[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AESHY9MV7GYFSJNHB8Z86B":3,"skill-same:01M6AESHY9MV7GYFSJNHB8Z86B":139},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":40,"linkOnly":41,"markdownContent":42,"markdownBody":43,"frontMatter":44,"refName":60,"commitSha":61,"skillDirectory":62,"forksCount":63,"repositoryHtmlUrl":64,"repositoryHomepageUrl":65,"ownerHtmlUrl":66,"ownerBlogUrl":67,"ownerDescription":68,"updatedAt":69,"install":70,"resources":83},"01M6AESHY9MV7GYFSJNHB8Z86B","hardening-docker-containers-for-production",null,"Hardens Dockerfiles, images, and per-container runtime settings against the CIS Docker Benchmark v1.8.0: non-root users, dropped capabilities, read-only root filesystem, seccomp and AppArmor profiles, and minimal multi-stage builds, validated with docker-bench-security, Hadolint, and Dockle. Use when preparing a container or Dockerfile for production, or auditing images and runtime flags against CIS Docker controls. Keywords: Dockerfile, USER, --cap-drop, read-only rootfs, seccomp, AppArmor, multi-stage, Hadolint, Dockle. Do not use for the Docker daemon's own configuration - use hardening-docker-daemon-configuration.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhardening-docker-containers-for-production\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[27,28,29,30,31,32,33,34,35,36,37,38,39],"containers","docker","hardening","Production","hardening docker containers for production","security","cybersecurity","dockerfile","pr","benchmark","capabilities","container-security","cis-benchmark","2026-11-10 10:12:30",false,"---\nname: hardening-docker-containers-for-production\ndescription: >-\n  Hardens Dockerfiles, images, and per-container runtime settings against the CIS Docker\n  Benchmark v1.8.0: non-root users, dropped capabilities, read-only root filesystem, seccomp\n  and AppArmor profiles, and minimal multi-stage builds, validated with docker-bench-security,\n  Hadolint, and Dockle. Use when preparing a container or Dockerfile for production, or\n  auditing images and runtime flags against CIS Docker controls. Keywords: Dockerfile, USER,\n  --cap-drop, read-only rootfs, seccomp, AppArmor, multi-stage, Hadolint, Dockle. Do not use\n  for the Docker daemon's own configuration - use hardening-docker-daemon-configuration.\ndomain: cybersecurity\nsubdomain: container-security\ntags:\n- containers\n- docker\n- security\n- hardening\n- CIS-benchmark\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- PR.IR-01\n- ID.AM-08\n- DE.CM-01\nmitre_attack:\n- T1610\n- T1611\n- T1609\n- T1525\n- T1068\n---\n# Hardening Docker Containers for Production\n\n## Overview\n\nHardening Docker containers for production involves applying security best practices aligned with CIS Docker Benchmark v1.8.0 to minimize attack surface, prevent privilege escalation, and enforce least-privilege principles across Docker daemon, images, containers, and runtime configurations.\n\n\n## When to Use\n\n- When deploying or configuring hardening docker containers for production capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Docker Engine 24.0+ installed\n- Docker Compose v2\n- Linux host with kernel 5.10+\n- Root or sudo access on Docker host\n- docker-bench-security tool\n- Hadolint for Dockerfile linting\n- Dockle for image linting\n\n## Core Concepts\n\n### CIS Docker Benchmark Sections\n\n1. **Host Configuration** - Audit Docker daemon files, restrict access to \u002Fvar\u002Frun\u002Fdocker.sock\n2. **Docker Daemon Configuration** - Enable TLS, restrict inter-container communication, configure logging\n3. **Docker Daemon Configuration Files** - Set ownership and permissions on daemon.json\n4. **Container Images and Build File** - Use trusted base images, scan for vulnerabilities, multi-stage builds\n5. **Container Runtime** - Drop capabilities, read-only rootfs, restrict syscalls\n6. **Docker Security Operations** - Monitor, audit, and rotate credentials\n\n### Key Hardening Principles\n\n- **Least Privilege**: Run containers as non-root, drop all capabilities except required\n- **Immutability**: Use read-only root filesystem, tmpfs for writable directories\n- **Minimalism**: Use distroless or Alpine base images, multi-stage builds\n- **Isolation**: Apply seccomp profiles, AppArmor\u002FSELinux, namespace restrictions\n- **Auditability**: Enable content trust, log all container activity\n\n## Workflow\n\n### Step 1: Harden the Dockerfile\n\n```dockerfile\n# Use specific digest for reproducibility\nFROM python:3.12-slim@sha256:abc123... AS builder\n\nWORKDIR \u002Fapp\nCOPY requirements.txt .\nRUN pip install --no-cache-dir --user -r requirements.txt\n\n# Production stage - minimal image\nFROM gcr.io\u002Fdistroless\u002Fpython3-debian12\n\n# Copy only necessary artifacts\nCOPY --from=builder \u002Froot\u002F.local \u002Froot\u002F.local\nCOPY --from=builder \u002Fapp \u002Fapp\n\nWORKDIR \u002Fapp\n\n# Create non-root user\nUSER 65534:65534\n\n# Set read-only filesystem expectation\nLABEL org.opencontainers.image.source=\"https:\u002F\u002Fgithub.com\u002Forg\u002Fapp\"\n\nENTRYPOINT [\"python\", \"app.py\"]\n```\n\n### Step 2: Harden Docker Daemon Configuration\n\n```json\n{\n  \"icc\": false,\n  \"log-driver\": \"json-file\",\n  \"log-opts\": {\n    \"max-size\": \"10m\",\n    \"max-file\": \"3\"\n  },\n  \"live-restore\": true,\n  \"userland-proxy\": false,\n  \"no-new-privileges\": true,\n  \"default-ulimits\": {\n    \"nofile\": {\n      \"Name\": \"nofile\",\n      \"Hard\": 64000,\n      \"Soft\": 64000\n    },\n    \"nproc\": {\n      \"Name\": \"nproc\",\n      \"Hard\": 1024,\n      \"Soft\": 1024\n    }\n  },\n  \"seccomp-profile\": \"\u002Fetc\u002Fdocker\u002Fseccomp-default.json\",\n  \"tls\": true,\n  \"tlscacert\": \"\u002Fetc\u002Fdocker\u002Ftls\u002Fca.pem\",\n  \"tlscert\": \"\u002Fetc\u002Fdocker\u002Ftls\u002Fserver-cert.pem\",\n  \"tlskey\": \"\u002Fetc\u002Fdocker\u002Ftls\u002Fserver-key.pem\",\n  \"tlsverify\": true\n}\n```\n\n### Step 3: Harden Container Runtime\n\n```bash\ndocker run -d \\\n  --name production-app \\\n  --read-only \\\n  --tmpfs \u002Ftmp:rw,noexec,nosuid,size=100m \\\n  --tmpfs \u002Fvar\u002Frun:rw,noexec,nosuid,size=10m \\\n  --cap-drop ALL \\\n  --cap-add NET_BIND_SERVICE \\\n  --security-opt no-new-privileges:true \\\n  --security-opt seccomp=\u002Fetc\u002Fdocker\u002Fseccomp-default.json \\\n  --security-opt apparmor=docker-default \\\n  --pids-limit 100 \\\n  --memory 512m \\\n  --memory-swap 512m \\\n  --cpus 1.0 \\\n  --user 65534:65534 \\\n  --network custom-bridge \\\n  --restart on-failure:3 \\\n  --health-cmd \"curl -f http:\u002F\u002Flocalhost:8080\u002Fhealth || exit 1\" \\\n  --health-interval 30s \\\n  --health-timeout 10s \\\n  --health-retries 3 \\\n  myapp:latest\n```\n\n### Step 4: Enable Docker Content Trust\n\n```bash\nexport DOCKER_CONTENT_TRUST=1\nexport DOCKER_CONTENT_TRUST_SERVER=https:\u002F\u002Fnotary.example.com\n\n# Sign and push image\ndocker trust sign myregistry.com\u002Fmyapp:v1.0.0\n\n# Verify image signature before pull\ndocker trust inspect --pretty myregistry.com\u002Fmyapp:v1.0.0\n```\n\n### Step 5: Configure Host-Level Auditing\n\n```bash\n# Add audit rules for Docker files and directories\ncat >> \u002Fetc\u002Faudit\u002Frules.d\u002Fdocker.rules \u003C\u003C 'EOF'\n-w \u002Fusr\u002Fbin\u002Fdocker -k docker\n-w \u002Fvar\u002Flib\u002Fdocker -k docker\n-w \u002Fetc\u002Fdocker -k docker\n-w \u002Flib\u002Fsystemd\u002Fsystem\u002Fdocker.service -k docker\n-w \u002Flib\u002Fsystemd\u002Fsystem\u002Fdocker.socket -k docker\n-w \u002Fetc\u002Fdefault\u002Fdocker -k docker\n-w \u002Fetc\u002Fdocker\u002Fdaemon.json -k docker\n-w \u002Fusr\u002Fbin\u002Fcontainerd -k docker\n-w \u002Fusr\u002Fbin\u002Frunc -k docker\nEOF\n\nsystemctl restart auditd\n```\n\n## Validation Commands\n\n```bash\n# Run Docker Bench Security\ndocker run --rm --net host --pid host \\\n  --userns host --cap-add audit_control \\\n  -e DOCKER_CONTENT_TRUST=$DOCKER_CONTENT_TRUST \\\n  -v \u002Fetc:\u002Fetc:ro \\\n  -v \u002Fusr\u002Fbin\u002Fcontainerd:\u002Fusr\u002Fbin\u002Fcontainerd:ro \\\n  -v \u002Fusr\u002Fbin\u002Frunc:\u002Fusr\u002Fbin\u002Frunc:ro \\\n  -v \u002Fusr\u002Flib\u002Fsystemd:\u002Fusr\u002Flib\u002Fsystemd:ro \\\n  -v \u002Fvar\u002Flib:\u002Fvar\u002Flib:ro \\\n  -v \u002Fvar\u002Frun\u002Fdocker.sock:\u002Fvar\u002Frun\u002Fdocker.sock:ro \\\n  docker\u002Fdocker-bench-security\n\n# Lint Dockerfile\nhadolint Dockerfile\n\n# Lint built image\ndockle myapp:latest\n\n# Verify no containers running as root\ndocker ps -q | xargs docker inspect --format '{{.Id}}: User={{.Config.User}}'\n```\n\n## Key Security Controls\n\n| Control | Implementation | CIS Section |\n|---------|---------------|-------------|\n| Non-root user | USER instruction in Dockerfile | 4.1 |\n| Read-only rootfs | --read-only flag | 5.12 |\n| Drop capabilities | --cap-drop ALL | 5.3 |\n| Resource limits | --memory, --cpus, --pids-limit | 5.10 |\n| No new privileges | --security-opt no-new-privileges | 5.25 |\n| Content trust | DOCKER_CONTENT_TRUST=1 | 4.5 |\n| TLS for daemon | daemon.json TLS config | 2.6 |\n| Audit logging | auditd rules | 1.1 |\n\n## References\n\n- [CIS Docker Benchmark](https:\u002F\u002Fwww.cisecurity.org\u002Fbenchmark\u002Fdocker)\n- [Docker Security Best Practices](https:\u002F\u002Fdocs.docker.com\u002Fengine\u002Fsecurity\u002F)\n- [Docker Bench Security Tool](https:\u002F\u002Fgithub.com\u002Fdocker\u002Fdocker-bench-security)\n- [Hadolint - Dockerfile Linter](https:\u002F\u002Fgithub.com\u002Fhadolint\u002Fhadolint)\n","# Hardening Docker Containers for Production\n\n## Overview\n\nHardening Docker containers for production involves applying security best practices aligned with CIS Docker Benchmark v1.8.0 to minimize attack surface, prevent privilege escalation, and enforce least-privilege principles across Docker daemon, images, containers, and runtime configurations.\n\n\n## When to Use\n\n- When deploying or configuring hardening docker containers for production capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Docker Engine 24.0+ installed\n- Docker Compose v2\n- Linux host with kernel 5.10+\n- Root or sudo access on Docker host\n- docker-bench-security tool\n- Hadolint for Dockerfile linting\n- Dockle for image linting\n\n## Core Concepts\n\n### CIS Docker Benchmark Sections\n\n1. **Host Configuration** - Audit Docker daemon files, restrict access to \u002Fvar\u002Frun\u002Fdocker.sock\n2. **Docker Daemon Configuration** - Enable TLS, restrict inter-container communication, configure logging\n3. **Docker Daemon Configuration Files** - Set ownership and permissions on daemon.json\n4. **Container Images and Build File** - Use trusted base images, scan for vulnerabilities, multi-stage builds\n5. **Container Runtime** - Drop capabilities, read-only rootfs, restrict syscalls\n6. **Docker Security Operations** - Monitor, audit, and rotate credentials\n\n### Key Hardening Principles\n\n- **Least Privilege**: Run containers as non-root, drop all capabilities except required\n- **Immutability**: Use read-only root filesystem, tmpfs for writable directories\n- **Minimalism**: Use distroless or Alpine base images, multi-stage builds\n- **Isolation**: Apply seccomp profiles, AppArmor\u002FSELinux, namespace restrictions\n- **Auditability**: Enable content trust, log all container activity\n\n## Workflow\n\n### Step 1: Harden the Dockerfile\n\n```dockerfile\n# Use specific digest for reproducibility\nFROM python:3.12-slim@sha256:abc123... AS builder\n\nWORKDIR \u002Fapp\nCOPY requirements.txt .\nRUN pip install --no-cache-dir --user -r requirements.txt\n\n# Production stage - minimal image\nFROM gcr.io\u002Fdistroless\u002Fpython3-debian12\n\n# Copy only necessary artifacts\nCOPY --from=builder \u002Froot\u002F.local \u002Froot\u002F.local\nCOPY --from=builder \u002Fapp \u002Fapp\n\nWORKDIR \u002Fapp\n\n# Create non-root user\nUSER 65534:65534\n\n# Set read-only filesystem expectation\nLABEL org.opencontainers.image.source=\"https:\u002F\u002Fgithub.com\u002Forg\u002Fapp\"\n\nENTRYPOINT [\"python\", \"app.py\"]\n```\n\n### Step 2: Harden Docker Daemon Configuration\n\n```json\n{\n  \"icc\": false,\n  \"log-driver\": \"json-file\",\n  \"log-opts\": {\n    \"max-size\": \"10m\",\n    \"max-file\": \"3\"\n  },\n  \"live-restore\": true,\n  \"userland-proxy\": false,\n  \"no-new-privileges\": true,\n  \"default-ulimits\": {\n    \"nofile\": {\n      \"Name\": \"nofile\",\n      \"Hard\": 64000,\n      \"Soft\": 64000\n    },\n    \"nproc\": {\n      \"Name\": \"nproc\",\n      \"Hard\": 1024,\n      \"Soft\": 1024\n    }\n  },\n  \"seccomp-profile\": \"\u002Fetc\u002Fdocker\u002Fseccomp-default.json\",\n  \"tls\": true,\n  \"tlscacert\": \"\u002Fetc\u002Fdocker\u002Ftls\u002Fca.pem\",\n  \"tlscert\": \"\u002Fetc\u002Fdocker\u002Ftls\u002Fserver-cert.pem\",\n  \"tlskey\": \"\u002Fetc\u002Fdocker\u002Ftls\u002Fserver-key.pem\",\n  \"tlsverify\": true\n}\n```\n\n### Step 3: Harden Container Runtime\n\n```bash\ndocker run -d \\\n  --name production-app \\\n  --read-only \\\n  --tmpfs \u002Ftmp:rw,noexec,nosuid,size=100m \\\n  --tmpfs \u002Fvar\u002Frun:rw,noexec,nosuid,size=10m \\\n  --cap-drop ALL \\\n  --cap-add NET_BIND_SERVICE \\\n  --security-opt no-new-privileges:true \\\n  --security-opt seccomp=\u002Fetc\u002Fdocker\u002Fseccomp-default.json \\\n  --security-opt apparmor=docker-default \\\n  --pids-limit 100 \\\n  --memory 512m \\\n  --memory-swap 512m \\\n  --cpus 1.0 \\\n  --user 65534:65534 \\\n  --network custom-bridge \\\n  --restart on-failure:3 \\\n  --health-cmd \"curl -f http:\u002F\u002Flocalhost:8080\u002Fhealth || exit 1\" \\\n  --health-interval 30s \\\n  --health-timeout 10s \\\n  --health-retries 3 \\\n  myapp:latest\n```\n\n### Step 4: Enable Docker Content Trust\n\n```bash\nexport DOCKER_CONTENT_TRUST=1\nexport DOCKER_CONTENT_TRUST_SERVER=https:\u002F\u002Fnotary.example.com\n\n# Sign and push image\ndocker trust sign myregistry.com\u002Fmyapp:v1.0.0\n\n# Verify image signature before pull\ndocker trust inspect --pretty myregistry.com\u002Fmyapp:v1.0.0\n```\n\n### Step 5: Configure Host-Level Auditing\n\n```bash\n# Add audit rules for Docker files and directories\ncat >> \u002Fetc\u002Faudit\u002Frules.d\u002Fdocker.rules \u003C\u003C 'EOF'\n-w \u002Fusr\u002Fbin\u002Fdocker -k docker\n-w \u002Fvar\u002Flib\u002Fdocker -k docker\n-w \u002Fetc\u002Fdocker -k docker\n-w \u002Flib\u002Fsystemd\u002Fsystem\u002Fdocker.service -k docker\n-w \u002Flib\u002Fsystemd\u002Fsystem\u002Fdocker.socket -k docker\n-w \u002Fetc\u002Fdefault\u002Fdocker -k docker\n-w \u002Fetc\u002Fdocker\u002Fdaemon.json -k docker\n-w \u002Fusr\u002Fbin\u002Fcontainerd -k docker\n-w \u002Fusr\u002Fbin\u002Frunc -k docker\nEOF\n\nsystemctl restart auditd\n```\n\n## Validation Commands\n\n```bash\n# Run Docker Bench Security\ndocker run --rm --net host --pid host \\\n  --userns host --cap-add audit_control \\\n  -e DOCKER_CONTENT_TRUST=$DOCKER_CONTENT_TRUST \\\n  -v \u002Fetc:\u002Fetc:ro \\\n  -v \u002Fusr\u002Fbin\u002Fcontainerd:\u002Fusr\u002Fbin\u002Fcontainerd:ro \\\n  -v \u002Fusr\u002Fbin\u002Frunc:\u002Fusr\u002Fbin\u002Frunc:ro \\\n  -v \u002Fusr\u002Flib\u002Fsystemd:\u002Fusr\u002Flib\u002Fsystemd:ro \\\n  -v \u002Fvar\u002Flib:\u002Fvar\u002Flib:ro \\\n  -v \u002Fvar\u002Frun\u002Fdocker.sock:\u002Fvar\u002Frun\u002Fdocker.sock:ro \\\n  docker\u002Fdocker-bench-security\n\n# Lint Dockerfile\nhadolint Dockerfile\n\n# Lint built image\ndockle myapp:latest\n\n# Verify no containers running as root\ndocker ps -q | xargs docker inspect --format '{{.Id}}: User={{.Config.User}}'\n```\n\n## Key Security Controls\n\n| Control | Implementation | CIS Section |\n|---------|---------------|-------------|\n| Non-root user | USER instruction in Dockerfile | 4.1 |\n| Read-only rootfs | --read-only flag | 5.12 |\n| Drop capabilities | --cap-drop ALL | 5.3 |\n| Resource limits | --memory, --cpus, --pids-limit | 5.10 |\n| No new privileges | --security-opt no-new-privileges | 5.25 |\n| Content trust | DOCKER_CONTENT_TRUST=1 | 4.5 |\n| TLS for daemon | daemon.json TLS config | 2.6 |\n| Audit logging | auditd rules | 1.1 |\n\n## References\n\n- [CIS Docker Benchmark](https:\u002F\u002Fwww.cisecurity.org\u002Fbenchmark\u002Fdocker)\n- [Docker Security Best Practices](https:\u002F\u002Fdocs.docker.com\u002Fengine\u002Fsecurity\u002F)\n- [Docker Bench Security Tool](https:\u002F\u002Fgithub.com\u002Fdocker\u002Fdocker-bench-security)\n- [Hadolint - Dockerfile Linter](https:\u002F\u002Fgithub.com\u002Fhadolint\u002Fhadolint)\n",{"name":5,"tags":45,"author":47,"domain":33,"license":15,"version":48,"nist_csf":49,"subdomain":38,"description":7,"mitre_attack":54},[27,28,32,29,46],"CIS-benchmark","mahipal","1.0",[50,51,52,53],"PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01",[55,56,57,58,59],"T1610","T1611","T1609","T1525","T1068","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fhardening-docker-containers-for-production",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":71,"prompt":81,"zipAvailable":82},[72,75,78],{"tool":73,"command":74},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill hardening-docker-containers-for-production",{"tool":76,"command":77},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill hardening-docker-containers-for-production",{"tool":79,"command":80},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill hardening-docker-containers-for-production","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhardening-docker-containers-for-production\u002FSKILL.md",true,[84,90,95,101,105,109,113,117,123,127,131,135],{"path":85,"resourceType":86,"resourceTypeDesc":87,"sizeBytes":88,"sourceHtmlUrl":89},"assets\u002Ftemplate.md","ASSET","资产文件",2822,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhardening-docker-containers-for-production\u002Fassets\u002Ftemplate.md",{"path":91,"resourceType":91,"resourceTypeDesc":92,"sizeBytes":93,"sourceHtmlUrl":94},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhardening-docker-containers-for-production\u002FLICENSE",{"path":96,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":99,"sourceHtmlUrl":100},"references\u002Fapi-reference.md","REFERENCE","参考文档",1818,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhardening-docker-containers-for-production\u002Freferences\u002Fapi-reference.md",{"path":102,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":103,"sourceHtmlUrl":104},"references\u002Fcommon_tags.md",10246,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fpydicom\u002Freferences\u002Fcommon_tags.md",{"path":106,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":107,"sourceHtmlUrl":108},"references\u002Fstandards.md",3676,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhardening-docker-containers-for-production\u002Freferences\u002Fstandards.md",{"path":110,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":111,"sourceHtmlUrl":112},"references\u002Ftransfer_syntaxes.md",9627,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fpydicom\u002Freferences\u002Ftransfer_syntaxes.md",{"path":114,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":115,"sourceHtmlUrl":116},"references\u002Fworkflows.md",4344,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhardening-docker-containers-for-production\u002Freferences\u002Fworkflows.md",{"path":118,"resourceType":119,"resourceTypeDesc":120,"sizeBytes":121,"sourceHtmlUrl":122},"scripts\u002Fagent.py","SCRIPT","脚本",5041,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhardening-docker-containers-for-production\u002Fscripts\u002Fagent.py",{"path":124,"resourceType":119,"resourceTypeDesc":120,"sizeBytes":125,"sourceHtmlUrl":126},"scripts\u002Fanonymize_dicom.py",5254,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fpydicom\u002Fscripts\u002Fanonymize_dicom.py",{"path":128,"resourceType":119,"resourceTypeDesc":120,"sizeBytes":129,"sourceHtmlUrl":130},"scripts\u002Fdicom_to_image.py",6101,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fpydicom\u002Fscripts\u002Fdicom_to_image.py",{"path":132,"resourceType":119,"resourceTypeDesc":120,"sizeBytes":133,"sourceHtmlUrl":134},"scripts\u002Fextract_metadata.py",5686,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fpydicom\u002Fscripts\u002Fextract_metadata.py",{"path":136,"resourceType":119,"resourceTypeDesc":120,"sizeBytes":137,"sourceHtmlUrl":138},"scripts\u002Fprocess.py",15194,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhardening-docker-containers-for-production\u002Fscripts\u002Fprocess.py",[140,165,189,217,243,270],{"skillNo":141,"name":142,"nameZh":6,"description":143,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":144,"categories":145,"keywords":147,"publishedAt":40},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[146],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[148,149,150,151,32,33,152,153,35,154,155,156,157,158,159,160,161,162,163,164],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":166,"name":167,"nameZh":6,"description":168,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":169,"categories":170,"keywords":172,"publishedAt":40},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[171],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[173,161,174,175,32,176,33,35,177,178,179,180,181,182,183,184,185,186,187,188],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":190,"name":191,"nameZh":6,"description":192,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":193,"categories":194,"keywords":199,"publishedAt":40},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[195,198],{"categoryNo":196,"categoryName":197,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[183,200,201,202,203,33,204,205,177,206,207,208,209,210,211,212,213,214,215,216],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":218,"name":219,"nameZh":6,"description":220,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":221,"categories":222,"keywords":224,"publishedAt":40},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[223],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[225,226,227,33,228,229,230,231,232,233,234,235,236,237,238,239,180,240,241,242],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":244,"name":245,"nameZh":6,"description":246,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":247,"categories":248,"keywords":250,"publishedAt":40},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[249],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[251,252,253,33,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":271,"name":272,"nameZh":6,"description":273,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":274,"categories":275,"keywords":277,"publishedAt":40},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[276],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[32,278,33,279,280,281,282,283,284,285,286,212,287,213,288,289,290,291,292,293],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]