token refresh with rotation (one-time-use refresh tokens)\n- Set appropriate expiration: access tokens 5-15 min, refresh tokens 8-24 hrs\n- Enable DPoP (Demonstration of Proof-of-Possession) for sender-constrained tokens\n- Implement token revocation endpoint\n\n### Step 4: Client Credentials Flow\n1. Register service client with client_id and client_secret\n2. Request token: POST \u002Foauth\u002Ftoken with grant_type=client_credentials\n3. Include scope for required permissions\n4. Store client_secret securely (vault, env vars, not code)\n5. Implement certificate-based client authentication for higher assurance\n\n### Step 5: Security Hardening\n- Enforce PKCE for all authorization code flows\n- Use exact redirect URI matching (no wildcards)\n- Implement CSRF protection with state parameter\n- Enable refresh token rotation and revocation on reuse detection\n- Apply RFC 9700 security best practices\n- Block implicit grant and ROPC (removed in OAuth 2.1)\n\n## Security Controls\n| Control | NIST 800-53 | Description |\n|---------|-------------|-------------|\n| Access Control | AC-3 | Token-based access enforcement |\n| Authentication | IA-5 | Client credential management |\n| Session Management | SC-23 | Token lifecycle management |\n| Audit | AU-3 | Log all token issuance and revocation |\n| Cryptographic Protection | SC-13 | PKCE and token signing |\n\n## Common Pitfalls\n- Using implicit grant (removed in OAuth 2.1) instead of authorization code + PKCE\n- Storing tokens in localStorage (XSS vulnerable) instead of httpOnly cookies\n- Not validating state parameter enabling CSRF attacks\n- Using wildcard redirect URIs allowing open redirect exploitation\n- Not implementing refresh token rotation allowing token theft persistence\n\n## Verification\n- [ ] Authorization Code + PKCE flow completes successfully\n- [ ] PKCE code_challenge validated at token endpoint\n- [ ] State parameter prevents CSRF\n- [ ] Access tokens expire within configured lifetime\n- [ ] Refresh token rotation issues new refresh token each use\n- [ ] Token revocation invalidates both access and refresh tokens\n- [ ] Client Credentials flow works for service-to-service calls\n- [ ] Scopes correctly enforced at resource server\n","# Configuring OAuth 2.0 Authorization Flow\n\n## Overview\nConfigure secure OAuth 2.0 authorization flows including Authorization Code with PKCE, Client Credentials, and Device Authorization Grant. This skill covers flow selection, PKCE implementation, token lifecycle management, scope design, and alignment with OAuth 2.1 security requirements.\n\n\n## When to Use\n\n- When deploying or configuring configuring oauth2 authorization flow capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Familiarity with identity access management concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Objectives\n- Implement Authorization Code flow with PKCE for public and confidential clients\n- Configure Client Credentials flow for machine-to-machine communication\n- Design least-privilege scope hierarchies\n- Implement secure token storage, refresh, and revocation\n- Apply OAuth 2.1 best practices and RFC 9700 security recommendations\n- Validate token integrity and prevent common OAuth attacks\n\n## Key Concepts\n\n### OAuth 2.0 Grant Types\n1. **Authorization Code + PKCE**: Recommended for all client types (web, mobile, SPA). PKCE is mandatory in OAuth 2.1.\n2. **Client Credentials**: Machine-to-machine authentication without user context.\n3. **Device Authorization Grant (RFC 8628)**: For input-constrained devices (smart TVs, CLI tools).\n4. **Refresh Token**: Long-lived token to obtain new access tokens without re-authentication.\n\n### PKCE (Proof Key for Code Exchange)\nPKCE (RFC 7636) prevents authorization code interception attacks:\n1. Client generates random `code_verifier` (43-128 characters, unreserved URI chars)\n2. Client computes `code_challenge = BASE64URL(SHA256(code_verifier))`\n3. Authorization request includes `code_challenge` and `code_challenge_method=S256`\n4. Token request includes original `code_verifier`\n5. Server validates `SHA256(code_verifier)` matches stored `code_challenge`\n\n### Token Types\n- **Access Token**: Short-lived (5-60 min), bearer or DPoP-bound\n- **Refresh Token**: Long-lived, single-use with rotation\n- **ID Token (OIDC)**: JWT containing user identity claims\n\n## Workflow\n\n### Step 1: Authorization Code Flow with PKCE\n1. Generate cryptographically random code_verifier (min 43 chars)\n2. Compute code_challenge using S256 method\n3. Redirect user to authorization endpoint with parameters:\n   - response_type=code\n   - client_id, redirect_uri, scope, state\n   - code_challenge, code_challenge_method=S256\n4. User authenticates and consents\n5. Authorization server redirects with authorization code\n6. Exchange code + code_verifier for tokens at token endpoint\n7. Validate state parameter matches original value\n\n### Step 2: Scope Design\n- Define granular scopes: `read:users`, `write:orders`, `admin:settings`\n- Follow least-privilege: request minimum scopes needed\n- Implement scope validation on resource server\n- Document scope hierarchy and consent requirements\n\n### Step 3: Token Security\n- Store tokens securely (httpOnly cookies for web, keychain for mobile)\n- Implement token refresh with rotation (one-time-use refresh tokens)\n- Set appropriate expiration: access tokens 5-15 min, refresh tokens 8-24 hrs\n- Enable DPoP (Demonstration of Proof-of-Possession) for sender-constrained tokens\n- Implement token revocation endpoint\n\n### Step 4: Client Credentials Flow\n1. Register service client with client_id and client_secret\n2. Request token: POST \u002Foauth\u002Ftoken with grant_type=client_credentials\n3. Include scope for required permissions\n4. Store client_secret securely (vault, env vars, not code)\n5. Implement certificate-based client authentication for higher assurance\n\n### Step 5: Security Hardening\n- Enforce PKCE for all authorization code flows\n- Use exact redirect URI matching (no wildcards)\n- Implement CSRF protection with state parameter\n- Enable refresh token rotation and revocation on reuse detection\n- Apply RFC 9700 security best practices\n- Block implicit grant and ROPC (removed in OAuth 2.1)\n\n## Security Controls\n| Control | NIST 800-53 | Description |\n|---------|-------------|-------------|\n| Access Control | AC-3 | Token-based access enforcement |\n| Authentication | IA-5 | Client credential management |\n| Session Management | SC-23 | Token lifecycle management |\n| Audit | AU-3 | Log all token issuance and revocation |\n| Cryptographic Protection | SC-13 | PKCE and token signing |\n\n## Common Pitfalls\n- Using implicit grant (removed in OAuth 2.1) instead of authorization code + PKCE\n- Storing tokens in localStorage (XSS vulnerable) instead of httpOnly cookies\n- Not validating state parameter enabling CSRF attacks\n- Using wildcard redirect URIs allowing open redirect exploitation\n- Not implementing refresh token rotation allowing token theft persistence\n\n## Verification\n- [ ] Authorization Code + PKCE flow completes successfully\n- [ ] PKCE code_challenge validated at token endpoint\n- [ ] State parameter prevents CSRF\n- [ ] Access tokens expire within configured lifetime\n- [ ] Refresh token rotation issues new refresh token each use\n- [ ] Token revocation invalidates both access and refresh tokens\n- [ ] Client Credentials flow works for service-to-service calls\n- [ ] Scopes correctly enforced at resource server\n",{"name":5,"tags":55,"author":56,"domain":49,"license":15,"version":57,"mitre_f3":58,"nist_csf":78,"subdomain":83,"description":7,"mitre_attack":84},[40,47,41,43,38,37,36,35],"mahipal","1.0",{"tactics":59,"version":62,"techniques":63},[60,61],"initial-access","positioning","1.1",[64,68,72,75],{"id":65,"name":66,"source":67,"tactic":60},"T1550.001","Use Alternate Authentication Material: Application Access Token","attack",{"id":69,"name":70,"source":71,"tactic":60},"F1004","Access with Stolen Session Cookie","f3",{"id":73,"name":74,"source":71,"tactic":60},"F1006","Account Takeover",{"id":76,"name":77,"source":67,"tactic":61},"T1539","Steal Web Session Cookie",[79,80,81,82],"PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06","identity-access-management",[85,65,76,86,87],"T1528","T1606.001","T1212","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fconfiguring-oauth2-authorization-flow",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":99,"prompt":109,"zipAvailable":110},[100,103,106],{"tool":101,"command":102},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill configuring-oauth2-authorization-flow",{"tool":104,"command":105},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill configuring-oauth2-authorization-flow",{"tool":107,"command":108},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill configuring-oauth2-authorization-flow","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconfiguring-oauth2-authorization-flow\u002FSKILL.md",true,[112,118,123,129,133,137,143,147],{"path":113,"resourceType":114,"resourceTypeDesc":115,"sizeBytes":116,"sourceHtmlUrl":117},"assets\u002Ftemplate.md","ASSET","资产文件",2818,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconfiguring-oauth2-authorization-flow\u002Fassets\u002Ftemplate.md",{"path":119,"resourceType":119,"resourceTypeDesc":120,"sizeBytes":121,"sourceHtmlUrl":122},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconfiguring-oauth2-authorization-flow\u002FLICENSE",{"path":124,"resourceType":125,"resourceTypeDesc":126,"sizeBytes":127,"sourceHtmlUrl":128},"references\u002Fapi-reference.md","REFERENCE","参考文档",1572,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconfiguring-oauth2-authorization-flow\u002Freferences\u002Fapi-reference.md",{"path":130,"resourceType":125,"resourceTypeDesc":126,"sizeBytes":131,"sourceHtmlUrl":132},"references\u002Fstandards.md",2270,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconfiguring-oauth2-authorization-flow\u002Freferences\u002Fstandards.md",{"path":134,"resourceType":125,"resourceTypeDesc":126,"sizeBytes":135,"sourceHtmlUrl":136},"references\u002Fworkflows.md",5472,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconfiguring-oauth2-authorization-flow\u002Freferences\u002Fworkflows.md",{"path":138,"resourceType":139,"resourceTypeDesc":140,"sizeBytes":141,"sourceHtmlUrl":142},"scripts\u002Fagent.py","SCRIPT","脚本",5518,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconfiguring-oauth2-authorization-flow\u002Fscripts\u002Fagent.py",{"path":144,"resourceType":139,"resourceTypeDesc":140,"sizeBytes":145,"sourceHtmlUrl":146},"scripts\u002Fprocess.py",20408,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconfiguring-oauth2-authorization-flow\u002Fscripts\u002Fprocess.py",{"path":148,"resourceType":149,"resourceTypeDesc":150,"sizeBytes":151,"sourceHtmlUrl":152},"SKILL.md.tmpl","OTHER","其他",5594,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Flearn\u002FSKILL.md.tmpl",[154,178,202,230,256,283],{"skillNo":155,"name":156,"nameZh":6,"description":157,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":158,"categories":159,"keywords":161,"publishedAt":50},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[160],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[162,163,164,165,166,49,167,47,45,44,168,169,170,171,172,173,174,175,176,177],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":179,"name":180,"nameZh":6,"description":181,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":182,"categories":183,"keywords":185,"publishedAt":50},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[184],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[186,174,187,188,166,189,49,45,190,191,192,193,194,195,196,197,198,199,200,201],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":203,"name":204,"nameZh":6,"description":205,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":206,"categories":207,"keywords":212,"publishedAt":50},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[208,211],{"categoryNo":209,"categoryName":210,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[196,213,214,215,216,49,217,218,190,219,220,221,222,223,224,225,226,227,228,229],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":231,"name":232,"nameZh":6,"description":233,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":234,"categories":235,"keywords":237,"publishedAt":50},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[236],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[238,239,240,49,241,242,243,244,245,246,247,248,249,250,251,252,193,253,254,255],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":257,"name":258,"nameZh":6,"description":259,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":260,"categories":261,"keywords":263,"publishedAt":50},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[262],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[264,265,266,49,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":284,"name":285,"nameZh":6,"description":286,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":287,"categories":288,"keywords":290,"publishedAt":50},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[289],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[166,291,49,292,293,294,295,296,297,298,299,225,300,226,301,302,303,304,305,306],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]