[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AEZV4TEVWFSDD5RRBVR9NN":3,"skill-same:01M6AEZV4TEVWFSDD5RRBVR9NN":102},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":57,"commitSha":58,"skillDirectory":59,"forksCount":60,"repositoryHtmlUrl":61,"repositoryHomepageUrl":62,"ownerHtmlUrl":63,"ownerBlogUrl":64,"ownerDescription":65,"updatedAt":66,"install":67,"resources":80},"01M6AEZV4TEVWFSDD5RRBVR9NN","implementing-attack-surface-management",null,"Implements external attack surface management (EASM) using Shodan, Censys, and ProjectDiscovery tools (subfinder, httpx, nuclei) for asset discovery, subdomain enumeration, service fingerprinting, and exposure scoring. Includes a weighted risk scoring algorithm based on OWASP attack surface analysis methodology and the Relative Attack Surface Quotient (RSQ). Use when building continuous ASM programs or performing external reconnaissance for security assessments.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-attack-surface-management\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"implementing attack surface management","enumeration","asset-discovery","nuclei","subfinder","censys","risk","t1059","Tools","t1078","security","attack-surface","offensive-security","Shodan","owasp","methodology","reconnaissance","risk scoring","cybersecurity","2026-11-10 10:12:30",false,"---\nname: implementing-attack-surface-management\ndescription: 'Implements external attack surface management (EASM) using Shodan, Censys,\n  and ProjectDiscovery tools (subfinder, httpx, nuclei) for asset discovery, subdomain\n  enumeration, service fingerprinting, and exposure scoring. Includes a weighted risk\n  scoring algorithm based on OWASP attack surface analysis methodology and the Relative\n  Attack Surface Quotient (RSQ). Use when building continuous ASM programs or performing\n  external reconnaissance for security assessments.\n\n  '\ndomain: cybersecurity\nsubdomain: offensive-security\ntags:\n- attack-surface\n- reconnaissance\n- shodan\n- censys\n- subfinder\n- nuclei\n- asset-discovery\nversion: '1.0'\nauthor: mukul975\nlicense: Apache-2.0\nnist_csf:\n- ID.RA-01\n- GV.OV-02\n- DE.AE-07\nmitre_attack:\n- T1078\n- T1190\n- T1059\n- T1595\n- T1592\n---\n\n# Implementing Attack Surface Management\n\n## When to Use\n\n- When building an external attack surface management (EASM) program from scratch\n- When performing authorized external reconnaissance for penetration testing engagements\n- When continuously monitoring organizational exposure across internet-facing assets\n- When scoring and prioritizing external attack surface risks for remediation\n- When integrating multiple discovery tools into an automated ASM pipeline\n\n## Prerequisites\n\n- Python 3.8+ with requests, shodan, censys libraries installed\n- Shodan API key (free tier provides 100 queries\u002Fmonth)\n- Censys API ID and Secret (free tier available)\n- ProjectDiscovery tools installed: subfinder, httpx, nuclei\n- Go 1.21+ for building ProjectDiscovery tools from source\n- Appropriate authorization for all external scanning activities\n- Target domains and IP ranges with written scope documentation\n\n## Instructions\n\n### Phase 1: Subdomain Enumeration with Multiple Sources\n\nUse subfinder for passive subdomain discovery leveraging dozens of data sources\nincluding certificate transparency logs, DNS datasets, and search engines.\n\n```bash\n# Install ProjectDiscovery tools\ngo install -v github.com\u002Fprojectdiscovery\u002Fsubfinder\u002Fv2\u002Fcmd\u002Fsubfinder@latest\ngo install -v github.com\u002Fprojectdiscovery\u002Fhttpx\u002Fcmd\u002Fhttpx@latest\ngo install -v github.com\u002Fprojectdiscovery\u002Fnuclei\u002Fv3\u002Fcmd\u002Fnuclei@latest\n\n# Basic subdomain enumeration\nsubfinder -d example.com -o subdomains.txt\n\n# Verbose with all sources and recursive enumeration\nsubfinder -d example.com -all -recursive -o subdomains_full.txt\n\n# Multi-domain enumeration from file\nsubfinder -dL domains.txt -o all_subdomains.txt\n\n# Using OWASP Amass for deeper enumeration\namass enum -d example.com -passive -o amass_subdomains.txt\n\n# Merge and deduplicate results\ncat subdomains.txt amass_subdomains.txt | sort -u > combined_subdomains.txt\n```\n\n### Phase 2: Live Host Discovery and Service Fingerprinting\n\nProbe discovered subdomains to identify live hosts, technologies, and services.\n\n```bash\n# HTTP probing with technology detection\ncat combined_subdomains.txt | httpx -sc -cl -ct -title -tech-detect \\\n    -follow-redirects -json -o httpx_results.json\n\n# Detailed service fingerprinting\ncat combined_subdomains.txt | httpx -sc -cl -ct -title -tech-detect \\\n    -favicon -hash sha256 -jarm -cdn -cname \\\n    -follow-redirects -json -o httpx_detailed.json\n```\n\n### Phase 3: Shodan Asset Discovery\n\nQuery Shodan for exposed services, open ports, and known vulnerabilities\nassociated with discovered assets.\n\n```python\nimport shodan\n\napi = shodan.Shodan(\"YOUR_SHODAN_API_KEY\")\n\n# Search by organization\nresults = api.search(\"org:\\\"Example Corp\\\"\")\nfor service in results[\"matches\"]:\n    print(f\"{service['ip_str']}:{service['port']} - {service.get('product', 'unknown')}\")\n    if service.get(\"vulns\"):\n        for cve in service[\"vulns\"]:\n            print(f\"  CVE: {cve}\")\n\n# Search by hostname\nresults = api.search(\"hostname:example.com\")\n\n# Search by SSL certificate\nresults = api.search(\"ssl.cert.subject.cn:example.com\")\n\n# Get host details with all services\nhost = api.host(\"93.184.216.34\")\nprint(f\"IP: {host['ip_str']}\")\nprint(f\"Ports: {host['ports']}\")\nprint(f\"Vulns: {host.get('vulns', [])}\")\n```\n\n### Phase 4: Censys Asset Discovery\n\nUse Censys to discover internet-facing assets through certificate and host search.\n\n```python\nfrom censys.search import CensysHosts, CensysCerts\n\n# Host search\nhosts = CensysHosts()\nquery = hosts.search(\"services.tls.certificates.leaf.subject.common_name: example.com\")\nfor page in query:\n    for host in page:\n        print(f\"IP: {host['ip']}\")\n        for service in host.get(\"services\", []):\n            print(f\"  Port: {service['port']} Protocol: {service['transport_protocol']}\")\n            print(f\"  Service: {service.get('service_name', 'unknown')}\")\n\n# Certificate transparency search\ncerts = CensysCerts()\nquery = certs.search(\"parsed.names: example.com\")\nfor page in query:\n    for cert in page:\n        print(f\"Fingerprint: {cert['fingerprint_sha256']}\")\n        print(f\"Names: {cert.get('parsed', {}).get('names', [])}\")\n```\n\n### Phase 5: Vulnerability Scanning with Nuclei\n\nRun targeted vulnerability scans against discovered assets using Nuclei templates.\n\n```bash\n# Update nuclei templates\nnuclei -ut\n\n# Scan with all templates\ncat combined_subdomains.txt | httpx -silent | nuclei -o nuclei_results.txt\n\n# Scan with specific severity\ncat combined_subdomains.txt | httpx -silent | \\\n    nuclei -severity critical,high -o critical_findings.txt\n\n# Scan with specific template categories\ncat combined_subdomains.txt | httpx -silent | \\\n    nuclei -tags cve,misconfig,exposure -o categorized_findings.txt\n\n# Scan for exposed panels and sensitive files\ncat combined_subdomains.txt | httpx -silent | \\\n    nuclei -tags panel,exposure,config -o exposed_panels.txt\n```\n\n### Phase 6: Exposure Scoring Algorithm\n\nScore each asset based on OWASP attack surface analysis principles, using\na weighted formula derived from the Relative Attack Surface Quotient (RSQ)\nand damage-potential-to-effort ratio.\n\nThe scoring algorithm considers:\n1. **Open ports and services** - weighted by service risk (management ports score higher)\n2. **Known vulnerabilities** - weighted by CVSS score\n3. **Technology age** - outdated software increases score\n4. **Exposure level** - internet-facing vs. authenticated access\n5. **Data sensitivity** - based on service type and content indicators\n\n```python\n# Exposure Score = sum of weighted factors, normalized to 0-100\n# See agent.py for the full implementation\n```\n\n## Examples\n\n```bash\n# Run complete ASM pipeline against a target domain\npython agent.py \\\n    --domain example.com \\\n    --action full_scan \\\n    --shodan-key YOUR_KEY \\\n    --censys-id YOUR_ID \\\n    --censys-secret YOUR_SECRET \\\n    --output asm_report.json\n\n# Subdomain enumeration only\npython agent.py \\\n    --domain example.com \\\n    --action enumerate \\\n    --output subdomains.json\n\n# Exposure scoring on previously discovered assets\npython agent.py \\\n    --domain example.com \\\n    --action score \\\n    --input previous_scan.json \\\n    --output scored_assets.json\n\n# Multi-domain scan from file\npython agent.py \\\n    --domain-list targets.txt \\\n    --action full_scan \\\n    --output multi_domain_report.json\n```\n","# Implementing Attack Surface Management\n\n## When to Use\n\n- When building an external attack surface management (EASM) program from scratch\n- When performing authorized external reconnaissance for penetration testing engagements\n- When continuously monitoring organizational exposure across internet-facing assets\n- When scoring and prioritizing external attack surface risks for remediation\n- When integrating multiple discovery tools into an automated ASM pipeline\n\n## Prerequisites\n\n- Python 3.8+ with requests, shodan, censys libraries installed\n- Shodan API key (free tier provides 100 queries\u002Fmonth)\n- Censys API ID and Secret (free tier available)\n- ProjectDiscovery tools installed: subfinder, httpx, nuclei\n- Go 1.21+ for building ProjectDiscovery tools from source\n- Appropriate authorization for all external scanning activities\n- Target domains and IP ranges with written scope documentation\n\n## Instructions\n\n### Phase 1: Subdomain Enumeration with Multiple Sources\n\nUse subfinder for passive subdomain discovery leveraging dozens of data sources\nincluding certificate transparency logs, DNS datasets, and search engines.\n\n```bash\n# Install ProjectDiscovery tools\ngo install -v github.com\u002Fprojectdiscovery\u002Fsubfinder\u002Fv2\u002Fcmd\u002Fsubfinder@latest\ngo install -v github.com\u002Fprojectdiscovery\u002Fhttpx\u002Fcmd\u002Fhttpx@latest\ngo install -v github.com\u002Fprojectdiscovery\u002Fnuclei\u002Fv3\u002Fcmd\u002Fnuclei@latest\n\n# Basic subdomain enumeration\nsubfinder -d example.com -o subdomains.txt\n\n# Verbose with all sources and recursive enumeration\nsubfinder -d example.com -all -recursive -o subdomains_full.txt\n\n# Multi-domain enumeration from file\nsubfinder -dL domains.txt -o all_subdomains.txt\n\n# Using OWASP Amass for deeper enumeration\namass enum -d example.com -passive -o amass_subdomains.txt\n\n# Merge and deduplicate results\ncat subdomains.txt amass_subdomains.txt | sort -u > combined_subdomains.txt\n```\n\n### Phase 2: Live Host Discovery and Service Fingerprinting\n\nProbe discovered subdomains to identify live hosts, technologies, and services.\n\n```bash\n# HTTP probing with technology detection\ncat combined_subdomains.txt | httpx -sc -cl -ct -title -tech-detect \\\n    -follow-redirects -json -o httpx_results.json\n\n# Detailed service fingerprinting\ncat combined_subdomains.txt | httpx -sc -cl -ct -title -tech-detect \\\n    -favicon -hash sha256 -jarm -cdn -cname \\\n    -follow-redirects -json -o httpx_detailed.json\n```\n\n### Phase 3: Shodan Asset Discovery\n\nQuery Shodan for exposed services, open ports, and known vulnerabilities\nassociated with discovered assets.\n\n```python\nimport shodan\n\napi = shodan.Shodan(\"YOUR_SHODAN_API_KEY\")\n\n# Search by organization\nresults = api.search(\"org:\\\"Example Corp\\\"\")\nfor service in results[\"matches\"]:\n    print(f\"{service['ip_str']}:{service['port']} - {service.get('product', 'unknown')}\")\n    if service.get(\"vulns\"):\n        for cve in service[\"vulns\"]:\n            print(f\"  CVE: {cve}\")\n\n# Search by hostname\nresults = api.search(\"hostname:example.com\")\n\n# Search by SSL certificate\nresults = api.search(\"ssl.cert.subject.cn:example.com\")\n\n# Get host details with all services\nhost = api.host(\"93.184.216.34\")\nprint(f\"IP: {host['ip_str']}\")\nprint(f\"Ports: {host['ports']}\")\nprint(f\"Vulns: {host.get('vulns', [])}\")\n```\n\n### Phase 4: Censys Asset Discovery\n\nUse Censys to discover internet-facing assets through certificate and host search.\n\n```python\nfrom censys.search import CensysHosts, CensysCerts\n\n# Host search\nhosts = CensysHosts()\nquery = hosts.search(\"services.tls.certificates.leaf.subject.common_name: example.com\")\nfor page in query:\n    for host in page:\n        print(f\"IP: {host['ip']}\")\n        for service in host.get(\"services\", []):\n            print(f\"  Port: {service['port']} Protocol: {service['transport_protocol']}\")\n            print(f\"  Service: {service.get('service_name', 'unknown')}\")\n\n# Certificate transparency search\ncerts = CensysCerts()\nquery = certs.search(\"parsed.names: example.com\")\nfor page in query:\n    for cert in page:\n        print(f\"Fingerprint: {cert['fingerprint_sha256']}\")\n        print(f\"Names: {cert.get('parsed', {}).get('names', [])}\")\n```\n\n### Phase 5: Vulnerability Scanning with Nuclei\n\nRun targeted vulnerability scans against discovered assets using Nuclei templates.\n\n```bash\n# Update nuclei templates\nnuclei -ut\n\n# Scan with all templates\ncat combined_subdomains.txt | httpx -silent | nuclei -o nuclei_results.txt\n\n# Scan with specific severity\ncat combined_subdomains.txt | httpx -silent | \\\n    nuclei -severity critical,high -o critical_findings.txt\n\n# Scan with specific template categories\ncat combined_subdomains.txt | httpx -silent | \\\n    nuclei -tags cve,misconfig,exposure -o categorized_findings.txt\n\n# Scan for exposed panels and sensitive files\ncat combined_subdomains.txt | httpx -silent | \\\n    nuclei -tags panel,exposure,config -o exposed_panels.txt\n```\n\n### Phase 6: Exposure Scoring Algorithm\n\nScore each asset based on OWASP attack surface analysis principles, using\na weighted formula derived from the Relative Attack Surface Quotient (RSQ)\nand damage-potential-to-effort ratio.\n\nThe scoring algorithm considers:\n1. **Open ports and services** - weighted by service risk (management ports score higher)\n2. **Known vulnerabilities** - weighted by CVSS score\n3. **Technology age** - outdated software increases score\n4. **Exposure level** - internet-facing vs. authenticated access\n5. **Data sensitivity** - based on service type and content indicators\n\n```python\n# Exposure Score = sum of weighted factors, normalized to 0-100\n# See agent.py for the full implementation\n```\n\n## Examples\n\n```bash\n# Run complete ASM pipeline against a target domain\npython agent.py \\\n    --domain example.com \\\n    --action full_scan \\\n    --shodan-key YOUR_KEY \\\n    --censys-id YOUR_ID \\\n    --censys-secret YOUR_SECRET \\\n    --output asm_report.json\n\n# Subdomain enumeration only\npython agent.py \\\n    --domain example.com \\\n    --action enumerate \\\n    --output subdomains.json\n\n# Exposure scoring on previously discovered assets\npython agent.py \\\n    --domain example.com \\\n    --action score \\\n    --input previous_scan.json \\\n    --output scored_assets.json\n\n# Multi-domain scan from file\npython agent.py \\\n    --domain-list targets.txt \\\n    --action full_scan \\\n    --output multi_domain_report.json\n```\n",{"name":5,"tags":43,"author":9,"domain":37,"license":15,"version":45,"nist_csf":46,"subdomain":31,"description":50,"mitre_attack":51},[30,35,44,24,23,22,21],"shodan","1.0",[47,48,49],"ID.RA-01","GV.OV-02","DE.AE-07","Implements external attack surface management (EASM) using Shodan, Censys, and ProjectDiscovery tools (subfinder, httpx, nuclei) for asset discovery, subdomain enumeration, service fingerprinting, and exposure scoring. Includes a weighted risk scoring algorithm based on OWASP attack surface analysis methodology and the Relative Attack Surface Quotient (RSQ). Use when building continuous ASM programs or performing external reconnaissance for security assessments.\n",[52,53,54,55,56],"T1078","T1190","T1059","T1595","T1592","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fimplementing-attack-surface-management",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":68,"prompt":78,"zipAvailable":79},[69,72,75],{"tool":70,"command":71},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-attack-surface-management",{"tool":73,"command":74},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-attack-surface-management",{"tool":76,"command":77},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-attack-surface-management","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-attack-surface-management\u002FSKILL.md",true,[81,86,92,96],{"path":82,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":84,"sourceHtmlUrl":85},"LICENSE","许可证",802,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-attack-surface-management\u002FLICENSE",{"path":87,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":90,"sourceHtmlUrl":91},"references\u002Fapi-reference.md","REFERENCE","参考文档",9243,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-attack-surface-management\u002Freferences\u002Fapi-reference.md",{"path":93,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":94,"sourceHtmlUrl":95},"references\u002Fasm-reference.md",5611,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-attack-surface-management\u002Freferences\u002Fasm-reference.md",{"path":97,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":100,"sourceHtmlUrl":101},"scripts\u002Fagent.py","SCRIPT","脚本",34324,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-attack-surface-management\u002Fscripts\u002Fagent.py",[103,133,156,183,209,235],{"skillNo":104,"name":105,"nameZh":6,"description":106,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":107,"categories":108,"keywords":114,"publishedAt":38},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[109],{"categoryNo":110,"categoryName":111,"taxonomyType":112,"taxonomyTypeDesc":113},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[115,116,117,118,29,37,119,120,121,122,123,124,125,126,127,128,129,130,131,132],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":134,"name":135,"nameZh":6,"description":136,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":137,"categories":138,"keywords":140,"publishedAt":38},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[139],{"categoryNo":110,"categoryName":111,"taxonomyType":112,"taxonomyTypeDesc":113},[141,129,142,143,29,144,37,121,145,146,147,27,148,149,150,151,152,153,154,155],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":157,"name":158,"nameZh":6,"description":159,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":160,"categories":161,"keywords":166,"publishedAt":38},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[162,165],{"categoryNo":163,"categoryName":164,"taxonomyType":112,"taxonomyTypeDesc":113},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":110,"categoryName":111,"taxonomyType":112,"taxonomyTypeDesc":113},[150,167,168,169,170,37,171,172,145,173,174,175,176,177,178,28,179,180,181,182],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":184,"name":185,"nameZh":6,"description":186,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":187,"categories":188,"keywords":190,"publishedAt":38},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[189],{"categoryNo":110,"categoryName":111,"taxonomyType":112,"taxonomyTypeDesc":113},[191,192,193,37,194,195,196,197,198,199,200,201,202,203,204,205,27,206,207,208],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":210,"name":211,"nameZh":6,"description":212,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":213,"categories":214,"keywords":216,"publishedAt":38},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[215],{"categoryNo":110,"categoryName":111,"taxonomyType":112,"taxonomyTypeDesc":113},[217,218,219,37,220,221,222,223,224,225,226,227,228,229,25,230,231,232,233,234],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":236,"name":237,"nameZh":6,"description":238,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":239,"categories":240,"keywords":242,"publishedAt":38},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[241],{"categoryNo":110,"categoryName":111,"taxonomyType":112,"taxonomyTypeDesc":113},[29,243,37,244,245,246,247,248,249,250,251,28,252,179,253,254,255,256,257,258],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]