[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skills:stats":3,"skills:pro6":8,"skills:sce6":55,"skills:creators9":100,"skills:all:stars:111:":195},{"skillCount":4,"professionCount":5,"scenarioCount":6,"creatorCount":7},196852,11,7,1926,[9,20,27,34,41,48],{"categoryNo":10,"taxonomyType":11,"taxonomyTypeDesc":12,"categoryName":13,"categoryNameEn":14,"description":15,"level":16,"skillCount":17,"parentNo":18,"parentName":18,"children":19},"01JBSEEDCAT000000000000030","PROFESSION","适用职业","开发工程师","Software Engineer","从事软件编码、测试与运维的工程师",1,13274,null,[],{"categoryNo":21,"taxonomyType":11,"taxonomyTypeDesc":12,"categoryName":22,"categoryNameEn":23,"description":24,"level":16,"skillCount":25,"parentNo":18,"parentName":18,"children":26},"01JBSEEDCAT000000000000032","设计师","Designer","视觉、交互与品牌设计人员",7775,[],{"categoryNo":28,"taxonomyType":11,"taxonomyTypeDesc":12,"categoryName":29,"categoryNameEn":30,"description":31,"level":16,"skillCount":32,"parentNo":18,"parentName":18,"children":33},"01JBSEEDCAT000000000000033","数据分析师","Data Analyst","数据分析、报表与商业智能人员",4988,[],{"categoryNo":35,"taxonomyType":11,"taxonomyTypeDesc":12,"categoryName":36,"categoryNameEn":37,"description":38,"level":16,"skillCount":39,"parentNo":18,"parentName":18,"children":40},"01JBSEEDCAT000000000000036","内容创作者","Content Creator","作者、编辑与自媒体创作者",3940,[],{"categoryNo":42,"taxonomyType":11,"taxonomyTypeDesc":12,"categoryName":43,"categoryNameEn":44,"description":45,"level":16,"skillCount":46,"parentNo":18,"parentName":18,"children":47},"01JBSEEDCAT000000000000035","市场营销","Marketer","市场推广、增长与品牌运营人员",3446,[],{"categoryNo":49,"taxonomyType":11,"taxonomyTypeDesc":12,"categoryName":50,"categoryNameEn":51,"description":52,"level":16,"skillCount":53,"parentNo":18,"parentName":18,"children":54},"01JBSEEDCAT000000000000037","律师与法务","Legal","合同、合规与法律事务人员",3316,[],[56,65,72,79,86,93],{"categoryNo":57,"taxonomyType":58,"taxonomyTypeDesc":59,"categoryName":60,"categoryNameEn":61,"description":62,"level":16,"skillCount":63,"parentNo":18,"parentName":18,"children":64},"01JBSEEDCAT000000000000022","SCENARIO","使用场景","智能体与自动化","Agents & Automation","Skill、MCP、智能体与工作流自动化",39458,[],{"categoryNo":66,"taxonomyType":58,"taxonomyTypeDesc":59,"categoryName":67,"categoryNameEn":68,"description":69,"level":16,"skillCount":70,"parentNo":18,"parentName":18,"children":71},"01JBSEEDCAT000000000000006","软件开发","Software Development","编码、测试、部署等软件研发任务",26531,[],{"categoryNo":73,"taxonomyType":58,"taxonomyTypeDesc":59,"categoryName":74,"categoryNameEn":75,"description":76,"level":16,"skillCount":77,"parentNo":18,"parentName":18,"children":78},"01JBSEEDCAT000000000000014","设计创意","Design & Creative","视觉设计、品牌与多媒体创作",13569,[],{"categoryNo":80,"taxonomyType":58,"taxonomyTypeDesc":59,"categoryName":81,"categoryNameEn":82,"description":83,"level":16,"skillCount":84,"parentNo":18,"parentName":18,"children":85},"01JBSEEDCAT000000000000001","办公效率","Office Productivity","日常办公文档、表格、演示与沟通类任务",6289,[],{"categoryNo":87,"taxonomyType":58,"taxonomyTypeDesc":59,"categoryName":88,"categoryNameEn":89,"description":90,"level":16,"skillCount":91,"parentNo":18,"parentName":18,"children":92},"01JBSEEDCAT000000000000017","内容创作","Content Creation","写作、文案与营销内容生产",6029,[],{"categoryNo":94,"taxonomyType":58,"taxonomyTypeDesc":59,"categoryName":95,"categoryNameEn":96,"description":97,"level":16,"skillCount":98,"parentNo":18,"parentName":18,"children":99},"01JBSEEDCAT000000000000020","研究与学习","Research & Learning","资料检索、知识整理与学习辅导",5531,[],{"records":101,"total":7,"current":16,"size":194},[102,114,123,133,143,153,163,172,182],{"accountNo":103,"login":104,"displayName":105,"avatarUrl":106,"accountType":107,"accountTypeDesc":108,"profileDescription":109,"skillCount":110,"repoCount":111,"professionCount":5,"scenarioCount":6,"totalStars":112,"updatedAt":113},"01M698VYDXZ6JW5WH3CRV650R8","microsoft","Microsoft","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F6154722?v=4","ORGANIZATION","组织","Open source projects and samples from Microsoft",4160,229,828772,"2026-11-13 04:10:52",{"accountNo":115,"login":116,"displayName":116,"avatarUrl":117,"accountType":107,"accountTypeDesc":108,"profileDescription":118,"skillCount":119,"repoCount":120,"professionCount":6,"scenarioCount":6,"totalStars":121,"updatedAt":122},"01M698P3FSAZ6B4R928ZF19KPT","openclaw","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F252820863?v=4","Your personal, open source AI assistant.",362,32,437711,"2026-11-13 03:02:05",{"accountNo":124,"login":125,"displayName":126,"avatarUrl":127,"accountType":107,"accountTypeDesc":108,"profileDescription":18,"skillCount":128,"repoCount":129,"professionCount":6,"scenarioCount":130,"totalStars":131,"updatedAt":132},"01M6AC29YGCR4S2NTJFV0G8B81","openai","OpenAI","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F14957082?v=4",171,23,6,342695,"2026-11-13 04:03:41",{"accountNo":134,"login":135,"displayName":136,"avatarUrl":137,"accountType":107,"accountTypeDesc":108,"profileDescription":18,"skillCount":138,"repoCount":139,"professionCount":140,"scenarioCount":6,"totalStars":141,"updatedAt":142},"01M6AC83E6K4FDKK7HZ8WNMQKE","apache","The Apache Software Foundation","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F47359?v=4",420,75,8,298176,"2026-11-13 03:14:28",{"accountNo":144,"login":145,"displayName":146,"avatarUrl":147,"accountType":107,"accountTypeDesc":108,"profileDescription":148,"skillCount":149,"repoCount":150,"professionCount":5,"scenarioCount":6,"totalStars":151,"updatedAt":152},"01M698VYEFDM0VJBZDYYJ2T83S","google","Google","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1342004?v=4","Google ❤️ Open Source",535,48,242366,"2026-11-13 04:17:09",{"accountNo":154,"login":155,"displayName":156,"avatarUrl":157,"accountType":107,"accountTypeDesc":108,"profileDescription":158,"skillCount":159,"repoCount":160,"professionCount":5,"scenarioCount":6,"totalStars":161,"updatedAt":162},"01M6AC83DS133TPXFSP1DHNCC6","github","GitHub","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F9919?v=4","How people build software.",940,28,238441,"2026-11-13 03:57:35",{"accountNo":164,"login":165,"displayName":166,"avatarUrl":167,"accountType":107,"accountTypeDesc":108,"profileDescription":18,"skillCount":168,"repoCount":169,"professionCount":5,"scenarioCount":6,"totalStars":170,"updatedAt":171},"01M697XGDPXJAVQ8391V2BCYTE","anthropics","Anthropic","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F76263028?v=4",674,17,231826,"2026-11-13 04:18:26",{"accountNo":173,"login":174,"displayName":175,"avatarUrl":176,"accountType":107,"accountTypeDesc":108,"profileDescription":18,"skillCount":177,"repoCount":178,"professionCount":179,"scenarioCount":6,"totalStars":180,"updatedAt":181},"01M6AC83EPDGBFN19MWYRREJD0","Significant-Gravitas","AutoGPT","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F130738209?v=4",86,2,10,188014,"2026-11-13 02:38:59",{"accountNo":183,"login":184,"displayName":185,"avatarUrl":186,"accountType":187,"accountTypeDesc":188,"profileDescription":189,"skillCount":190,"repoCount":191,"professionCount":130,"scenarioCount":6,"totalStars":192,"updatedAt":193},"01M6DJCCDDG53MTYYRTXAXFG17","garrytan","Garry Tan","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F19957?v=4","USER","个人作者","Writes software, dreams. ",324,3,174614,"2026-11-13 04:05:07",9,{"records":196,"total":4,"current":589,"size":590},[197,238,262,285,305,324,344,364,383,401,417,438,455,482,502,515,542,566],{"skillNo":198,"name":199,"nameZh":18,"description":200,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":209,"categories":210,"keywords":217,"publishedAt":237},"01M6AENGG8MH1VE9ZKX7KWMWVA","exploiting-deeplink-vulnerabilities","Tests and exploits deep link (URL scheme and App Link) vulnerabilities in Android and iOS mobile applications to identify unauthorized access, data injection, intent hijacking, and redirect manipulation. Use when assessing mobile app attack surface through custom URI schemes, Android App Links, iOS Universal Links, or intent-based navigation. Activates for requests involving deep link security testing, URL scheme exploitation, mobile intent abuse, or link hijacking.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-deeplink-vulnerabilities\u002FSKILL.md",[211,214],{"categoryNo":212,"categoryName":213,"taxonomyType":58,"taxonomyTypeDesc":59},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":215,"categoryName":216,"taxonomyType":58,"taxonomyTypeDesc":59},"01JBSEEDCAT000000000000023","Skill与智能体开发",[218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236],"vulnerabilities","exploiting deeplink vulnerabilities","testing","android","security","cybersecurity","pr","mobile-security","ios","owasp-mobile","penetration-testing","data","owasp","exploitation","t1055","t1078","t1059","injection","deep-links","2026-11-10 10:12:30",{"skillNo":239,"name":240,"nameZh":18,"description":241,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":242,"categories":243,"keywords":245,"publishedAt":237},"01M6AEND5QGWY8CAG3NQPN9RZH","exploiting-constrained-delegation-abuse","Exploits Kerberos Constrained Delegation misconfigurations in Active Directory using Impacket's findDelegation.py and getST.py (or Rubeus\u002FKekeo on Windows) to abuse S4U2Self and S4U2Proxy and impersonate privileged users. Use during authorized Active Directory penetration tests or red-team engagements for lateral movement and privilege escalation after finding an account trusted for constrained delegation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-constrained-delegation-abuse\u002FSKILL.md",[244],{"categoryNo":215,"categoryName":216,"taxonomyType":58,"taxonomyTypeDesc":59},[246,247,248,223,249,250,251,252,253,254,255,256,257,258,259,233,234,260,261],"delegation","exploiting constrained delegation abuse","directory","windows","protocol","server","red-team","active-directory","privilege-escalation","network","escalation","lateral-movement","Impacket","kerberos","constrained-delegation","s4u2proxy",{"skillNo":263,"name":264,"nameZh":18,"description":265,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":266,"categories":267,"keywords":270,"publishedAt":237},"01M6AEN8W246K6WX2WAQSDA97H","exploiting-broken-link-hijacking","Discovers and exploits broken link hijacking by spidering a site (Burp Suite Spider, Scrapy, curl scraping), extracting referenced external scripts\u002Fdomains, and checking DNS\u002FCNAME records and domain registration status for expired or unclaimed resources an attacker could register. Use for subdomain takeover testing, supply-chain review of third-party scripts, or bug bounty hunting for hijackable external resources.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-broken-link-hijacking\u002FSKILL.md",[268,269],{"categoryNo":212,"categoryName":213,"taxonomyType":58,"taxonomyTypeDesc":59},{"categoryNo":215,"categoryName":216,"taxonomyType":58,"taxonomyTypeDesc":59},[271,220,272,222,223,273,274,224,275,276,277,278,234,279,280,281,282,283,284],"exploiting broken link hijacking","review","web","status","dns","supply-chain","bug bounty","web-application-security","broken-link-hijacking","blh","subdomain-takeover","dead-link","expired-domain","external-resource",{"skillNo":286,"name":287,"nameZh":18,"description":288,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":289,"categories":290,"keywords":297,"publishedAt":237},"01M6AEN55ZY9TQAPNEFY6WS3NP","exploiting-broken-function-level-authorization","Tests APIs for Broken Function Level Authorization (OWASP API5:2023) by identifying admin and privileged endpoints, then reaching them with regular-user credentials via HTTP method switching, URL path manipulation, and parameter tampering. Use when testing whether low-privilege users can invoke admin API functions or otherwise escalate privileges via function-level access control gaps.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-broken-function-level-authorization\u002FSKILL.md",[291,292,295,296],{"categoryNo":212,"categoryName":213,"taxonomyType":58,"taxonomyTypeDesc":59},{"categoryNo":293,"categoryName":294,"taxonomyType":58,"taxonomyTypeDesc":59},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":215,"categoryName":216,"taxonomyType":58,"taxonomyTypeDesc":59},{"categoryNo":10,"categoryName":13,"taxonomyType":11,"taxonomyTypeDesc":12},[298,299,220,222,223,300,224,301,254,302,303,256,230,234,304],"authorization","exploiting broken function level authorization","http","admin","api-security","access-control","bfla",{"skillNo":306,"name":307,"nameZh":18,"description":308,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":309,"categories":310,"keywords":312,"publishedAt":237},"01M6AEN1A0G8NGHMMWZ768Q0EP","exploiting-bgp-hijacking-vulnerabilities","Analyzes and simulates BGP hijacking scenarios in authorized lab environments to assess route origin validation, RPKI deployment, and BGP monitoring defenses against prefix hijacking and route leak attacks on internet routing infrastructure.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-bgp-hijacking-vulnerabilities\u002FSKILL.md",[311],{"categoryNo":215,"categoryName":216,"taxonomyType":58,"taxonomyTypeDesc":59},[218,313,222,223,224,314,315,316,317,318,255,319,320,321,322,323],"exploiting bgp hijacking vulnerabilities","infrastructure","deployment","routing","validation","monitoring","network-security","bgp","routing-security","rpki","route-hijacking",{"skillNo":325,"name":326,"nameZh":18,"description":327,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":328,"categories":329,"keywords":332,"publishedAt":237},"01M6AEMXMM2XFPKV0DQY7WK2ZA","exploiting-aws-with-pacu","Runs the Pacu AWS exploitation framework end-to-end — session and credential setup, IAM enumeration, automated privilege-escalation scanning via iam__privesc_scan, and persistence\u002Fbackdooring modules like iam__backdoor_users_keys. Use for authorized AWS penetration tests or red-team engagements, assessing blast radius from a compromised IAM credential, or generating attacker telemetry for purple-team detection testing.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-aws-with-pacu\u002FSKILL.md",[330,331],{"categoryNo":212,"categoryName":213,"taxonomyType":58,"taxonomyTypeDesc":59},{"categoryNo":215,"categoryName":216,"taxonomyType":58,"taxonomyTypeDesc":59},[333,334,220,222,223,335,224,336,337,252,254,338,339,256,340,231,341,233,342,343],"aws","exploiting aws with pacu","telemetry","blast radius","framework","cloud-security","iam","purple-team","enumeration","pacu","iam-abuse",{"skillNo":345,"name":346,"nameZh":18,"description":347,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":348,"categories":349,"keywords":355,"publishedAt":237},"01M6AEMSDWYZEEZ04DJNZ2B6ZZ","exploiting-api-injection-vulnerabilities","Tests API parameters, headers, and request bodies for injection flaws — SQL injection, NoSQL injection, OS command injection, LDAP injection, and SSRF — by crafting payloads tailored to the target backend to extract data, execute commands, or reach internal services, mapped to OWASP API8:2023 and API7:2023 SSRF. Use when performing SQLi, NoSQL injection, command injection, or SSRF testing against APIs, or assessing API input validation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-api-injection-vulnerabilities\u002FSKILL.md",[350,351,352,353,354],{"categoryNo":212,"categoryName":213,"taxonomyType":58,"taxonomyTypeDesc":59},{"categoryNo":293,"categoryName":294,"taxonomyType":58,"taxonomyTypeDesc":59},{"categoryNo":215,"categoryName":216,"taxonomyType":58,"taxonomyTypeDesc":59},{"categoryNo":10,"categoryName":13,"taxonomyType":11,"taxonomyTypeDesc":12},{"categoryNo":28,"categoryName":29,"taxonomyType":11,"taxonomyTypeDesc":12},[218,356,220,222,223,357,224,317,358,359,302,229,360,230,361,232,234,235,362,363],"exploiting api injection vulnerabilities","sql","services","ldap","ssrf","command-injection","sqli","nosql",{"skillNo":365,"name":366,"nameZh":18,"description":367,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":368,"categories":369,"keywords":371,"publishedAt":237},"01M6AEMPCNS29K0P2E6JJVNRTS","exploiting-adcs-with-certipy","Use Certipy to enumerate AD CS certificate authorities and templates over LDAP\u002FRPC, then exploit ESC1-ESC16 misconfigurations - SAN abuse, NTLM relay to web enrollment (ESC8), Shadow Credentials, golden certificate forgery, and PKINIT\u002FSchannel auth. Use during authorized penetration tests to escalate a domain foothold to Domain Admin, or to validate that certificate template ACLs and CA hardening detect these attacks.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-adcs-with-certipy\u002FSKILL.md",[370],{"categoryNo":215,"categoryName":216,"taxonomyType":58,"taxonomyTypeDesc":59},[372,373,248,223,273,374,375,224,376,301,252,253,377,254,378,256,379,380,381,382],"certipy","exploiting adcs with certipy","auth","validate","rpc","pkinit","hardening","templates","esc8","esc1","adcs",{"skillNo":384,"name":385,"nameZh":18,"description":386,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":387,"categories":388,"keywords":390,"publishedAt":237},"01M6AEMJR7SVMP6TFTN6PFCRHX","exploiting-active-directory-with-bloodhound","BloodHound is a graph-based Active Directory reconnaissance tool that uses graph theory to reveal hidden and unintended relationships within AD environments. Red teams use BloodHound to identify attac","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-active-directory-with-bloodhound\u002FSKILL.md",[389],{"categoryNo":215,"categoryName":216,"taxonomyType":58,"taxonomyTypeDesc":59},[248,391,392,393,223,394,395,396,252,397,253,398,399,400,231,233,234],"bloodhound","exploiting active directory with bloodhound","policy","teams","authentication","graph","post-exploitation","mitre-attack","adversary-simulation","reconnaissance",{"skillNo":402,"name":403,"nameZh":18,"description":404,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":405,"categories":406,"keywords":408,"publishedAt":237},"01M6AEMEQ12BJDNZHRTZZT11FY","exploiting-active-directory-certificate-services-esc1","Exploit misconfigured Active Directory Certificate Services (AD CS) ESC1 vulnerability to request certificates as high-privileged users and escalate domain privileges during authorized red team assessments.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-active-directory-certificate-services-esc1\u002FSKILL.md",[407],{"categoryNo":215,"categoryName":216,"taxonomyType":58,"taxonomyTypeDesc":59},[248,358,409,223,317,410,411,412,252,253,413,254,378,256,233,234,414,381,415,416],"exploiting active directory certificate services esc1","content","metadata","file","red team","ad-cs","certificate-abuse","domain-escalation",{"skillNo":418,"name":419,"nameZh":18,"description":420,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":421,"categories":422,"keywords":425,"publishedAt":237},"01M6AEMBB88KVQAVEYRR520E03","executing-red-team-exercise","Run a stealthy, MITRE ATT&CK-mapped adversary emulation against an organization's people, processes, and technology, using C2 infrastructure (Cobalt Strike, Sliver, Brute Ratel, Mythic) through the full attack lifecycle to test SOC detection and response rather than just find vulnerabilities. Use when executing a full-scope red team exercise, adversary simulation\u002Femulation, or a regulatory exercise (TIBER-EU, CBEST, AASE, iCAST) with executive authorization and a signed Rules of Engagement already in place.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexecuting-red-team-exercise\u002FSKILL.md",[423,424],{"categoryNo":212,"categoryName":213,"taxonomyType":58,"taxonomyTypeDesc":59},{"categoryNo":215,"categoryName":216,"taxonomyType":58,"taxonomyTypeDesc":59},[413,426,220,223,427,314,428,429,412,252,430,431,432,433,434,435,436,233,234,437],"executing red team exercise","test","assessment","run","cobalt-strike","c2","MITRE-ATT&CK","soc","sliver","adversary-emulation","ATT&CK","detection-assessment",{"skillNo":439,"name":440,"nameZh":18,"description":441,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":442,"categories":443,"keywords":446,"publishedAt":237},"01M6AEM7BQN3M1F2QHCKR1MFEA","executing-red-team-engagement-planning","Build the foundational red team engagement plan - scope definition, Rules of Engagement (restrictions, communication plan, emergency stop procedures, legal authorization), MITRE ATT&CK-aligned threat profile selection, and operational timelines - producing an engagement brief for stakeholder approval. Use before any offensive testing begins, when scoping a full-scope, assumed-breach, objective-based, or purple-team engagement.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexecuting-red-team-engagement-planning\u002FSKILL.md",[444,445],{"categoryNo":212,"categoryName":213,"taxonomyType":58,"taxonomyTypeDesc":59},{"categoryNo":215,"categoryName":216,"taxonomyType":58,"taxonomyTypeDesc":59},[447,413,448,220,223,449,450,451,252,397,398,399,340,452,231,436,233,234,453,454],"planning","executing red team engagement planning","engagement plan","communication","brief","assumed-breach","engagement-planning","rules-of-engagement",{"skillNo":456,"name":457,"nameZh":18,"description":458,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":459,"categories":460,"keywords":469,"publishedAt":237},"01M6AEM3SPVHNA5M1R9Y4B01AR","executing-phishing-simulation-campaign","Executes authorized phishing simulation campaigns to assess an organization's susceptibility to email-based social engineering attacks. The tester designs realistic phishing scenarios, builds credential harvesting infrastructure, sends targeted phishing emails, and tracks open rates, click-through rates, and credential submission rates to measure human security awareness. Activates for requests involving phishing simulation, social engineering assessment, email security testing, or security awareness measurement.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexecuting-phishing-simulation-campaign\u002FSKILL.md",[461,464,465,468],{"categoryNo":462,"categoryName":463,"taxonomyType":58,"taxonomyTypeDesc":59},"01JBSEEDCAT000000000000005","邮件与沟通",{"categoryNo":212,"categoryName":213,"taxonomyType":58,"taxonomyTypeDesc":59},{"categoryNo":466,"categoryName":467,"taxonomyType":58,"taxonomyTypeDesc":59},"01JBSEEDCAT000000000000019","营销推广",{"categoryNo":42,"categoryName":43,"taxonomyType":11,"taxonomyTypeDesc":12},[470,471,220,222,223,314,428,472,473,474,475,476,477,478,479,400,480,233,234,481],"phishing","executing phishing simulation campaign","development","create","website","email","email-security","social-engineering","awareness","security-awareness","t1003","phishing-simulation",{"skillNo":483,"name":484,"nameZh":18,"description":485,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":486,"categories":487,"keywords":488,"publishedAt":237},"01M6AEKZCYS3TA3BQVH2YQV2BZ","executing-nist-rmf-authorization-to-operate","Drive a federal system through the NIST Risk Management Framework (SP 800-37 Rev 2) to an Authorization to Operate (ATO): Prepare, Categorize (FIPS 199), Select a control baseline (FIPS 200 \u002F SP 800-53 Rev 5), Implement, Assess (SP 800-53A), Authorize, and Monitor continuously. Use when a system needs an ATO or a renewal, when working a FISMA\u002FFedRAMP authorization package, when building or reviewing an SSP, SAR, or POA&M, when categorizing a system as Low\u002FModerate\u002FHigh impact, when selecting or tailoring a control baseline, or when standing up continuous monitoring (ConMon) after authorization. Covers ATO, conditional ATO (cATO), and the artifacts assessors expect. Keywords: NIST RMF, 800-37, ATO, authorization to operate, FISMA, FedRAMP, SSP, SAR, POA&M, FIPS 199, FIPS 200, 800-53, 800-53A, control baseline, security categorization, continuous monitoring, authorizing official, system boundary, ongoing authorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexecuting-nist-rmf-authorization-to-operate\u002FSKILL.md",[],[489,298,490,222,223,491,224,492,337,318,233,493,494,495,496,497,498,499,500,501],"NIST","executing nist rmf authorization to operate","official","monitor","nist-rmf","nist-800-37","ato","fisma","fedramp","nist-800-53","fips-199","ssp","continuous-monitoring",{"skillNo":503,"name":504,"nameZh":18,"description":505,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":506,"categories":507,"keywords":510,"publishedAt":237},"01M6AEKVJH5FB5ZH79M1PPC92D","executing-active-directory-attack-simulation","Executes authorized attack simulations against Active Directory environments to identify misconfigurations, weak credentials, dangerous privilege paths, and exploitable trust relationships that could lead to domain compromise. The tester uses BloodHound for attack path analysis, Mimikatz for credential extraction, and Impacket for protocol-level attacks including Kerberoasting, AS-REP Roasting, and delegation abuse. Activates for requests involving Active Directory pentest, AD attack simulation, domain compromise testing, or Kerberos attack assessment.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexecuting-active-directory-attack-simulation\u002FSKILL.md",[508,509],{"categoryNo":212,"categoryName":213,"taxonomyType":58,"taxonomyTypeDesc":59},{"categoryNo":215,"categoryName":216,"taxonomyType":58,"taxonomyTypeDesc":59},[248,511,220,223,428,250,246,251,253,512,228,255,258,391,259,513,480,233,234,514],"executing active directory attack simulation","mimikatz","kerberoasting","domain-compromise",{"skillNo":516,"name":517,"nameZh":18,"description":518,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":519,"categories":520,"keywords":522,"publishedAt":237},"01M6AEKR1KZC1JMWN08YDTQ1AS","evaluating-threat-intelligence-platforms","Evaluates and selects Threat Intelligence Platform (TIP) products based on organizational requirements including feed integration capability, STIX\u002FTAXII support, workflow automation, analyst interface, and total cost of ownership. Use when conducting a TIP procurement, migrating between TIP solutions, or assessing whether the current TIP meets program maturity requirements. Activates for requests involving ThreatConnect, MISP, OpenCTI, Anomali, EclecticIQ, or TIP procurement decisions.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fevaluating-threat-intelligence-platforms\u002FSKILL.md",[521],{"categoryNo":215,"categoryName":216,"taxonomyType":58,"taxonomyTypeDesc":59},[523,524,223,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541],"threat intelligence","evaluating threat intelligence platforms","workflow","support","automation","integration","Workflow Automation","threat-intelligence","cti","stix","MISP","TAXII","ThreatConnect","STIX-TAXII","TIP","Anomali","EclecticIQ","CTI-program","procurement",{"skillNo":543,"name":544,"nameZh":18,"description":545,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":546,"categories":547,"keywords":552,"publishedAt":237},"01M6AEKMCCM5SQHT60DASW5GA5","escaping-containers-to-host","Exploits privileged pods, host mounts, runC CVEs, and exposed Docker sockets to break out of a container and reach the underlying host during an authorized container-security assessment. Use when executing an approved breakout test, demonstrating the real impact of a privileged or hostPath workload, or validating that escape mitigations actually hold. Keywords: container breakout, privileged, hostPath, docker.sock, runC CVE-2019-5736, CVE-2024-21626, release_agent, nsenter. Do not use for defensive detection of these techniques - use detecting-container-escape-attempts.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fescaping-containers-to-host\u002FSKILL.md",[548,551],{"categoryNo":549,"categoryName":550,"taxonomyType":58,"taxonomyTypeDesc":59},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":215,"categoryName":216,"taxonomyType":58,"taxonomyTypeDesc":59},[553,554,555,556,222,223,427,557,224,428,558,559,254,560,256,561,562,563,564,565],"containers","escaping containers to host","docker","kubernetes","workload","release","cve","container-security","detection","container-escape","docker-socket","host-mount","breakout",{"skillNo":567,"name":568,"nameZh":18,"description":569,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":570,"categories":571,"keywords":573,"publishedAt":237},"01M6AEKGNPDDXQ1PG5VXV72YXM","eradicating-malware-from-infected-systems","Systematically map and remove malware, backdoors, and attacker persistence mechanisms (registry Run keys, scheduled tasks, WMI subscriptions, services, cron\u002Finit.d) from infected Windows and Linux systems using Autoruns, EDR\u002FAV, and YARA, restoring a clean state while preventing re-infection. Use after containment and forensic analysis have identified all compromised systems and persistence mechanisms and you are ready to eradicate and recover.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Feradicating-malware-from-infected-systems\u002FSKILL.md",[572],{"categoryNo":215,"categoryName":216,"taxonomyType":58,"taxonomyTypeDesc":59},[574,575,576,223,577,249,578,429,579,580,581,358,582,583,584,585,586,587,233,588],"malware","eradicating malware from infected systems","linux","init","tasks","registry","state","persistence","dfir","yara","autoruns","incident-response","containment","edr","wmi",111,18]