[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skills:stats":3,"skills:sce6":8,"skills:pro6":55,"skills:creators9":100,"skills:all:stars:112:":195},{"skillCount":4,"professionCount":5,"scenarioCount":6,"creatorCount":7},196852,11,7,1926,[9,20,27,34,41,48],{"categoryNo":10,"taxonomyType":11,"taxonomyTypeDesc":12,"categoryName":13,"categoryNameEn":14,"description":15,"level":16,"skillCount":17,"parentNo":18,"parentName":18,"children":19},"01JBSEEDCAT000000000000022","SCENARIO","使用场景","智能体与自动化","Agents & Automation","Skill、MCP、智能体与工作流自动化",1,39458,null,[],{"categoryNo":21,"taxonomyType":11,"taxonomyTypeDesc":12,"categoryName":22,"categoryNameEn":23,"description":24,"level":16,"skillCount":25,"parentNo":18,"parentName":18,"children":26},"01JBSEEDCAT000000000000006","软件开发","Software Development","编码、测试、部署等软件研发任务",26531,[],{"categoryNo":28,"taxonomyType":11,"taxonomyTypeDesc":12,"categoryName":29,"categoryNameEn":30,"description":31,"level":16,"skillCount":32,"parentNo":18,"parentName":18,"children":33},"01JBSEEDCAT000000000000014","设计创意","Design & Creative","视觉设计、品牌与多媒体创作",13569,[],{"categoryNo":35,"taxonomyType":11,"taxonomyTypeDesc":12,"categoryName":36,"categoryNameEn":37,"description":38,"level":16,"skillCount":39,"parentNo":18,"parentName":18,"children":40},"01JBSEEDCAT000000000000001","办公效率","Office Productivity","日常办公文档、表格、演示与沟通类任务",6289,[],{"categoryNo":42,"taxonomyType":11,"taxonomyTypeDesc":12,"categoryName":43,"categoryNameEn":44,"description":45,"level":16,"skillCount":46,"parentNo":18,"parentName":18,"children":47},"01JBSEEDCAT000000000000017","内容创作","Content Creation","写作、文案与营销内容生产",6029,[],{"categoryNo":49,"taxonomyType":11,"taxonomyTypeDesc":12,"categoryName":50,"categoryNameEn":51,"description":52,"level":16,"skillCount":53,"parentNo":18,"parentName":18,"children":54},"01JBSEEDCAT000000000000020","研究与学习","Research & Learning","资料检索、知识整理与学习辅导",5531,[],[56,65,72,79,86,93],{"categoryNo":57,"taxonomyType":58,"taxonomyTypeDesc":59,"categoryName":60,"categoryNameEn":61,"description":62,"level":16,"skillCount":63,"parentNo":18,"parentName":18,"children":64},"01JBSEEDCAT000000000000030","PROFESSION","适用职业","开发工程师","Software Engineer","从事软件编码、测试与运维的工程师",13274,[],{"categoryNo":66,"taxonomyType":58,"taxonomyTypeDesc":59,"categoryName":67,"categoryNameEn":68,"description":69,"level":16,"skillCount":70,"parentNo":18,"parentName":18,"children":71},"01JBSEEDCAT000000000000032","设计师","Designer","视觉、交互与品牌设计人员",7775,[],{"categoryNo":73,"taxonomyType":58,"taxonomyTypeDesc":59,"categoryName":74,"categoryNameEn":75,"description":76,"level":16,"skillCount":77,"parentNo":18,"parentName":18,"children":78},"01JBSEEDCAT000000000000033","数据分析师","Data Analyst","数据分析、报表与商业智能人员",4988,[],{"categoryNo":80,"taxonomyType":58,"taxonomyTypeDesc":59,"categoryName":81,"categoryNameEn":82,"description":83,"level":16,"skillCount":84,"parentNo":18,"parentName":18,"children":85},"01JBSEEDCAT000000000000036","内容创作者","Content Creator","作者、编辑与自媒体创作者",3940,[],{"categoryNo":87,"taxonomyType":58,"taxonomyTypeDesc":59,"categoryName":88,"categoryNameEn":89,"description":90,"level":16,"skillCount":91,"parentNo":18,"parentName":18,"children":92},"01JBSEEDCAT000000000000035","市场营销","Marketer","市场推广、增长与品牌运营人员",3446,[],{"categoryNo":94,"taxonomyType":58,"taxonomyTypeDesc":59,"categoryName":95,"categoryNameEn":96,"description":97,"level":16,"skillCount":98,"parentNo":18,"parentName":18,"children":99},"01JBSEEDCAT000000000000037","律师与法务","Legal","合同、合规与法律事务人员",3316,[],{"records":101,"total":7,"current":16,"size":194},[102,114,123,133,143,153,163,172,182],{"accountNo":103,"login":104,"displayName":105,"avatarUrl":106,"accountType":107,"accountTypeDesc":108,"profileDescription":109,"skillCount":110,"repoCount":111,"professionCount":5,"scenarioCount":6,"totalStars":112,"updatedAt":113},"01M698VYDXZ6JW5WH3CRV650R8","microsoft","Microsoft","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F6154722?v=4","ORGANIZATION","组织","Open source projects and samples from Microsoft",4160,229,828772,"2026-11-13 04:10:52",{"accountNo":115,"login":116,"displayName":116,"avatarUrl":117,"accountType":107,"accountTypeDesc":108,"profileDescription":118,"skillCount":119,"repoCount":120,"professionCount":6,"scenarioCount":6,"totalStars":121,"updatedAt":122},"01M698P3FSAZ6B4R928ZF19KPT","openclaw","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F252820863?v=4","Your personal, open source AI assistant.",362,32,437711,"2026-11-13 03:02:05",{"accountNo":124,"login":125,"displayName":126,"avatarUrl":127,"accountType":107,"accountTypeDesc":108,"profileDescription":18,"skillCount":128,"repoCount":129,"professionCount":6,"scenarioCount":130,"totalStars":131,"updatedAt":132},"01M6AC29YGCR4S2NTJFV0G8B81","openai","OpenAI","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F14957082?v=4",171,23,6,342695,"2026-11-13 04:03:41",{"accountNo":134,"login":135,"displayName":136,"avatarUrl":137,"accountType":107,"accountTypeDesc":108,"profileDescription":18,"skillCount":138,"repoCount":139,"professionCount":140,"scenarioCount":6,"totalStars":141,"updatedAt":142},"01M6AC83E6K4FDKK7HZ8WNMQKE","apache","The Apache Software Foundation","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F47359?v=4",420,75,8,298176,"2026-11-13 03:14:28",{"accountNo":144,"login":145,"displayName":146,"avatarUrl":147,"accountType":107,"accountTypeDesc":108,"profileDescription":148,"skillCount":149,"repoCount":150,"professionCount":5,"scenarioCount":6,"totalStars":151,"updatedAt":152},"01M698VYEFDM0VJBZDYYJ2T83S","google","Google","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1342004?v=4","Google ❤️ Open Source",535,48,242366,"2026-11-13 04:17:09",{"accountNo":154,"login":155,"displayName":156,"avatarUrl":157,"accountType":107,"accountTypeDesc":108,"profileDescription":158,"skillCount":159,"repoCount":160,"professionCount":5,"scenarioCount":6,"totalStars":161,"updatedAt":162},"01M6AC83DS133TPXFSP1DHNCC6","github","GitHub","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F9919?v=4","How people build software.",940,28,238441,"2026-11-13 03:57:35",{"accountNo":164,"login":165,"displayName":166,"avatarUrl":167,"accountType":107,"accountTypeDesc":108,"profileDescription":18,"skillCount":168,"repoCount":169,"professionCount":5,"scenarioCount":6,"totalStars":170,"updatedAt":171},"01M697XGDPXJAVQ8391V2BCYTE","anthropics","Anthropic","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F76263028?v=4",674,17,231826,"2026-11-13 04:18:26",{"accountNo":173,"login":174,"displayName":175,"avatarUrl":176,"accountType":107,"accountTypeDesc":108,"profileDescription":18,"skillCount":177,"repoCount":178,"professionCount":179,"scenarioCount":6,"totalStars":180,"updatedAt":181},"01M6AC83EPDGBFN19MWYRREJD0","Significant-Gravitas","AutoGPT","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F130738209?v=4",86,2,10,188014,"2026-11-13 02:38:59",{"accountNo":183,"login":184,"displayName":185,"avatarUrl":186,"accountType":187,"accountTypeDesc":188,"profileDescription":189,"skillCount":190,"repoCount":191,"professionCount":130,"scenarioCount":6,"totalStars":192,"updatedAt":193},"01M6DJCCDDG53MTYYRTXAXFG17","garrytan","Garry Tan","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F19957?v=4","USER","个人作者","Writes software, dreams. ",324,3,174614,"2026-11-13 04:05:07",9,{"records":196,"total":4,"current":591,"size":592},[197,236,259,284,312,328,347,365,388,404,422,445,463,485,510,534,559,570],{"skillNo":198,"name":199,"nameZh":18,"description":200,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":209,"categories":210,"keywords":214,"publishedAt":235},"01M6AEKDFW4PBYE9NWD4BFBHGZ","enumerating-cloud-with-cloudfox","Run CloudFox's read-only Describe\u002FList\u002FGet enumeration (all-checks, role-trusts, secrets, endpoints, and permissions commands) to map AWS and Azure attack paths and surface exploitable misconfigurations. Use immediately after obtaining a cloud credential to build situational awareness, find exposed resources and secrets, or map sts:AssumeRole trust relationships for lateral-movement\u002Fprivilege-escalation planning.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fenumerating-cloud-with-cloudfox\u002FSKILL.md",[211],{"categoryNo":212,"categoryName":213,"taxonomyType":11,"taxonomyTypeDesc":12},"01JBSEEDCAT000000000000023","Skill与智能体开发",[215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234],"cloud","enumerating cloud with cloudfox","security","cybersecurity","azure","run","planning","permissions","privilege-escalation","cloud-security","awareness","aws","attack-paths","situational-awareness","escalation","offensive-security","lateral-movement","enumeration","cloudfox","cloud-pentest","2026-11-10 10:12:30",{"skillNo":237,"name":238,"nameZh":18,"description":239,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":240,"categories":241,"keywords":243,"publishedAt":235},"01M6AEK9PY53WCFCEJ3WZK4DGG","emulating-cloud-attacks-with-stratus-red-team","Install and run Stratus Red Team to detonate granular, MITRE ATT&CK-mapped AWS, Azure, GCP, and Kubernetes attack techniques through their warmup-detonate-revert-cleanup lifecycle, then verify the telemetry they generate. Use to validate that cloud detections (CloudTrail, GuardDuty, Microsoft Sentinel, GCP SCC, Falco) actually fire, or to run a repeatable purple-team exercise generating realistic attacker telemetry.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Femulating-cloud-attacks-with-stratus-red-team\u002FSKILL.md",[242],{"categoryNo":212,"categoryName":213,"taxonomyType":11,"taxonomyTypeDesc":12},[215,244,245,246,217,218,247,248,220,249,250,224,251,252,253,254,255,256,257,258],"red team","emulating cloud attacks with stratus red team","kubernetes","cleanup","generate","red-team","mitre-attack","threat-detection","gcp","sentinel","adversary-emulation","purple-team","guardduty","falco","t1078",{"skillNo":260,"name":261,"nameZh":18,"description":262,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":263,"categories":264,"keywords":266,"publishedAt":235},"01M6AEK6C522Z13D355C72PTG0","detecting-wmi-persistence","Detect WMI event subscription persistence (MITRE T1546.003) by analyzing Sysmon Event IDs 19, 20, and 21 for malicious EventFilter, EventConsumer, and FilterToConsumerBinding creation, cross-referenced against root\\subscription namespace contents and Sysinternals Autoruns. Use when hunting WMI-based persistence, triaging a Sysmon alert on these event IDs, or during incident response and purple-team validation of WMI defenses.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-wmi-persistence\u002FSKILL.md",[265],{"categoryNo":212,"categoryName":213,"taxonomyType":11,"taxonomyTypeDesc":12},[267,268,269,218,270,271,272,273,274,275,250,276,277,278,279,280,255,281,282,283],"persistence","detecting wmi persistence","malicious","incident response","windows","validation","protocol","monitoring","server","threat-hunting","dfir","analyzing","T1059.001","sysmon","ids","t1059","wmi",{"skillNo":285,"name":286,"nameZh":18,"description":287,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":288,"categories":289,"keywords":294,"publishedAt":235},"01M6AEK2S5047YW4D0H9Y43134","detecting-typosquatting-packages","Flag misspelled, brandjacked, and typosquatted package names across npm, PyPI, and crates.io before installation, using edit-distance, keyboard-proximity, and known-target corpus matching with typomania, Microsoft OSSGadget's oss-find-squats, and pypi-scan. Use before adding a new dependency, as a CI\u002FCD gate on pull requests, when reviewing an AI-generated (\"slopsquatting\") dependency list, or when auditing a lockfile diff for a swapped package.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-typosquatting-packages\u002FSKILL.md",[290,293],{"categoryNo":291,"categoryName":292,"taxonomyType":11,"taxonomyTypeDesc":12},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":212,"categoryName":213,"taxonomyType":11,"taxonomyTypeDesc":12},[295,296,297,217,218,104,298,299,300,301,302,303,304,305,306,307,308,309,310,311],"packages","typosquatting","detecting typosquatting packages","pull requests","registry","pull","npm","package","pypi","ci","lockfile","supply-chain","supply-chain-security","package-registry","typomania","ossgadget","dependency-screening",{"skillNo":313,"name":314,"nameZh":18,"description":315,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":316,"categories":317,"keywords":319,"publishedAt":235},"01M6AEJZ0Y8TQMZNQQHRYSQHQ6","detecting-typosquatting-packages-in-npm-pypi","Detects typosquatting attacks in npm and PyPI package registries by analyzing package name similarity using Levenshtein distance and other string metrics, examining publish date heuristics to identify recently created packages mimicking established ones, and flagging download count anomalies where suspicious packages have disproportionately low usage compared to their legitimate targets. The analyst queries the PyPI JSON API and npm registry API to gather package metadata for automated comparison. Activates for requests involving package typosquatting detection, dependency confusion analysis, malicious package identification, or software supply chain threat hunting in package registries.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-typosquatting-packages-in-npm-pypi\u002FSKILL.md",[318],{"categoryNo":212,"categoryName":213,"taxonomyType":11,"taxonomyTypeDesc":12},[295,301,303,296,320,269,321,217,218,322,299,323,302,324,278,306,325,307,326,327],"detecting typosquatting packages in npm pypi","suspicious","threat hunting","metrics","publish","dependency-confusion","heuristics","package-security",{"skillNo":329,"name":330,"nameZh":18,"description":331,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":332,"categories":333,"keywords":335,"publishedAt":235},"01M6AEJVDGB8GN8RMGKZFB8JMA","detecting-t1548-abuse-elevation-control-mechanism","Detect abuse of elevation control mechanisms (T1548), including Windows UAC bypass via auto-elevating binaries like fodhelper.exe and Linux sudo\u002Fsetuid\u002Fsetgid exploitation, by monitoring registry changes, integrity-level transitions, and parent-child process relationships via Sysmon and Windows Security events. Use when hunting privilege-escalation activity or validating elevation-abuse detection coverage.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-t1548-abuse-elevation-control-mechanism\u002FSKILL.md",[334],{"categoryNo":212,"categoryName":213,"taxonomyType":11,"taxonomyTypeDesc":12},[336,337,218,271,338,299,272,339,274,223,276,280,229,340,341,342,343,344,345,346],"detecting t1548 abuse elevation control mechanism","linux","authentication","file","exploitation","windows-security","detection","uac-bypass","execution","mitre-t1548","elevation-control",{"skillNo":348,"name":349,"nameZh":18,"description":350,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":351,"categories":352,"keywords":354,"publishedAt":235},"01M6AEJQXSSN95WRVGXHAR8WAB","detecting-t1055-process-injection-with-sysmon","Detect process injection techniques (T1055) - including DLL injection, process hollowing, and APC injection - by analyzing Sysmon Event IDs 1, 7, 8, 10, and 25 for cross-process memory operations, remote thread creation, and anomalous DLL loads. Use when hunting defense-evasion activity that hides code inside legitimate processes, investigating an EDR alert on suspicious cross-process access, or validating Sysmon coverage for injection detection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-t1055-process-injection-with-sysmon\u002FSKILL.md",[353],{"categoryNo":212,"categoryName":213,"taxonomyType":11,"taxonomyTypeDesc":12},[280,355,356,321,357,218,358,272,339,276,278,359,281,342,360,361,362,344,363,364],"t1055","detecting t1055 process injection with sysmon","memory","code","process-injection","edr","defense","defense-evasion","mitre-t1055","dll-injection",{"skillNo":366,"name":367,"nameZh":18,"description":368,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":369,"categories":370,"keywords":375,"publishedAt":235},"01M6AEJKW3SSDR9WQPZJRGQBSR","detecting-t1003-credential-dumping-with-edr","Detect OS credential dumping (MITRE T1003) targeting LSASS memory, the SAM database, NTDS.dit, and cached credentials by correlating EDR telemetry, Sysmon process-access events, and Windows security event logs. Use when hunting for Mimikatz-style credential theft, triaging an EDR alert on LSASS access, or scoping an incident after suspected credential dumping.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-t1003-credential-dumping-with-edr\u002FSKILL.md",[371,374],{"categoryNo":372,"categoryName":373,"taxonomyType":11,"taxonomyTypeDesc":12},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":212,"categoryName":213,"taxonomyType":11,"taxonomyTypeDesc":12},[360,376,377,217,357,218,271,378,379,339,380,381,276,280,382,383,384,385,386,387],"t1003","detecting t1003 credential dumping with edr","telemetry","database","logs","mimikatz","reconnaissance","credential-dumping","lsass","mitre-t1003","ntds","sam-database",{"skillNo":389,"name":390,"nameZh":18,"description":391,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":392,"categories":393,"keywords":395,"publishedAt":235},"01M6AEJGEMEC7SATEXCPT55F9H","detecting-suspicious-powershell-execution","Hunt for suspicious PowerShell execution (T1059.001) such as encoded commands, download cradles, AMSI bypass, and constrained language mode evasion using EDR telemetry (CrowdStrike, Microsoft Defender for Endpoint), Sysmon, and SIEM queries (Splunk, Elastic). Use when proactively threat hunting, triaging EDR\u002FSIEM alerts, or scoping an incident involving malicious PowerShell activity.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-suspicious-powershell-execution\u002FSKILL.md",[394],{"categoryNo":212,"categoryName":213,"taxonomyType":11,"taxonomyTypeDesc":12},[321,396,397,269,218,398,322,378,399,250,276,400,279,280,401,402,360,403,344,282],"powershell","detecting suspicious powershell execution","siem","defender","splunk","elastic","endpoint","CrowdStrike",{"skillNo":405,"name":406,"nameZh":18,"description":407,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":408,"categories":409,"keywords":410,"publishedAt":235},"01M6AEJDEAKRC8EDFDA42JCZNY","detecting-suspicious-oauth-application-consent","Detect risky OAuth application consent grants in Azure AD \u002F Microsoft Entra ID using Microsoft Graph API, audit logs, and permission analysis to identify illicit consent grant attacks.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-suspicious-oauth-application-consent\u002FSKILL.md",[],[321,411,412,217,218,104,413,219,414,222,415,380,215,224,416,417,418,419,420,421],"OAuth","detecting suspicious oauth application consent","entra id","pr","audit","Microsoft-Graph","entra-id","azure-ad","illicit-consent","t1550","application-permissions",{"skillNo":423,"name":424,"nameZh":18,"description":425,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":426,"categories":427,"keywords":429,"publishedAt":235},"01M6AEJA3KKH6Q09Z3RJHVZ17G","detecting-supply-chain-attacks-in-ci-cd","Scans GitHub Actions workflows and CI\u002FCD pipeline configurations for supply chain attack vectors including unpinned actions, script injection via expressions, dependency confusion, and secrets exposure. Uses PyGithub and YAML parsing for automated audit. Use when hardening CI\u002FCD pipelines or investigating compromised build systems.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-supply-chain-attacks-in-ci-cd\u002FSKILL.md",[428],{"categoryNo":291,"categoryName":292,"taxonomyType":11,"taxonomyTypeDesc":12},[430,304,431,155,432,218,433,415,434,435,436,437,438,439,440,307,441,442,443,444],"ci cd","detecting supply chain attacks in ci cd","devsecops","workflows","yaml","actions","github actions","security-operations","hardening","pipeline","ci-cd","ci-cd-security","github-actions","pipeline-security","dependency-pinning",{"skillNo":446,"name":447,"nameZh":18,"description":448,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":449,"categories":450,"keywords":452,"publishedAt":235},"01M6AEJ6ZG3E6XX94H0P9TFVYW","detecting-stuxnet-style-attacks","Detects sophisticated cyber-physical attacks that follow the Stuxnet pattern of modifying PLC logic while spoofing sensor readings to hide the manipulation, using PLC logic integrity monitoring (Claroty xDome, Nozomi Guardian) and physics-based process anomaly detection. Use when hunting for IT-to-OT lateral movement or discrepancies between PLC program state and physical process behavior in ICS\u002FSCADA environments.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-stuxnet-style-attacks\u002FSKILL.md",[451],{"categoryNo":212,"categoryName":213,"taxonomyType":11,"taxonomyTypeDesc":12},[453,217,218,414,454,455,274,342,456,457,458,459,460,461,462],"detecting stuxnet style attacks","state","apt","ot-security","ics","scada","industrial-control","iec62443","stuxnet","plc-integrity",{"skillNo":464,"name":465,"nameZh":18,"description":466,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":467,"categories":468,"keywords":471,"publishedAt":235},"01M6AEJ31KJRWHSZ95704G52SY","detecting-sql-injection-via-waf-logs","Analyze WAF (ModSecurity\u002FAWS WAF\u002FCloudflare) logs to detect SQL injection attack campaigns. Parses ModSecurity audit logs and JSON WAF event logs to identify SQLi patterns (UNION SELECT, OR 1=1, SLEEP(), BENCHMARK()), tracks attack sources, correlates multi-stage injection attempts, and generates incident reports with OWASP classification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-sql-injection-via-waf-logs\u002FSKILL.md",[469,470],{"categoryNo":372,"categoryName":373,"taxonomyType":11,"taxonomyTypeDesc":12},{"categoryNo":73,"categoryName":74,"taxonomyType":58,"taxonomyTypeDesc":59},[472,380,473,474,217,218,475,476,477,415,437,478,479,226,480,342,481,482,483,484],"sql","waf","detecting sql injection via waf logs","web","benchmark","cloudflare","log-analysis","sql-injection-detection","owasp","waf-log-analysis","aws-waf","cloudflare-waf","web-application-security",{"skillNo":486,"name":487,"nameZh":18,"description":488,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":489,"categories":490,"keywords":495,"publishedAt":235},"01M6AEHZ4CYEYTCB2MY5MJY0NX","detecting-spearphishing-with-email-gateway","Detect and block spearphishing emails that use personalized, researched content to evade generic spam filters, by configuring email security gateway (SEG) impersonation protection, URL rewriting, attachment sandboxing, and custom detection rules in Microsoft Defender for Office 365, Proofpoint, Mimecast, or Barracuda. Use when hardening a mail gateway against targeted phishing or investigating a suspected spearphishing campaign.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-spearphishing-with-email-gateway\u002FSKILL.md",[491,494],{"categoryNo":492,"categoryName":493,"taxonomyType":11,"taxonomyTypeDesc":12},"01JBSEEDCAT000000000000005","邮件与沟通",{"categoryNo":212,"categoryName":213,"taxonomyType":11,"taxonomyTypeDesc":12},[496,497,498,499,217,218,500,399,414,501,502,503,504,505,506,507,508,225,361,509],"gateway","email","spearphishing","detecting spearphishing with email gateway","official","development","create","website","office","phishing","dmarc","email-security","social-engineering","email-gateway",{"skillNo":511,"name":512,"nameZh":18,"description":513,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":514,"categories":515,"keywords":519,"publishedAt":235},"01M6AEHVGAE2F8M31MHDC1Y0Z6","detecting-shadow-it-cloud-usage","Detect unauthorized SaaS and cloud service usage (shadow IT) by parsing proxy access logs, DNS query logs, and firewall\u002Fnetflow data with Python pandas to aggregate traffic by domain, classify domains against known SaaS categories, and score risk by data volume and user count. Use when auditing an organization for unsanctioned cloud\u002FSaaS usage or generating a shadow IT discovery report with remediation recommendations.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-shadow-it-cloud-usage\u002FSKILL.md",[516],{"categoryNo":517,"categoryName":518,"taxonomyType":11,"taxonomyTypeDesc":12},"01JBSEEDCAT000000000000013","分析与可视化",[215,520,521,218,414,522,523,524,380,224,525,526,527,528,529,258,530,531,532,533],"detecting shadow it cloud usage","python","report","pandas","proxy","dns","data","netflow","remediation","firewall","shadow-IT","SaaS-discovery","proxy-logs","DNS-analysis",{"skillNo":535,"name":536,"nameZh":18,"description":537,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":538,"categories":539,"keywords":542,"publishedAt":235},"01M6AEHQPZ43S5628DEMWS2352","detecting-shadow-api-endpoints","Discover and inventory shadow API endpoints that operate outside documented OpenAPI\u002FSwagger specs, using traffic analysis against API gateways (Kong, AWS API Gateway, Envoy), cloud configuration scanning, and source code repository mining for undocumented routes. Use when assessing API attack surface, auditing for forgotten test environments or deprecated API versions still running, or building an API registration governance policy.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-shadow-api-endpoints\u002FSKILL.md",[540,541],{"categoryNo":372,"categoryName":373,"taxonomyType":11,"taxonomyTypeDesc":12},{"categoryNo":57,"categoryName":60,"taxonomyType":58,"taxonomyTypeDesc":59},[543,544,218,545,546,414,358,496,547,548,549,550,551,552,553,554,555,556,557,558],"detecting shadow api endpoints","policy","test","governance","gateways","repository","api-security","kong","attack-surface","shadow-apis","api-discovery","undocumented-apis","zombie-apis","api-inventory","attack-surface-management","api-governance",{"skillNo":560,"name":561,"nameZh":18,"description":562,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":563,"categories":564,"keywords":566,"publishedAt":235},"01M6AEHM6SJCHEAJHBNQZDYKSC","detecting-service-account-abuse","Detect abuse of service accounts by hunting for anomalous interactive logons, privilege escalation, and lateral movement using EDR\u002FSIEM telemetry (CrowdStrike Falcon, Microsoft Defender, Splunk, Elastic Security, Sysmon, Velociraptor) and Sigma detection rules. Use when hunting for service-account misuse or investigating a service account performing unexpected interactive logons.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-service-account-abuse\u002FSKILL.md",[565],{"categoryNo":212,"categoryName":213,"taxonomyType":11,"taxonomyTypeDesc":12},[567,544,218,398,104,378,399,338,223,250,276,400,280,568,229,360,403,569,420,258],"detecting service account abuse","service-accounts","Falcon",{"skillNo":571,"name":572,"nameZh":18,"description":573,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":574,"categories":575,"keywords":578,"publishedAt":235},"01M6AEHGEAYP1HN60ZHMSKKHQV","detecting-serverless-function-injection","Detects and prevents code injection attacks targeting serverless functions (AWS Lambda, Azure Functions, Google Cloud Functions) through event source poisoning, malicious layer injection, runtime command execution, and IAM privilege escalation via function modification. The analyst combines static analysis of function code, CloudTrail event correlation, runtime behavior monitoring, and IAM policy auditing to identify injection vectors across the expanded serverless attack surface including API Gateway, S3, SQS, DynamoDB Streams, and CloudWatch event triggers. Activates for requests involving Lambda security assessment, serverless injection detection, function event poisoning analysis, or serverless privilege escalation investigation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-serverless-function-injection\u002FSKILL.md",[576,577],{"categoryNo":212,"categoryName":213,"taxonomyType":11,"taxonomyTypeDesc":12},{"categoryNo":57,"categoryName":60,"taxonomyType":58,"taxonomyTypeDesc":59},[579,145,269,580,217,581,218,582,358,583,274,224,584,480,585,586,587,588,589,590],"detecting serverless function injection","google cloud","static analysis","assessment","api gateway","iam","lambda","serverless-security","Lambda-injection","event-source-poisoning","OWASP-serverless","IAM-escalation",112,18]