[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AF1TQN1TR60WB3SVNB8GSE":3,"skill-same:01M6AF1TQN1TR60WB3SVNB8GSE":140},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":61,"commitSha":62,"skillDirectory":63,"forksCount":64,"repositoryHtmlUrl":65,"repositoryHomepageUrl":66,"ownerHtmlUrl":67,"ownerBlogUrl":68,"ownerDescription":69,"updatedAt":70,"install":71,"resources":84},"01M6AF1TQN1TR60WB3SVNB8GSE","implementing-cloud-vulnerability-posture-management",null,"Implement multi-cloud CSPM to detect cloud-native misconfigurations and vulnerabilities (IAM over-permissions, exposed storage, unencrypted data, missing network controls) using AWS Security Hub, Azure Defender for Cloud, and open-source Prowler and ScoutSuite scans, then aggregate results across clouds. Use when auditing multi-cloud environments for misconfiguration-driven vulnerabilities or building a consolidated cross-cloud posture report.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-cloud-vulnerability-posture-management\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"implementing cloud vulnerability posture management","cloud","prowler","scoutsuite","multi-cloud","aws-security-hub","cspm","security-hub","t1078","vulnerability-management","iam","security","data","network","cloud-security","permissions","azure","defender","storage","cybersecurity","2026-11-10 10:12:30",false,"---\nname: implementing-cloud-vulnerability-posture-management\ndescription: Implement multi-cloud CSPM to detect cloud-native misconfigurations\n  and vulnerabilities (IAM over-permissions, exposed storage, unencrypted data, missing\n  network controls) using AWS Security Hub, Azure Defender for Cloud, and open-source\n  Prowler and ScoutSuite scans, then aggregate results across clouds. Use when auditing\n  multi-cloud environments for misconfiguration-driven vulnerabilities or building\n  a consolidated cross-cloud posture report.\ndomain: cybersecurity\nsubdomain: vulnerability-management\ntags:\n- cspm\n- cloud-security\n- aws-security-hub\n- azure-defender\n- prowler\n- scoutsuite\n- misconfiguration\n- cnapp\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- ID.RA-01\n- ID.RA-02\n- ID.IM-02\n- ID.RA-06\nmitre_attack:\n- T1190\n- T1203\n- T1068\n- T1078.004\n- T1530\n---\n\n# Implementing Cloud Vulnerability Posture Management\n\n## Overview\n\nCloud Security Posture Management (CSPM) continuously monitors cloud infrastructure for misconfigurations, compliance violations, and security risks. Unlike traditional vulnerability scanning, CSPM focuses on cloud-native risks: IAM over-permissions, exposed storage buckets, unencrypted data, missing network controls, and service misconfigurations. This skill covers multi-cloud CSPM using AWS Security Hub, Azure Defender for Cloud, and open-source tools like Prowler and ScoutSuite.\n\n\n## When to Use\n\n- When deploying or configuring implementing cloud vulnerability posture management capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- AWS CLI configured with SecurityAudit IAM policy\n- Azure CLI with Security Reader role\n- Python 3.9+ with `boto3`, `azure-identity`, `azure-mgmt-security`\n- Prowler (https:\u002F\u002Fgithub.com\u002Fprowler-cloud\u002Fprowler)\n- ScoutSuite (https:\u002F\u002Fgithub.com\u002Fnccgroup\u002FScoutSuite)\n\n## AWS Security Hub\n\n### Enable Security Hub\n```bash\n# Enable AWS Security Hub with default standards\naws securityhub enable-security-hub \\\n  --enable-default-standards \\\n  --region us-east-1\n\n# Enable specific standards\naws securityhub batch-enable-standards \\\n  --standards-subscription-requests \\\n    '{\"StandardsArn\":\"arn:aws:securityhub:us-east-1::standards\u002Faws-foundational-security-best-practices\u002Fv\u002F1.0.0\"}' \\\n    '{\"StandardsArn\":\"arn:aws:securityhub:us-east-1::standards\u002Fcis-aws-foundations-benchmark\u002Fv\u002F1.4.0\"}'\n\n# Get findings summary\naws securityhub get-findings \\\n  --filters '{\"SeverityLabel\":[{\"Value\":\"CRITICAL\",\"Comparison\":\"EQUALS\"}],\"RecordState\":[{\"Value\":\"ACTIVE\",\"Comparison\":\"EQUALS\"}]}' \\\n  --max-items 10\n```\n\n### Security Hub Standards\n| Standard | Description |\n|----------|------------|\n| AWS Foundational Security Best Practices | AWS-recommended baseline controls |\n| CIS AWS Foundations Benchmark 1.4 | CIS hardening requirements |\n| PCI DSS v3.2.1 | Payment card industry controls |\n| NIST SP 800-53 Rev 5 | Federal security controls |\n\n## Azure Defender for Cloud\n\n### Enable Defender CSPM\n```bash\n# Enable Defender for Cloud free tier\naz security pricing create \\\n  --name CloudPosture \\\n  --tier standard\n\n# Check secure score\naz security secure-score list \\\n  --query \"[].{Name:displayName,Score:current,Max:max}\" \\\n  --output table\n\n# Get security recommendations\naz security assessment list \\\n  --query \"[?status.code=='Unhealthy'].{Name:displayName,Severity:metadata.severity,Resource:resourceDetails.id}\" \\\n  --output table\n\n# Get alerts\naz security alert list \\\n  --query \"[?status=='Active'].{Name:alertDisplayName,Severity:severity,Time:timeGeneratedUtc}\" \\\n  --output table\n```\n\n## Open-Source: Prowler\n\n### Installation and Execution\n```bash\n# Install Prowler\npip install prowler\n\n# Run full AWS scan\nprowler aws --output-formats json-ocsf,csv,html\n\n# Run specific checks\nprowler aws --checks s3_bucket_public_access iam_root_mfa_enabled ec2_sg_open_to_internet\n\n# Run against specific AWS profile and region\nprowler aws --profile production --region us-east-1 --output-formats json-ocsf\n\n# Run CIS Benchmark compliance check\nprowler aws --compliance cis_1.5_aws\n\n# Run PCI DSS compliance\nprowler aws --compliance pci_3.2.1_aws\n\n# Scan Azure environment\nprowler azure --subscription-ids \"sub-id-here\"\n\n# Scan GCP environment\nprowler gcp --project-ids \"project-id-here\"\n```\n\n### Prowler Check Categories\n| Category | Examples |\n|----------|---------|\n| IAM | Root MFA, password policy, access key rotation |\n| S3 | Public access, encryption, versioning |\n| EC2 | Security groups, EBS encryption, metadata service |\n| RDS | Public access, encryption, backup retention |\n| CloudTrail | Enabled, encrypted, log validation |\n| VPC | Flow logs, default SG restrictions |\n| Lambda | Public access, runtime versions |\n| EKS | Public endpoint, secrets encryption |\n\n## Open-Source: ScoutSuite\n\n```bash\n# Install ScoutSuite\npip install scoutsuite\n\n# Run AWS assessment\nscout aws --profile production\n\n# Run Azure assessment\nscout azure --cli\n\n# Run GCP assessment\nscout gcp --project-id my-project\n\n# Results available as interactive HTML report\n# Open scout-report\u002Freport.html in browser\n```\n\n## Multi-Cloud Aggregation\n\n```python\nimport json\nimport subprocess\nfrom datetime import datetime, timezone\n\ndef run_prowler_scan(provider, output_dir, compliance=None):\n    \"\"\"Run Prowler scan for a cloud provider.\"\"\"\n    cmd = [\"prowler\", provider, \"--output-formats\", \"json-ocsf\",\n           \"--output-directory\", output_dir]\n    if compliance:\n        cmd.extend([\"--compliance\", compliance])\n    result = subprocess.run(cmd, capture_output=True, text=True, timeout=3600)\n    return result.returncode == 0\n\ndef aggregate_findings(prowler_dirs):\n    \"\"\"Aggregate findings from multiple Prowler scans.\"\"\"\n    all_findings = []\n    for scan_dir in prowler_dirs:\n        json_files = list(Path(scan_dir).glob(\"*.json\"))\n        for jf in json_files:\n            with open(jf, \"r\") as f:\n                for line in f:\n                    try:\n                        finding = json.loads(line.strip())\n                        all_findings.append(finding)\n                    except json.JSONDecodeError:\n                        continue\n    # Sort by severity\n    severity_order = {\"critical\": 0, \"high\": 1, \"medium\": 2, \"low\": 3, \"informational\": 4}\n    all_findings.sort(key=lambda f: severity_order.get(\n        f.get(\"severity\", \"informational\").lower(), 5\n    ))\n    return all_findings\n\ndef generate_posture_report(findings, output_path):\n    \"\"\"Generate cloud security posture report.\"\"\"\n    report = {\n        \"generated_at\": datetime.now(timezone.utc).isoformat(),\n        \"total_findings\": len(findings),\n        \"by_severity\": {},\n        \"by_provider\": {},\n        \"by_service\": {},\n    }\n    for f in findings:\n        sev = f.get(\"severity\", \"unknown\")\n        provider = f.get(\"cloud_provider\", \"unknown\")\n        service = f.get(\"service_name\", \"unknown\")\n        report[\"by_severity\"][sev] = report[\"by_severity\"].get(sev, 0) + 1\n        report[\"by_provider\"][provider] = report[\"by_provider\"].get(provider, 0) + 1\n        report[\"by_service\"][service] = report[\"by_service\"].get(service, 0) + 1\n\n    with open(output_path, \"w\") as f:\n        json.dump(report, f, indent=2)\n    return report\n```\n\n## References\n\n- [AWS Security Hub](https:\u002F\u002Faws.amazon.com\u002Fsecurity-hub\u002F)\n- [Azure Defender for Cloud](https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fazure\u002Fdefender-for-cloud\u002F)\n- [Prowler](https:\u002F\u002Fgithub.com\u002Fprowler-cloud\u002Fprowler)\n- [ScoutSuite](https:\u002F\u002Fgithub.com\u002Fnccgroup\u002FScoutSuite)\n- [CIS Benchmarks](https:\u002F\u002Fwww.cisecurity.org\u002Fcis-benchmarks)\n","# Implementing Cloud Vulnerability Posture Management\n\n## Overview\n\nCloud Security Posture Management (CSPM) continuously monitors cloud infrastructure for misconfigurations, compliance violations, and security risks. Unlike traditional vulnerability scanning, CSPM focuses on cloud-native risks: IAM over-permissions, exposed storage buckets, unencrypted data, missing network controls, and service misconfigurations. This skill covers multi-cloud CSPM using AWS Security Hub, Azure Defender for Cloud, and open-source tools like Prowler and ScoutSuite.\n\n\n## When to Use\n\n- When deploying or configuring implementing cloud vulnerability posture management capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- AWS CLI configured with SecurityAudit IAM policy\n- Azure CLI with Security Reader role\n- Python 3.9+ with `boto3`, `azure-identity`, `azure-mgmt-security`\n- Prowler (https:\u002F\u002Fgithub.com\u002Fprowler-cloud\u002Fprowler)\n- ScoutSuite (https:\u002F\u002Fgithub.com\u002Fnccgroup\u002FScoutSuite)\n\n## AWS Security Hub\n\n### Enable Security Hub\n```bash\n# Enable AWS Security Hub with default standards\naws securityhub enable-security-hub \\\n  --enable-default-standards \\\n  --region us-east-1\n\n# Enable specific standards\naws securityhub batch-enable-standards \\\n  --standards-subscription-requests \\\n    '{\"StandardsArn\":\"arn:aws:securityhub:us-east-1::standards\u002Faws-foundational-security-best-practices\u002Fv\u002F1.0.0\"}' \\\n    '{\"StandardsArn\":\"arn:aws:securityhub:us-east-1::standards\u002Fcis-aws-foundations-benchmark\u002Fv\u002F1.4.0\"}'\n\n# Get findings summary\naws securityhub get-findings \\\n  --filters '{\"SeverityLabel\":[{\"Value\":\"CRITICAL\",\"Comparison\":\"EQUALS\"}],\"RecordState\":[{\"Value\":\"ACTIVE\",\"Comparison\":\"EQUALS\"}]}' \\\n  --max-items 10\n```\n\n### Security Hub Standards\n| Standard | Description |\n|----------|------------|\n| AWS Foundational Security Best Practices | AWS-recommended baseline controls |\n| CIS AWS Foundations Benchmark 1.4 | CIS hardening requirements |\n| PCI DSS v3.2.1 | Payment card industry controls |\n| NIST SP 800-53 Rev 5 | Federal security controls |\n\n## Azure Defender for Cloud\n\n### Enable Defender CSPM\n```bash\n# Enable Defender for Cloud free tier\naz security pricing create \\\n  --name CloudPosture \\\n  --tier standard\n\n# Check secure score\naz security secure-score list \\\n  --query \"[].{Name:displayName,Score:current,Max:max}\" \\\n  --output table\n\n# Get security recommendations\naz security assessment list \\\n  --query \"[?status.code=='Unhealthy'].{Name:displayName,Severity:metadata.severity,Resource:resourceDetails.id}\" \\\n  --output table\n\n# Get alerts\naz security alert list \\\n  --query \"[?status=='Active'].{Name:alertDisplayName,Severity:severity,Time:timeGeneratedUtc}\" \\\n  --output table\n```\n\n## Open-Source: Prowler\n\n### Installation and Execution\n```bash\n# Install Prowler\npip install prowler\n\n# Run full AWS scan\nprowler aws --output-formats json-ocsf,csv,html\n\n# Run specific checks\nprowler aws --checks s3_bucket_public_access iam_root_mfa_enabled ec2_sg_open_to_internet\n\n# Run against specific AWS profile and region\nprowler aws --profile production --region us-east-1 --output-formats json-ocsf\n\n# Run CIS Benchmark compliance check\nprowler aws --compliance cis_1.5_aws\n\n# Run PCI DSS compliance\nprowler aws --compliance pci_3.2.1_aws\n\n# Scan Azure environment\nprowler azure --subscription-ids \"sub-id-here\"\n\n# Scan GCP environment\nprowler gcp --project-ids \"project-id-here\"\n```\n\n### Prowler Check Categories\n| Category | Examples |\n|----------|---------|\n| IAM | Root MFA, password policy, access key rotation |\n| S3 | Public access, encryption, versioning |\n| EC2 | Security groups, EBS encryption, metadata service |\n| RDS | Public access, encryption, backup retention |\n| CloudTrail | Enabled, encrypted, log validation |\n| VPC | Flow logs, default SG restrictions |\n| Lambda | Public access, runtime versions |\n| EKS | Public endpoint, secrets encryption |\n\n## Open-Source: ScoutSuite\n\n```bash\n# Install ScoutSuite\npip install scoutsuite\n\n# Run AWS assessment\nscout aws --profile production\n\n# Run Azure assessment\nscout azure --cli\n\n# Run GCP assessment\nscout gcp --project-id my-project\n\n# Results available as interactive HTML report\n# Open scout-report\u002Freport.html in browser\n```\n\n## Multi-Cloud Aggregation\n\n```python\nimport json\nimport subprocess\nfrom datetime import datetime, timezone\n\ndef run_prowler_scan(provider, output_dir, compliance=None):\n    \"\"\"Run Prowler scan for a cloud provider.\"\"\"\n    cmd = [\"prowler\", provider, \"--output-formats\", \"json-ocsf\",\n           \"--output-directory\", output_dir]\n    if compliance:\n        cmd.extend([\"--compliance\", compliance])\n    result = subprocess.run(cmd, capture_output=True, text=True, timeout=3600)\n    return result.returncode == 0\n\ndef aggregate_findings(prowler_dirs):\n    \"\"\"Aggregate findings from multiple Prowler scans.\"\"\"\n    all_findings = []\n    for scan_dir in prowler_dirs:\n        json_files = list(Path(scan_dir).glob(\"*.json\"))\n        for jf in json_files:\n            with open(jf, \"r\") as f:\n                for line in f:\n                    try:\n                        finding = json.loads(line.strip())\n                        all_findings.append(finding)\n                    except json.JSONDecodeError:\n                        continue\n    # Sort by severity\n    severity_order = {\"critical\": 0, \"high\": 1, \"medium\": 2, \"low\": 3, \"informational\": 4}\n    all_findings.sort(key=lambda f: severity_order.get(\n        f.get(\"severity\", \"informational\").lower(), 5\n    ))\n    return all_findings\n\ndef generate_posture_report(findings, output_path):\n    \"\"\"Generate cloud security posture report.\"\"\"\n    report = {\n        \"generated_at\": datetime.now(timezone.utc).isoformat(),\n        \"total_findings\": len(findings),\n        \"by_severity\": {},\n        \"by_provider\": {},\n        \"by_service\": {},\n    }\n    for f in findings:\n        sev = f.get(\"severity\", \"unknown\")\n        provider = f.get(\"cloud_provider\", \"unknown\")\n        service = f.get(\"service_name\", \"unknown\")\n        report[\"by_severity\"][sev] = report[\"by_severity\"].get(sev, 0) + 1\n        report[\"by_provider\"][provider] = report[\"by_provider\"].get(provider, 0) + 1\n        report[\"by_service\"][service] = report[\"by_service\"].get(service, 0) + 1\n\n    with open(output_path, \"w\") as f:\n        json.dump(report, f, indent=2)\n    return report\n```\n\n## References\n\n- [AWS Security Hub](https:\u002F\u002Faws.amazon.com\u002Fsecurity-hub\u002F)\n- [Azure Defender for Cloud](https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fazure\u002Fdefender-for-cloud\u002F)\n- [Prowler](https:\u002F\u002Fgithub.com\u002Fprowler-cloud\u002Fprowler)\n- [ScoutSuite](https:\u002F\u002Fgithub.com\u002Fnccgroup\u002FScoutSuite)\n- [CIS Benchmarks](https:\u002F\u002Fwww.cisecurity.org\u002Fcis-benchmarks)\n",{"name":5,"tags":44,"author":48,"domain":38,"license":15,"version":49,"nist_csf":50,"subdomain":28,"description":7,"mitre_attack":55},[25,33,24,45,21,22,46,47],"azure-defender","misconfiguration","cnapp","mahipal","1.0",[51,52,53,54],"ID.RA-01","ID.RA-02","ID.IM-02","ID.RA-06",[56,57,58,59,60],"T1190","T1203","T1068","T1078.004","T1530","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fimplementing-cloud-vulnerability-posture-management",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":72,"prompt":82,"zipAvailable":83},[73,76,79],{"tool":74,"command":75},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-cloud-vulnerability-posture-management",{"tool":77,"command":78},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-cloud-vulnerability-posture-management",{"tool":80,"command":81},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-cloud-vulnerability-posture-management","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-cloud-vulnerability-posture-management\u002FSKILL.md",true,[85,91,96,102,106,110,114,118,122,126,130,136],{"path":86,"resourceType":87,"resourceTypeDesc":88,"sizeBytes":89,"sourceHtmlUrl":90},"assets\u002Ftemplate.md","ASSET","资产文件",1473,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-cloud-vulnerability-posture-management\u002Fassets\u002Ftemplate.md",{"path":92,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":94,"sourceHtmlUrl":95},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-cloud-vulnerability-posture-management\u002FLICENSE",{"path":97,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":100,"sourceHtmlUrl":101},"references\u002Fadvanced-topics.md","REFERENCE","参考文档",13132,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fsympy\u002Freferences\u002Fadvanced-topics.md",{"path":103,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":104,"sourceHtmlUrl":105},"references\u002Fapi-reference.md",1693,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-cloud-vulnerability-posture-management\u002Freferences\u002Fapi-reference.md",{"path":107,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":108,"sourceHtmlUrl":109},"references\u002Fcode-generation-printing.md",12427,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fsympy\u002Freferences\u002Fcode-generation-printing.md",{"path":111,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":112,"sourceHtmlUrl":113},"references\u002Fcore-capabilities.md",7754,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fsympy\u002Freferences\u002Fcore-capabilities.md",{"path":115,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":116,"sourceHtmlUrl":117},"references\u002Fmatrices-linear-algebra.md",9639,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fsympy\u002Freferences\u002Fmatrices-linear-algebra.md",{"path":119,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":120,"sourceHtmlUrl":121},"references\u002Fphysics-mechanics.md",12053,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fsympy\u002Freferences\u002Fphysics-mechanics.md",{"path":123,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":124,"sourceHtmlUrl":125},"references\u002Fstandards.md",1688,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-cloud-vulnerability-posture-management\u002Freferences\u002Fstandards.md",{"path":127,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":128,"sourceHtmlUrl":129},"references\u002Fworkflows.md",1333,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-cloud-vulnerability-posture-management\u002Freferences\u002Fworkflows.md",{"path":131,"resourceType":132,"resourceTypeDesc":133,"sizeBytes":134,"sourceHtmlUrl":135},"scripts\u002Fagent.py","SCRIPT","脚本",5376,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-cloud-vulnerability-posture-management\u002Fscripts\u002Fagent.py",{"path":137,"resourceType":132,"resourceTypeDesc":133,"sizeBytes":138,"sourceHtmlUrl":139},"scripts\u002Fprocess.py",7651,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-cloud-vulnerability-posture-management\u002Fscripts\u002Fprocess.py",[141,171,195,222,247,273],{"skillNo":142,"name":143,"nameZh":6,"description":144,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":145,"categories":146,"keywords":152,"publishedAt":39},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[147],{"categoryNo":148,"categoryName":149,"taxonomyType":150,"taxonomyTypeDesc":151},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[153,154,155,156,30,38,157,158,159,160,161,162,163,164,165,166,167,168,169,170],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":172,"name":173,"nameZh":6,"description":174,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":175,"categories":176,"keywords":178,"publishedAt":39},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[177],{"categoryNo":148,"categoryName":149,"taxonomyType":150,"taxonomyTypeDesc":151},[179,167,180,181,30,182,38,159,183,184,185,186,187,188,189,190,191,192,193,194],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":196,"name":197,"nameZh":6,"description":198,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":199,"categories":200,"keywords":205,"publishedAt":39},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[201,204],{"categoryNo":202,"categoryName":203,"taxonomyType":150,"taxonomyTypeDesc":151},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":148,"categoryName":149,"taxonomyType":150,"taxonomyTypeDesc":151},[189,206,207,208,209,38,210,211,183,212,213,214,215,216,217,27,218,219,220,221],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":223,"name":224,"nameZh":6,"description":225,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":226,"categories":227,"keywords":229,"publishedAt":39},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[228],{"categoryNo":148,"categoryName":149,"taxonomyType":150,"taxonomyTypeDesc":151},[230,231,232,38,233,234,235,236,237,238,239,31,240,241,242,243,186,244,245,246],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":248,"name":249,"nameZh":6,"description":250,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":251,"categories":252,"keywords":254,"publishedAt":39},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[253],{"categoryNo":148,"categoryName":149,"taxonomyType":150,"taxonomyTypeDesc":151},[255,256,257,38,258,259,260,28,261,262,263,264,265,266,267,268,269,270,271,272],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":274,"name":275,"nameZh":6,"description":276,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":277,"categories":278,"keywords":280,"publishedAt":39},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[279],{"categoryNo":148,"categoryName":149,"taxonomyType":150,"taxonomyTypeDesc":151},[30,281,38,282,283,284,285,286,287,288,289,27,290,218,291,292,293,294,295,296],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]