[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFQXXJR7N0EMCVRZR83DJX":3,"skill-same:01M6AFQXXJR7N0EMCVRZR83DJX":130},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":37,"linkOnly":38,"markdownContent":39,"markdownBody":40,"frontMatter":41,"refName":55,"commitSha":56,"skillDirectory":57,"forksCount":58,"repositoryHtmlUrl":59,"repositoryHomepageUrl":60,"ownerHtmlUrl":61,"ownerBlogUrl":62,"ownerDescription":63,"updatedAt":64,"install":65,"resources":78},"01M6AFQXXJR7N0EMCVRZR83DJX","performing-dark-web-monitoring-for-threats",null,"Dark web monitoring involves systematically scanning Tor hidden services, underground forums, paste sites, and dark web marketplaces to identify threats targeting an organization, including leaked cre","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-dark-web-monitoring-for-threats\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36],"web","monitoring","performing dark web monitoring for threats","cybersecurity","services","mitre-attack","threat-intelligence","cti","ioc","stix","tor","dark-web","threat-monitoring","2026-11-10 10:12:30",false,"---\nname: performing-dark-web-monitoring-for-threats\ndescription: Dark web monitoring involves systematically scanning Tor hidden services,\n  underground forums, paste sites, and dark web marketplaces to identify threats targeting\n  an organization, including leaked cre\ndomain: cybersecurity\nsubdomain: threat-intelligence\ntags:\n- threat-intelligence\n- cti\n- ioc\n- mitre-attack\n- stix\n- dark-web\n- tor\n- threat-monitoring\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- ID.RA-01\n- ID.RA-05\n- DE.CM-01\n- DE.AE-02\nmitre_attack:\n- T1591\n- T1592\n- T1593\n- T1589\n---\n# Performing Dark Web Monitoring for Threats\n\n## Overview\n\nDark web monitoring involves systematically scanning Tor hidden services, underground forums, paste sites, and dark web marketplaces to identify threats targeting an organization, including leaked credentials, data breaches, threat actor discussions, vulnerability exploitation tools, and planned attacks. This skill covers setting up monitoring infrastructure, using Tor-based collection tools, implementing automated alerting for brand mentions and credential leaks, and analyzing dark web intelligence for actionable threat indicators.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing dark web monitoring for threats\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Tor Browser and Tor proxy (SOCKS5 on port 9050)\n- Python 3.9+ with `requests`, `stem`, `beautifulsoup4`, `stix2` libraries\n- Understanding of Tor hidden service architecture (.onion domains)\n- API access to dark web monitoring services (Flare, SpyCloud, DarkOwl, Intel 471)\n- Awareness of legal and ethical boundaries for dark web research\n- Isolated VM for dark web browsing (no personal or corporate identity leakage)\n\n## Key Concepts\n\n### Dark Web Intelligence Sources\n- **Underground Forums**: Hacking forums where threat actors discuss TTPs, sell exploits, and share tools\n- **Paste Sites**: Platforms for sharing stolen data, credentials, and code snippets\n- **Marketplaces**: Dark web markets selling stolen data, RaaS, exploit kits, and access\n- **Telegram\u002FDiscord**: Alternative communication channels for cybercriminal groups\n- **Ransomware Leak Sites**: Blogs where ransomware groups post stolen data from victims\n\n### Collection Methods\n- **Automated Crawling**: Tor-based web crawlers scanning hidden services\n- **API-Based Monitoring**: Commercial dark web monitoring APIs (Flare, DarkOwl, Intel 471)\n- **Manual HUMINT**: Analyst-driven research on specific forums and marketplaces\n- **Credential Monitoring**: Breach databases and paste site monitoring for leaked credentials\n\n### OPSEC for Dark Web Research\n- Use dedicated VMs with no personal data\n- Route all traffic through Tor (Whonix or Tails recommended)\n- Never use personal accounts or identifiable information\n- Use separate email addresses and personas for forum registration\n- Disable JavaScript in Tor Browser for enhanced security\n- Never download or execute files from dark web sources on production systems\n\n## Workflow\n\n### Step 1: Set Up Tor-Based HTTP Client\n\n```python\nimport requests\nfrom requests.adapters import HTTPAdapter\n\ndef create_tor_session():\n    \"\"\"Create a requests session routed through Tor SOCKS5 proxy.\"\"\"\n    session = requests.Session()\n    session.proxies = {\n        \"http\": \"socks5h:\u002F\u002F127.0.0.1:9050\",\n        \"https\": \"socks5h:\u002F\u002F127.0.0.1:9050\",\n    }\n    session.headers.update({\n        \"User-Agent\": \"Mozilla\u002F5.0 (Windows NT 10.0; rv:109.0) Gecko\u002F20100101 Firefox\u002F115.0\",\n    })\n    return session\n\n\ndef verify_tor_connection(session):\n    \"\"\"Verify that traffic is routed through Tor.\"\"\"\n    try:\n        resp = session.get(\"https:\u002F\u002Fcheck.torproject.org\u002Fapi\u002Fip\", timeout=30)\n        data = resp.json()\n        return {\n            \"is_tor\": data.get(\"IsTor\", False),\n            \"ip\": data.get(\"IP\", \"\"),\n        }\n    except Exception as e:\n        return {\"error\": str(e)}\n```\n\n### Step 2: Monitor Paste Sites for Credential Leaks\n\n```python\nimport re\nfrom datetime import datetime\n\ndef monitor_paste_sites(session, organization_domains):\n    \"\"\"Monitor paste sites for leaked credentials matching organization domains.\"\"\"\n    findings = []\n\n    # Check Have I Been Pwned API (clearnet)\n    for domain in organization_domains:\n        try:\n            resp = requests.get(\n                f\"https:\u002F\u002Fhaveibeenpwned.com\u002Fapi\u002Fv3\u002Fbreaches\",\n                headers={\"hibp-api-key\": \"YOUR_HIBP_KEY\"},\n                timeout=30,\n            )\n            if resp.status_code == 200:\n                breaches = resp.json()\n                for breach in breaches:\n                    if domain.lower() in breach.get(\"Domain\", \"\").lower():\n                        findings.append({\n                            \"source\": \"HIBP\",\n                            \"breach_name\": breach[\"Name\"],\n                            \"breach_date\": breach.get(\"BreachDate\"),\n                            \"data_classes\": breach.get(\"DataClasses\", []),\n                            \"pwn_count\": breach.get(\"PwnCount\", 0),\n                            \"domain\": domain,\n                        })\n        except Exception as e:\n            print(f\"[-] HIBP error for {domain}: {e}\")\n\n    return findings\n\n\ndef search_for_keywords(session, keywords, onion_paste_urls):\n    \"\"\"Search dark web paste sites for specific keywords.\"\"\"\n    results = []\n\n    for paste_url in onion_paste_urls:\n        try:\n            resp = session.get(paste_url, timeout=60)\n            if resp.status_code == 200:\n                content = resp.text.lower()\n                for keyword in keywords:\n                    if keyword.lower() in content:\n                        results.append({\n                            \"url\": paste_url,\n                            \"keyword\": keyword,\n                            \"timestamp\": datetime.utcnow().isoformat(),\n                            \"snippet\": extract_context(content, keyword.lower()),\n                        })\n        except Exception as e:\n            print(f\"[-] Error fetching {paste_url}: {e}\")\n\n    return results\n\n\ndef extract_context(text, keyword, context_chars=200):\n    \"\"\"Extract text context around a keyword match.\"\"\"\n    idx = text.find(keyword)\n    if idx == -1:\n        return \"\"\n    start = max(0, idx - context_chars)\n    end = min(len(text), idx + len(keyword) + context_chars)\n    return text[start:end]\n```\n\n### Step 3: Monitor Ransomware Leak Sites\n\n```python\ndef check_ransomware_leak_sites(session, organization_name):\n    \"\"\"Check known ransomware group leak sites for organization mentions.\"\"\"\n    # Use Ransomwatch API (clearnet aggregator of ransomware leak sites)\n    try:\n        resp = requests.get(\n            \"https:\u002F\u002Fraw.githubusercontent.com\u002Fjoshhighet\u002Fransomwatch\u002Fmain\u002Fposts.json\",\n            timeout=30,\n        )\n        if resp.status_code == 200:\n            posts = resp.json()\n            matches = []\n            for post in posts:\n                post_title = post.get(\"post_title\", \"\").lower()\n                if organization_name.lower() in post_title:\n                    matches.append({\n                        \"group\": post.get(\"group_name\", \"\"),\n                        \"title\": post.get(\"post_title\", \"\"),\n                        \"discovered\": post.get(\"discovered\", \"\"),\n                        \"url\": post.get(\"post_url\", \"\"),\n                    })\n            return matches\n    except Exception as e:\n        print(f\"[-] Ransomwatch error: {e}\")\n    return []\n```\n\n### Step 4: Generate Dark Web Intelligence Report\n\n```python\ndef generate_dark_web_report(findings, organization):\n    \"\"\"Generate structured dark web intelligence report.\"\"\"\n    report = {\n        \"organization\": organization,\n        \"report_date\": datetime.utcnow().isoformat(),\n        \"executive_summary\": \"\",\n        \"credential_leaks\": [],\n        \"ransomware_mentions\": [],\n        \"dark_web_mentions\": [],\n        \"recommendations\": [],\n    }\n\n    for finding in findings:\n        if finding.get(\"source\") == \"HIBP\":\n            report[\"credential_leaks\"].append(finding)\n        elif finding.get(\"group\"):\n            report[\"ransomware_mentions\"].append(finding)\n        else:\n            report[\"dark_web_mentions\"].append(finding)\n\n    # Generate executive summary\n    cred_count = len(report[\"credential_leaks\"])\n    ransom_count = len(report[\"ransomware_mentions\"])\n    report[\"executive_summary\"] = (\n        f\"Monitoring identified {cred_count} credential leak sources \"\n        f\"and {ransom_count} ransomware group mentions for {organization}.\"\n    )\n\n    if ransom_count > 0:\n        report[\"recommendations\"].append(\n            \"CRITICAL: Organization mentioned on ransomware leak site. \"\n            \"Initiate incident response immediately.\"\n        )\n    if cred_count > 0:\n        report[\"recommendations\"].append(\n            \"HIGH: Leaked credentials detected. Force password resets for \"\n            \"affected accounts and enable MFA.\"\n        )\n\n    return report\n```\n\n## Validation Criteria\n\n- Tor connection established and verified via check.torproject.org\n- Credential leak monitoring returns results from HIBP and paste sites\n- Ransomware leak site monitoring identifies relevant mentions\n- Dark web intelligence report generated with actionable recommendations\n- All monitoring performed within legal and ethical boundaries\n- OPSEC maintained: no personal or corporate identity exposure\n\n## References\n\n- [Tor Project](https:\u002F\u002Fwww.torproject.org\u002F)\n- [Have I Been Pwned API](https:\u002F\u002Fhaveibeenpwned.com\u002FAPI\u002Fv3)\n- [Ransomwatch](https:\u002F\u002Fgithub.com\u002Fjoshhighet\u002Fransomwatch)\n- [DarkOwl](https:\u002F\u002Fwww.darkowl.com\u002F)\n- [Intel 471](https:\u002F\u002Fintel471.com\u002F)\n- [Flare Systems](https:\u002F\u002Fflare.io\u002F)\n","# Performing Dark Web Monitoring for Threats\n\n## Overview\n\nDark web monitoring involves systematically scanning Tor hidden services, underground forums, paste sites, and dark web marketplaces to identify threats targeting an organization, including leaked credentials, data breaches, threat actor discussions, vulnerability exploitation tools, and planned attacks. This skill covers setting up monitoring infrastructure, using Tor-based collection tools, implementing automated alerting for brand mentions and credential leaks, and analyzing dark web intelligence for actionable threat indicators.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing dark web monitoring for threats\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Tor Browser and Tor proxy (SOCKS5 on port 9050)\n- Python 3.9+ with `requests`, `stem`, `beautifulsoup4`, `stix2` libraries\n- Understanding of Tor hidden service architecture (.onion domains)\n- API access to dark web monitoring services (Flare, SpyCloud, DarkOwl, Intel 471)\n- Awareness of legal and ethical boundaries for dark web research\n- Isolated VM for dark web browsing (no personal or corporate identity leakage)\n\n## Key Concepts\n\n### Dark Web Intelligence Sources\n- **Underground Forums**: Hacking forums where threat actors discuss TTPs, sell exploits, and share tools\n- **Paste Sites**: Platforms for sharing stolen data, credentials, and code snippets\n- **Marketplaces**: Dark web markets selling stolen data, RaaS, exploit kits, and access\n- **Telegram\u002FDiscord**: Alternative communication channels for cybercriminal groups\n- **Ransomware Leak Sites**: Blogs where ransomware groups post stolen data from victims\n\n### Collection Methods\n- **Automated Crawling**: Tor-based web crawlers scanning hidden services\n- **API-Based Monitoring**: Commercial dark web monitoring APIs (Flare, DarkOwl, Intel 471)\n- **Manual HUMINT**: Analyst-driven research on specific forums and marketplaces\n- **Credential Monitoring**: Breach databases and paste site monitoring for leaked credentials\n\n### OPSEC for Dark Web Research\n- Use dedicated VMs with no personal data\n- Route all traffic through Tor (Whonix or Tails recommended)\n- Never use personal accounts or identifiable information\n- Use separate email addresses and personas for forum registration\n- Disable JavaScript in Tor Browser for enhanced security\n- Never download or execute files from dark web sources on production systems\n\n## Workflow\n\n### Step 1: Set Up Tor-Based HTTP Client\n\n```python\nimport requests\nfrom requests.adapters import HTTPAdapter\n\ndef create_tor_session():\n    \"\"\"Create a requests session routed through Tor SOCKS5 proxy.\"\"\"\n    session = requests.Session()\n    session.proxies = {\n        \"http\": \"socks5h:\u002F\u002F127.0.0.1:9050\",\n        \"https\": \"socks5h:\u002F\u002F127.0.0.1:9050\",\n    }\n    session.headers.update({\n        \"User-Agent\": \"Mozilla\u002F5.0 (Windows NT 10.0; rv:109.0) Gecko\u002F20100101 Firefox\u002F115.0\",\n    })\n    return session\n\n\ndef verify_tor_connection(session):\n    \"\"\"Verify that traffic is routed through Tor.\"\"\"\n    try:\n        resp = session.get(\"https:\u002F\u002Fcheck.torproject.org\u002Fapi\u002Fip\", timeout=30)\n        data = resp.json()\n        return {\n            \"is_tor\": data.get(\"IsTor\", False),\n            \"ip\": data.get(\"IP\", \"\"),\n        }\n    except Exception as e:\n        return {\"error\": str(e)}\n```\n\n### Step 2: Monitor Paste Sites for Credential Leaks\n\n```python\nimport re\nfrom datetime import datetime\n\ndef monitor_paste_sites(session, organization_domains):\n    \"\"\"Monitor paste sites for leaked credentials matching organization domains.\"\"\"\n    findings = []\n\n    # Check Have I Been Pwned API (clearnet)\n    for domain in organization_domains:\n        try:\n            resp = requests.get(\n                f\"https:\u002F\u002Fhaveibeenpwned.com\u002Fapi\u002Fv3\u002Fbreaches\",\n                headers={\"hibp-api-key\": \"YOUR_HIBP_KEY\"},\n                timeout=30,\n            )\n            if resp.status_code == 200:\n                breaches = resp.json()\n                for breach in breaches:\n                    if domain.lower() in breach.get(\"Domain\", \"\").lower():\n                        findings.append({\n                            \"source\": \"HIBP\",\n                            \"breach_name\": breach[\"Name\"],\n                            \"breach_date\": breach.get(\"BreachDate\"),\n                            \"data_classes\": breach.get(\"DataClasses\", []),\n                            \"pwn_count\": breach.get(\"PwnCount\", 0),\n                            \"domain\": domain,\n                        })\n        except Exception as e:\n            print(f\"[-] HIBP error for {domain}: {e}\")\n\n    return findings\n\n\ndef search_for_keywords(session, keywords, onion_paste_urls):\n    \"\"\"Search dark web paste sites for specific keywords.\"\"\"\n    results = []\n\n    for paste_url in onion_paste_urls:\n        try:\n            resp = session.get(paste_url, timeout=60)\n            if resp.status_code == 200:\n                content = resp.text.lower()\n                for keyword in keywords:\n                    if keyword.lower() in content:\n                        results.append({\n                            \"url\": paste_url,\n                            \"keyword\": keyword,\n                            \"timestamp\": datetime.utcnow().isoformat(),\n                            \"snippet\": extract_context(content, keyword.lower()),\n                        })\n        except Exception as e:\n            print(f\"[-] Error fetching {paste_url}: {e}\")\n\n    return results\n\n\ndef extract_context(text, keyword, context_chars=200):\n    \"\"\"Extract text context around a keyword match.\"\"\"\n    idx = text.find(keyword)\n    if idx == -1:\n        return \"\"\n    start = max(0, idx - context_chars)\n    end = min(len(text), idx + len(keyword) + context_chars)\n    return text[start:end]\n```\n\n### Step 3: Monitor Ransomware Leak Sites\n\n```python\ndef check_ransomware_leak_sites(session, organization_name):\n    \"\"\"Check known ransomware group leak sites for organization mentions.\"\"\"\n    # Use Ransomwatch API (clearnet aggregator of ransomware leak sites)\n    try:\n        resp = requests.get(\n            \"https:\u002F\u002Fraw.githubusercontent.com\u002Fjoshhighet\u002Fransomwatch\u002Fmain\u002Fposts.json\",\n            timeout=30,\n        )\n        if resp.status_code == 200:\n            posts = resp.json()\n            matches = []\n            for post in posts:\n                post_title = post.get(\"post_title\", \"\").lower()\n                if organization_name.lower() in post_title:\n                    matches.append({\n                        \"group\": post.get(\"group_name\", \"\"),\n                        \"title\": post.get(\"post_title\", \"\"),\n                        \"discovered\": post.get(\"discovered\", \"\"),\n                        \"url\": post.get(\"post_url\", \"\"),\n                    })\n            return matches\n    except Exception as e:\n        print(f\"[-] Ransomwatch error: {e}\")\n    return []\n```\n\n### Step 4: Generate Dark Web Intelligence Report\n\n```python\ndef generate_dark_web_report(findings, organization):\n    \"\"\"Generate structured dark web intelligence report.\"\"\"\n    report = {\n        \"organization\": organization,\n        \"report_date\": datetime.utcnow().isoformat(),\n        \"executive_summary\": \"\",\n        \"credential_leaks\": [],\n        \"ransomware_mentions\": [],\n        \"dark_web_mentions\": [],\n        \"recommendations\": [],\n    }\n\n    for finding in findings:\n        if finding.get(\"source\") == \"HIBP\":\n            report[\"credential_leaks\"].append(finding)\n        elif finding.get(\"group\"):\n            report[\"ransomware_mentions\"].append(finding)\n        else:\n            report[\"dark_web_mentions\"].append(finding)\n\n    # Generate executive summary\n    cred_count = len(report[\"credential_leaks\"])\n    ransom_count = len(report[\"ransomware_mentions\"])\n    report[\"executive_summary\"] = (\n        f\"Monitoring identified {cred_count} credential leak sources \"\n        f\"and {ransom_count} ransomware group mentions for {organization}.\"\n    )\n\n    if ransom_count > 0:\n        report[\"recommendations\"].append(\n            \"CRITICAL: Organization mentioned on ransomware leak site. \"\n            \"Initiate incident response immediately.\"\n        )\n    if cred_count > 0:\n        report[\"recommendations\"].append(\n            \"HIGH: Leaked credentials detected. Force password resets for \"\n            \"affected accounts and enable MFA.\"\n        )\n\n    return report\n```\n\n## Validation Criteria\n\n- Tor connection established and verified via check.torproject.org\n- Credential leak monitoring returns results from HIBP and paste sites\n- Ransomware leak site monitoring identifies relevant mentions\n- Dark web intelligence report generated with actionable recommendations\n- All monitoring performed within legal and ethical boundaries\n- OPSEC maintained: no personal or corporate identity exposure\n\n## References\n\n- [Tor Project](https:\u002F\u002Fwww.torproject.org\u002F)\n- [Have I Been Pwned API](https:\u002F\u002Fhaveibeenpwned.com\u002FAPI\u002Fv3)\n- [Ransomwatch](https:\u002F\u002Fgithub.com\u002Fjoshhighet\u002Fransomwatch)\n- [DarkOwl](https:\u002F\u002Fwww.darkowl.com\u002F)\n- [Intel 471](https:\u002F\u002Fintel471.com\u002F)\n- [Flare Systems](https:\u002F\u002Fflare.io\u002F)\n",{"name":5,"tags":42,"author":43,"domain":27,"license":15,"version":44,"nist_csf":45,"subdomain":30,"description":7,"mitre_attack":50},[30,31,32,29,33,35,34,36],"mahipal","1.0",[46,47,48,49],"ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02",[51,52,53,54],"T1591","T1592","T1593","T1589","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-dark-web-monitoring-for-threats",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":66,"prompt":76,"zipAvailable":77},[67,70,73],{"tool":68,"command":69},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-dark-web-monitoring-for-threats",{"tool":71,"command":72},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-dark-web-monitoring-for-threats",{"tool":74,"command":75},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-dark-web-monitoring-for-threats","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-dark-web-monitoring-for-threats\u002FSKILL.md",true,[79,85,90,96,100,104,108,112,116,120,126],{"path":80,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":83,"sourceHtmlUrl":84},"assets\u002Ftemplate.md","ASSET","资产文件",861,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-dark-web-monitoring-for-threats\u002Fassets\u002Ftemplate.md",{"path":86,"resourceType":86,"resourceTypeDesc":87,"sizeBytes":88,"sourceHtmlUrl":89},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-dark-web-monitoring-for-threats\u002FLICENSE",{"path":91,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":94,"sourceHtmlUrl":95},"references\u002Fapi-reference.md","REFERENCE","参考文档",5886,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-dark-web-monitoring-for-threats\u002Freferences\u002Fapi-reference.md",{"path":97,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":98,"sourceHtmlUrl":99},"references\u002Fpage-type-taxonomy.md",7382,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fclaude\u002Fskills\u002Fseo-sxo\u002Freferences\u002Fpage-type-taxonomy.md",{"path":101,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":102,"sourceHtmlUrl":103},"references\u002Fpersona-scoring.md",6353,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fclaude\u002Fskills\u002Fseo-sxo\u002Freferences\u002Fpersona-scoring.md",{"path":105,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":106,"sourceHtmlUrl":107},"references\u002Fstandards.md",1608,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-dark-web-monitoring-for-threats\u002Freferences\u002Fstandards.md",{"path":109,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":110,"sourceHtmlUrl":111},"references\u002Fuser-story-framework.md",5694,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fclaude\u002Fskills\u002Fseo-sxo\u002Freferences\u002Fuser-story-framework.md",{"path":113,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":114,"sourceHtmlUrl":115},"references\u002Fwireframe-templates.md",6515,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fclaude\u002Fskills\u002Fseo-sxo\u002Freferences\u002Fwireframe-templates.md",{"path":117,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":118,"sourceHtmlUrl":119},"references\u002Fworkflows.md",1566,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-dark-web-monitoring-for-threats\u002Freferences\u002Fworkflows.md",{"path":121,"resourceType":122,"resourceTypeDesc":123,"sizeBytes":124,"sourceHtmlUrl":125},"scripts\u002Fagent.py","SCRIPT","脚本",8940,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-dark-web-monitoring-for-threats\u002Fscripts\u002Fagent.py",{"path":127,"resourceType":122,"resourceTypeDesc":123,"sizeBytes":128,"sourceHtmlUrl":129},"scripts\u002Fprocess.py",8975,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-dark-web-monitoring-for-threats\u002Fscripts\u002Fprocess.py",[131,158,182,210,236,263],{"skillNo":132,"name":133,"nameZh":6,"description":134,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":135,"categories":136,"keywords":138,"publishedAt":37},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[137],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[139,140,141,142,143,27,144,145,146,147,148,149,150,151,152,153,154,155,156,157],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":159,"name":160,"nameZh":6,"description":161,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":162,"categories":163,"keywords":165,"publishedAt":37},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[164],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[166,154,167,168,143,169,27,146,170,171,172,173,174,175,176,177,178,179,180,181],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":183,"name":184,"nameZh":6,"description":185,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":186,"categories":187,"keywords":192,"publishedAt":37},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[188,191],{"categoryNo":189,"categoryName":190,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[176,193,194,195,196,27,197,198,170,199,200,201,202,203,204,205,206,207,208,209],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":211,"name":212,"nameZh":6,"description":213,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":214,"categories":215,"keywords":217,"publishedAt":37},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[216],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[218,219,220,27,221,222,223,224,225,226,227,228,229,230,231,232,173,233,234,235],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":237,"name":238,"nameZh":6,"description":239,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":240,"categories":241,"keywords":243,"publishedAt":37},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[242],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[244,245,246,27,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":264,"name":265,"nameZh":6,"description":266,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":267,"categories":268,"keywords":270,"publishedAt":37},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[269],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[143,271,27,272,273,32,274,275,276,277,278,205,279,206,280,281,282,283,284,285],"triaging security incident","siem","file","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]