[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFMMNDWW4Q7G4R698EMN53":3,"skill-same:01M6AFMMNDWW4Q7G4R698EMN53":125},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":41,"linkOnly":42,"markdownContent":43,"markdownBody":44,"frontMatter":45,"refName":58,"commitSha":59,"skillDirectory":60,"forksCount":61,"repositoryHtmlUrl":62,"repositoryHomepageUrl":63,"ownerHtmlUrl":64,"ownerBlogUrl":65,"ownerDescription":66,"updatedAt":67,"install":68,"resources":81},"01M6AFMMNDWW4Q7G4R698EMN53","performing-asset-criticality-scoring-for-vulns",null,"Build a multi-factor asset criticality scoring model—incorporating data sensitivity, business function dependency, regulatory scope, network exposure, and recoverability—to produce a 1-5 criticality tier that weights vulnerability prioritization and remediation SLAs. Use when prioritizing vulnerability remediation by business impact or aligning CMDB asset data with risk-based patching timelines.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-asset-criticality-scoring-for-vulns\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40],"performing asset criticality scoring for vulns","risk","asset-classification","crown-jewels","business-impact","cmdb","asset-criticality","risk-based","vulnerability-prioritization","cybersecurity","multi-factor","remediation","risk-management","vulnerability-management","data","network","produce","2026-11-10 10:12:30",false,"---\nname: performing-asset-criticality-scoring-for-vulns\ndescription: Build a multi-factor asset criticality scoring model—incorporating data\n  sensitivity, business function dependency, regulatory scope, network exposure, and\n  recoverability—to produce a 1-5 criticality tier that weights vulnerability prioritization\n  and remediation SLAs. Use when prioritizing vulnerability remediation by business\n  impact or aligning CMDB asset data with risk-based patching timelines.\ndomain: cybersecurity\nsubdomain: vulnerability-management\ntags:\n- asset-criticality\n- vulnerability-prioritization\n- risk-management\n- cmdb\n- business-impact\n- crown-jewels\n- asset-classification\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- ID.RA-01\n- ID.RA-02\n- ID.IM-02\n- ID.RA-06\nmitre_attack:\n- T1190\n- T1203\n- T1068\n---\n# Performing Asset Criticality Scoring for Vulns\n\n## Overview\nAsset criticality scoring assigns a business impact rating to each IT asset so that vulnerability remediation efforts focus on systems with the greatest organizational risk. Without criticality context, a CVSS 9.0 vulnerability on a test server receives the same urgency as the same vulnerability on a payment processing database. This skill covers building a multi-factor scoring model incorporating data sensitivity, business function dependency, regulatory scope, network exposure, and recoverability to create a 1-5 criticality tier that directly modifies vulnerability remediation SLAs.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing asset criticality scoring for vulns\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n- Configuration Management Database (CMDB) or asset inventory\n- Business Impact Analysis (BIA) data\n- Data classification policy\n- Network architecture documentation\n- Stakeholder input from business unit owners\n\n## Core Concepts\n\n### Asset Criticality Scoring Model\n\n| Factor | Weight | Score Range | Description |\n|--------|--------|-------------|-------------|\n| Business Function Impact | 25% | 1-5 | How critical is the supported business process |\n| Data Sensitivity | 25% | 1-5 | Type and sensitivity of data processed\u002Fstored |\n| Regulatory Scope | 15% | 1-5 | Regulatory requirements (PCI, HIPAA, SOX) |\n| Network Exposure | 15% | 1-5 | Internet-facing vs internal-only |\n| Recoverability | 10% | 1-5 | RTO\u002FRPO requirements, DR capability |\n| User Population | 10% | 1-5 | Number of users\u002Fcustomers affected |\n\n### Criticality Tier Definitions\n\n| Tier | Score Range | Label | SLA Modifier | Examples |\n|------|------------|-------|-------------|---------|\n| 1 | 4.5-5.0 | Crown Jewels | -50% SLA | Domain controllers, payment systems, ERP |\n| 2 | 3.5-4.4 | High Value | -25% SLA | Email servers, HR systems, CI\u002FCD |\n| 3 | 2.5-3.4 | Standard | Baseline SLA | Internal apps, file servers |\n| 4 | 1.5-2.4 | Low Impact | +25% SLA | Test environments, printers |\n| 5 | 1.0-1.4 | Minimal | +50% SLA | Decommissioning, isolated labs |\n\n### Data Sensitivity Scoring\n\n| Score | Classification | Examples |\n|-------|---------------|---------|\n| 5 | Restricted\u002FSecret | PII, PHI, payment card data, trade secrets |\n| 4 | Confidential | Financial reports, HR records, source code |\n| 3 | Internal | Internal documents, policies, project files |\n| 2 | Semi-public | Marketing materials, press releases (draft) |\n| 1 | Public | Published content, public APIs |\n\n## Workflow\n\n### Step 1: Define Scoring Criteria\n\n```python\nclass AssetCriticalityScorer:\n    \"\"\"Multi-factor asset criticality scoring engine.\"\"\"\n\n    WEIGHTS = {\n        \"business_function\": 0.25,\n        \"data_sensitivity\": 0.25,\n        \"regulatory_scope\": 0.15,\n        \"network_exposure\": 0.15,\n        \"recoverability\": 0.10,\n        \"user_population\": 0.10,\n    }\n\n    TIER_THRESHOLDS = [\n        (4.5, 1, \"Crown Jewels\", -0.50),\n        (3.5, 2, \"High Value\", -0.25),\n        (2.5, 3, \"Standard\", 0.00),\n        (1.5, 4, \"Low Impact\", 0.25),\n        (1.0, 5, \"Minimal\", 0.50),\n    ]\n\n    def score_asset(self, asset):\n        \"\"\"Calculate criticality score for an asset.\"\"\"\n        weighted_score = sum(\n            asset.get(factor, 3) * weight\n            for factor, weight in self.WEIGHTS.items()\n        )\n        score = round(weighted_score, 2)\n\n        for threshold, tier, label, sla_mod in self.TIER_THRESHOLDS:\n            if score >= threshold:\n                return {\n                    \"score\": score,\n                    \"tier\": tier,\n                    \"label\": label,\n                    \"sla_modifier\": sla_mod,\n                }\n        return {\"score\": score, \"tier\": 5, \"label\": \"Minimal\", \"sla_modifier\": 0.50}\n\n    def adjust_vuln_sla(self, base_sla_days, asset_tier_data):\n        \"\"\"Adjust vulnerability SLA based on asset criticality.\"\"\"\n        modifier = asset_tier_data[\"sla_modifier\"]\n        adjusted = int(base_sla_days * (1 + modifier))\n        return max(1, adjusted)  # Minimum 1 day SLA\n```\n\n### Step 2: Integrate with Vulnerability Prioritization\n\n```python\ndef apply_criticality_to_vulns(vulns_df, asset_scores):\n    \"\"\"Enrich vulnerability data with asset criticality context.\"\"\"\n    for idx, vuln in vulns_df.iterrows():\n        asset_id = vuln.get(\"asset_id\", \"\")\n        asset_data = asset_scores.get(asset_id, {\"tier\": 3, \"sla_modifier\": 0})\n\n        vulns_df.at[idx, \"asset_tier\"] = asset_data[\"tier\"]\n        vulns_df.at[idx, \"asset_label\"] = asset_data.get(\"label\", \"Standard\")\n\n        base_sla = get_base_sla(vuln[\"severity\"])\n        adjusted_sla = int(base_sla * (1 + asset_data[\"sla_modifier\"]))\n        vulns_df.at[idx, \"adjusted_sla_days\"] = max(1, adjusted_sla)\n\n    return vulns_df\n```\n\n## Best Practices\n1. Involve business stakeholders in criticality scoring; IT alone cannot assess business impact\n2. Review and update criticality scores at least quarterly or when systems change roles\n3. Automate scoring where possible using CMDB tags and data classification labels\n4. Apply criticality tiers to vulnerability SLAs for risk-proportional remediation\n5. Validate scoring against actual incident impact data to calibrate the model\n6. Start with a simple 3-tier model before expanding to 5 tiers\n\n## Common Pitfalls\n- Classifying all assets as \"critical\" which defeats the purpose of tiering\n- Not updating criticality scores when systems are repurposed or decommissioned\n- Using only technical factors without business context\n- Applying uniform SLAs regardless of asset importance\n- Not documenting the scoring methodology for audit and consistency\n\n## Related Skills\n- performing-cve-prioritization-with-kev-catalog\n- building-vulnerability-aging-and-sla-tracking\n- performing-business-impact-analysis\n- implementing-asset-management-program\n","# Performing Asset Criticality Scoring for Vulns\n\n## Overview\nAsset criticality scoring assigns a business impact rating to each IT asset so that vulnerability remediation efforts focus on systems with the greatest organizational risk. Without criticality context, a CVSS 9.0 vulnerability on a test server receives the same urgency as the same vulnerability on a payment processing database. This skill covers building a multi-factor scoring model incorporating data sensitivity, business function dependency, regulatory scope, network exposure, and recoverability to create a 1-5 criticality tier that directly modifies vulnerability remediation SLAs.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing asset criticality scoring for vulns\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n- Configuration Management Database (CMDB) or asset inventory\n- Business Impact Analysis (BIA) data\n- Data classification policy\n- Network architecture documentation\n- Stakeholder input from business unit owners\n\n## Core Concepts\n\n### Asset Criticality Scoring Model\n\n| Factor | Weight | Score Range | Description |\n|--------|--------|-------------|-------------|\n| Business Function Impact | 25% | 1-5 | How critical is the supported business process |\n| Data Sensitivity | 25% | 1-5 | Type and sensitivity of data processed\u002Fstored |\n| Regulatory Scope | 15% | 1-5 | Regulatory requirements (PCI, HIPAA, SOX) |\n| Network Exposure | 15% | 1-5 | Internet-facing vs internal-only |\n| Recoverability | 10% | 1-5 | RTO\u002FRPO requirements, DR capability |\n| User Population | 10% | 1-5 | Number of users\u002Fcustomers affected |\n\n### Criticality Tier Definitions\n\n| Tier | Score Range | Label | SLA Modifier | Examples |\n|------|------------|-------|-------------|---------|\n| 1 | 4.5-5.0 | Crown Jewels | -50% SLA | Domain controllers, payment systems, ERP |\n| 2 | 3.5-4.4 | High Value | -25% SLA | Email servers, HR systems, CI\u002FCD |\n| 3 | 2.5-3.4 | Standard | Baseline SLA | Internal apps, file servers |\n| 4 | 1.5-2.4 | Low Impact | +25% SLA | Test environments, printers |\n| 5 | 1.0-1.4 | Minimal | +50% SLA | Decommissioning, isolated labs |\n\n### Data Sensitivity Scoring\n\n| Score | Classification | Examples |\n|-------|---------------|---------|\n| 5 | Restricted\u002FSecret | PII, PHI, payment card data, trade secrets |\n| 4 | Confidential | Financial reports, HR records, source code |\n| 3 | Internal | Internal documents, policies, project files |\n| 2 | Semi-public | Marketing materials, press releases (draft) |\n| 1 | Public | Published content, public APIs |\n\n## Workflow\n\n### Step 1: Define Scoring Criteria\n\n```python\nclass AssetCriticalityScorer:\n    \"\"\"Multi-factor asset criticality scoring engine.\"\"\"\n\n    WEIGHTS = {\n        \"business_function\": 0.25,\n        \"data_sensitivity\": 0.25,\n        \"regulatory_scope\": 0.15,\n        \"network_exposure\": 0.15,\n        \"recoverability\": 0.10,\n        \"user_population\": 0.10,\n    }\n\n    TIER_THRESHOLDS = [\n        (4.5, 1, \"Crown Jewels\", -0.50),\n        (3.5, 2, \"High Value\", -0.25),\n        (2.5, 3, \"Standard\", 0.00),\n        (1.5, 4, \"Low Impact\", 0.25),\n        (1.0, 5, \"Minimal\", 0.50),\n    ]\n\n    def score_asset(self, asset):\n        \"\"\"Calculate criticality score for an asset.\"\"\"\n        weighted_score = sum(\n            asset.get(factor, 3) * weight\n            for factor, weight in self.WEIGHTS.items()\n        )\n        score = round(weighted_score, 2)\n\n        for threshold, tier, label, sla_mod in self.TIER_THRESHOLDS:\n            if score >= threshold:\n                return {\n                    \"score\": score,\n                    \"tier\": tier,\n                    \"label\": label,\n                    \"sla_modifier\": sla_mod,\n                }\n        return {\"score\": score, \"tier\": 5, \"label\": \"Minimal\", \"sla_modifier\": 0.50}\n\n    def adjust_vuln_sla(self, base_sla_days, asset_tier_data):\n        \"\"\"Adjust vulnerability SLA based on asset criticality.\"\"\"\n        modifier = asset_tier_data[\"sla_modifier\"]\n        adjusted = int(base_sla_days * (1 + modifier))\n        return max(1, adjusted)  # Minimum 1 day SLA\n```\n\n### Step 2: Integrate with Vulnerability Prioritization\n\n```python\ndef apply_criticality_to_vulns(vulns_df, asset_scores):\n    \"\"\"Enrich vulnerability data with asset criticality context.\"\"\"\n    for idx, vuln in vulns_df.iterrows():\n        asset_id = vuln.get(\"asset_id\", \"\")\n        asset_data = asset_scores.get(asset_id, {\"tier\": 3, \"sla_modifier\": 0})\n\n        vulns_df.at[idx, \"asset_tier\"] = asset_data[\"tier\"]\n        vulns_df.at[idx, \"asset_label\"] = asset_data.get(\"label\", \"Standard\")\n\n        base_sla = get_base_sla(vuln[\"severity\"])\n        adjusted_sla = int(base_sla * (1 + asset_data[\"sla_modifier\"]))\n        vulns_df.at[idx, \"adjusted_sla_days\"] = max(1, adjusted_sla)\n\n    return vulns_df\n```\n\n## Best Practices\n1. Involve business stakeholders in criticality scoring; IT alone cannot assess business impact\n2. Review and update criticality scores at least quarterly or when systems change roles\n3. Automate scoring where possible using CMDB tags and data classification labels\n4. Apply criticality tiers to vulnerability SLAs for risk-proportional remediation\n5. Validate scoring against actual incident impact data to calibrate the model\n6. Start with a simple 3-tier model before expanding to 5 tiers\n\n## Common Pitfalls\n- Classifying all assets as \"critical\" which defeats the purpose of tiering\n- Not updating criticality scores when systems are repurposed or decommissioned\n- Using only technical factors without business context\n- Applying uniform SLAs regardless of asset importance\n- Not documenting the scoring methodology for audit and consistency\n\n## Related Skills\n- performing-cve-prioritization-with-kev-catalog\n- building-vulnerability-aging-and-sla-tracking\n- performing-business-impact-analysis\n- implementing-asset-management-program\n",{"name":5,"tags":46,"author":47,"domain":33,"license":15,"version":48,"nist_csf":49,"subdomain":37,"description":7,"mitre_attack":54},[30,32,36,29,28,27,26],"mahipal","1.0",[50,51,52,53],"ID.RA-01","ID.RA-02","ID.IM-02","ID.RA-06",[55,56,57],"T1190","T1203","T1068","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-asset-criticality-scoring-for-vulns",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":69,"prompt":79,"zipAvailable":80},[70,73,76],{"tool":71,"command":72},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-asset-criticality-scoring-for-vulns",{"tool":74,"command":75},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-asset-criticality-scoring-for-vulns",{"tool":77,"command":78},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-asset-criticality-scoring-for-vulns","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-asset-criticality-scoring-for-vulns\u002FSKILL.md",true,[82,88,93,99,103,107,111,115,121],{"path":83,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":86,"sourceHtmlUrl":87},"assets\u002Ftemplate.md","ASSET","资产文件",527,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-asset-criticality-scoring-for-vulns\u002Fassets\u002Ftemplate.md",{"path":89,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":91,"sourceHtmlUrl":92},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-asset-criticality-scoring-for-vulns\u002FLICENSE",{"path":94,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":97,"sourceHtmlUrl":98},"references\u002Fapi-reference.md","REFERENCE","参考文档",2244,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-asset-criticality-scoring-for-vulns\u002Freferences\u002Fapi-reference.md",{"path":100,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":101,"sourceHtmlUrl":102},"references\u002Fhost-load-balancing.md",6389,"https:\u002F\u002Fgithub.com\u002Fjleechanorg\u002Fjleechan-skills\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fparallelize-to-ceiling\u002Freferences\u002Fhost-load-balancing.md",{"path":104,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":105,"sourceHtmlUrl":106},"references\u002Fstandards.md",523,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-asset-criticality-scoring-for-vulns\u002Freferences\u002Fstandards.md",{"path":108,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":109,"sourceHtmlUrl":110},"references\u002Ftimeline-milestones.md",3113,"https:\u002F\u002Fgithub.com\u002Fjleechanorg\u002Fjleechan-skills\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fparallelize-to-ceiling\u002Freferences\u002Ftimeline-milestones.md",{"path":112,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":113,"sourceHtmlUrl":114},"references\u002Fworkflows.md",579,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-asset-criticality-scoring-for-vulns\u002Freferences\u002Fworkflows.md",{"path":116,"resourceType":117,"resourceTypeDesc":118,"sizeBytes":119,"sourceHtmlUrl":120},"scripts\u002Fagent.py","SCRIPT","脚本",6808,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-asset-criticality-scoring-for-vulns\u002Fscripts\u002Fagent.py",{"path":122,"resourceType":117,"resourceTypeDesc":118,"sizeBytes":123,"sourceHtmlUrl":124},"scripts\u002Fprocess.py",3866,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-asset-criticality-scoring-for-vulns\u002Fscripts\u002Fprocess.py",[126,153,177,205,230,253],{"skillNo":127,"name":128,"nameZh":6,"description":129,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":130,"categories":131,"keywords":133,"publishedAt":41},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[132],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[134,135,136,137,138,33,139,140,141,142,143,144,145,146,147,148,149,150,151,152],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":154,"name":155,"nameZh":6,"description":156,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":157,"categories":158,"keywords":160,"publishedAt":41},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[159],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[161,149,162,163,138,164,33,141,165,166,167,168,169,170,171,172,173,174,175,176],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":178,"name":179,"nameZh":6,"description":180,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":181,"categories":182,"keywords":187,"publishedAt":41},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[183,186],{"categoryNo":184,"categoryName":185,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[171,188,189,190,191,33,192,193,165,194,195,196,197,198,199,200,201,202,203,204],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":206,"name":207,"nameZh":6,"description":208,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":209,"categories":210,"keywords":212,"publishedAt":41},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[211],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[213,214,215,33,216,217,218,219,220,221,222,38,223,224,225,226,168,227,228,229],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":231,"name":232,"nameZh":6,"description":233,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":234,"categories":235,"keywords":237,"publishedAt":41},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[236],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[238,239,240,33,241,242,243,37,36,244,245,246,247,35,25,248,249,250,251,252],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","nessus","qualys","openvas","cvss","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":254,"name":255,"nameZh":6,"description":256,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":257,"categories":258,"keywords":260,"publishedAt":41},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[259],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[138,261,33,262,263,264,265,266,267,268,269,200,270,201,271,272,273,274,275,276],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]