[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skills:pro6":3,"skills:sce6":50,"skills:creators9":95,"skills:stats":193,"skills:all:stars:116:":196},[4,15,22,29,36,43],{"categoryNo":5,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":8,"categoryNameEn":9,"description":10,"level":11,"skillCount":12,"parentNo":13,"parentName":13,"children":14},"01JBSEEDCAT000000000000030","PROFESSION","适用职业","开发工程师","Software Engineer","从事软件编码、测试与运维的工程师",1,13273,null,[],{"categoryNo":16,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":17,"categoryNameEn":18,"description":19,"level":11,"skillCount":20,"parentNo":13,"parentName":13,"children":21},"01JBSEEDCAT000000000000032","设计师","Designer","视觉、交互与品牌设计人员",7774,[],{"categoryNo":23,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":24,"categoryNameEn":25,"description":26,"level":11,"skillCount":27,"parentNo":13,"parentName":13,"children":28},"01JBSEEDCAT000000000000033","数据分析师","Data Analyst","数据分析、报表与商业智能人员",4988,[],{"categoryNo":30,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":31,"categoryNameEn":32,"description":33,"level":11,"skillCount":34,"parentNo":13,"parentName":13,"children":35},"01JBSEEDCAT000000000000036","内容创作者","Content Creator","作者、编辑与自媒体创作者",3940,[],{"categoryNo":37,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":38,"categoryNameEn":39,"description":40,"level":11,"skillCount":41,"parentNo":13,"parentName":13,"children":42},"01JBSEEDCAT000000000000035","市场营销","Marketer","市场推广、增长与品牌运营人员",3446,[],{"categoryNo":44,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":45,"categoryNameEn":46,"description":47,"level":11,"skillCount":48,"parentNo":13,"parentName":13,"children":49},"01JBSEEDCAT000000000000037","律师与法务","Legal","合同、合规与法律事务人员",3316,[],[51,60,67,74,81,88],{"categoryNo":52,"taxonomyType":53,"taxonomyTypeDesc":54,"categoryName":55,"categoryNameEn":56,"description":57,"level":11,"skillCount":58,"parentNo":13,"parentName":13,"children":59},"01JBSEEDCAT000000000000022","SCENARIO","使用场景","智能体与自动化","Agents & Automation","Skill、MCP、智能体与工作流自动化",39455,[],{"categoryNo":61,"taxonomyType":53,"taxonomyTypeDesc":54,"categoryName":62,"categoryNameEn":63,"description":64,"level":11,"skillCount":65,"parentNo":13,"parentName":13,"children":66},"01JBSEEDCAT000000000000006","软件开发","Software Development","编码、测试、部署等软件研发任务",26531,[],{"categoryNo":68,"taxonomyType":53,"taxonomyTypeDesc":54,"categoryName":69,"categoryNameEn":70,"description":71,"level":11,"skillCount":72,"parentNo":13,"parentName":13,"children":73},"01JBSEEDCAT000000000000014","设计创意","Design & Creative","视觉设计、品牌与多媒体创作",13568,[],{"categoryNo":75,"taxonomyType":53,"taxonomyTypeDesc":54,"categoryName":76,"categoryNameEn":77,"description":78,"level":11,"skillCount":79,"parentNo":13,"parentName":13,"children":80},"01JBSEEDCAT000000000000001","办公效率","Office Productivity","日常办公文档、表格、演示与沟通类任务",6289,[],{"categoryNo":82,"taxonomyType":53,"taxonomyTypeDesc":54,"categoryName":83,"categoryNameEn":84,"description":85,"level":11,"skillCount":86,"parentNo":13,"parentName":13,"children":87},"01JBSEEDCAT000000000000017","内容创作","Content Creation","写作、文案与营销内容生产",6029,[],{"categoryNo":89,"taxonomyType":53,"taxonomyTypeDesc":54,"categoryName":90,"categoryNameEn":91,"description":92,"level":11,"skillCount":93,"parentNo":13,"parentName":13,"children":94},"01JBSEEDCAT000000000000020","研究与学习","Research & Learning","资料检索、知识整理与学习辅导",5531,[],{"records":96,"total":191,"current":11,"size":192},[97,111,120,130,140,150,160,169,179],{"accountNo":98,"login":99,"displayName":100,"avatarUrl":101,"accountType":102,"accountTypeDesc":103,"profileDescription":104,"skillCount":105,"repoCount":106,"professionCount":107,"scenarioCount":108,"totalStars":109,"updatedAt":110},"01M698VYDXZ6JW5WH3CRV650R8","microsoft","Microsoft","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F6154722?v=4","ORGANIZATION","组织","Open source projects and samples from Microsoft",4160,229,11,7,829284,"2026-11-14 03:09:22",{"accountNo":112,"login":113,"displayName":113,"avatarUrl":114,"accountType":102,"accountTypeDesc":103,"profileDescription":115,"skillCount":116,"repoCount":117,"professionCount":108,"scenarioCount":108,"totalStars":118,"updatedAt":119},"01M698P3FSAZ6B4R928ZF19KPT","openclaw","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F252820863?v=4","Your personal, open source AI assistant.",362,32,437710,"2026-11-14 03:02:00",{"accountNo":121,"login":122,"displayName":123,"avatarUrl":124,"accountType":102,"accountTypeDesc":103,"profileDescription":13,"skillCount":125,"repoCount":126,"professionCount":108,"scenarioCount":127,"totalStars":128,"updatedAt":129},"01M6AC29YGCR4S2NTJFV0G8B81","openai","OpenAI","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F14957082?v=4",171,23,6,342695,"2026-11-13 04:03:41",{"accountNo":131,"login":132,"displayName":133,"avatarUrl":134,"accountType":102,"accountTypeDesc":103,"profileDescription":13,"skillCount":135,"repoCount":136,"professionCount":137,"scenarioCount":108,"totalStars":138,"updatedAt":139},"01M6AC83E6K4FDKK7HZ8WNMQKE","apache","The Apache Software Foundation","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F47359?v=4",420,75,8,298176,"2026-11-13 03:14:28",{"accountNo":141,"login":142,"displayName":143,"avatarUrl":144,"accountType":102,"accountTypeDesc":103,"profileDescription":145,"skillCount":146,"repoCount":147,"professionCount":107,"scenarioCount":108,"totalStars":148,"updatedAt":149},"01M698VYEFDM0VJBZDYYJ2T83S","google","Google","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1342004?v=4","Google ❤️ Open Source",528,48,242984,"2026-11-14 03:03:50",{"accountNo":151,"login":152,"displayName":153,"avatarUrl":154,"accountType":102,"accountTypeDesc":103,"profileDescription":155,"skillCount":156,"repoCount":157,"professionCount":107,"scenarioCount":108,"totalStars":158,"updatedAt":159},"01M6AC83DS133TPXFSP1DHNCC6","github","GitHub","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F9919?v=4","How people build software.",940,28,238441,"2026-11-13 03:57:35",{"accountNo":161,"login":162,"displayName":163,"avatarUrl":164,"accountType":102,"accountTypeDesc":103,"profileDescription":13,"skillCount":165,"repoCount":166,"professionCount":107,"scenarioCount":108,"totalStars":167,"updatedAt":168},"01M697XGDPXJAVQ8391V2BCYTE","anthropics","Anthropic","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F76263028?v=4",674,17,231826,"2026-11-13 04:18:26",{"accountNo":170,"login":171,"displayName":172,"avatarUrl":173,"accountType":102,"accountTypeDesc":103,"profileDescription":13,"skillCount":174,"repoCount":175,"professionCount":176,"scenarioCount":108,"totalStars":177,"updatedAt":178},"01M6AC83EPDGBFN19MWYRREJD0","Significant-Gravitas","AutoGPT","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F130738209?v=4",86,2,10,188014,"2026-11-13 02:38:59",{"accountNo":180,"login":181,"displayName":182,"avatarUrl":183,"accountType":184,"accountTypeDesc":185,"profileDescription":186,"skillCount":187,"repoCount":188,"professionCount":127,"scenarioCount":108,"totalStars":189,"updatedAt":190},"01M6DJCCDDG53MTYYRTXAXFG17","garrytan","Garry Tan","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F19957?v=4","USER","个人作者","Writes software, dreams. ",324,3,174614,"2026-11-13 04:05:07",1926,9,{"skillCount":194,"professionCount":107,"scenarioCount":108,"creatorCount":195},196837,1925,{"records":197,"total":194,"current":577,"size":578},[198,240,256,274,294,319,342,361,392,409,435,460,478,498,516,529,543,557],{"skillNo":199,"name":200,"nameZh":13,"description":201,"descriptionZh":13,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":13,"sourceHtmlUrl":210,"categories":211,"keywords":218,"publishedAt":239},"01M6AEBCHXPSG3SGCMWF4BT1XQ","detecting-container-runtime-threats-with-falco","Deploys and operates Falco with the modern eBPF driver in Kubernetes and Docker, covering driver selection, Helm installation, output channels, and the built-in ruleset that detects container escape, namespace abuse, privileged mounts, and anomalous syscalls. Use when standing Falco up on a cluster, choosing between the eBPF and kernel-module drivers, routing Falco alerts into a SIEM or Falcosidekick, or upgrading an existing deployment. Keywords: Falco, modern_ebpf, kernel module, Helm, Falcosidekick, runtime security, syscall. Do not use for authoring individual escape rules - use detecting-container-escape-with-falco-rules.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-container-runtime-threats-with-falco\u002FSKILL.md",[212,215],{"categoryNo":213,"categoryName":214,"taxonomyType":53,"taxonomyTypeDesc":54},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":216,"categoryName":217,"taxonomyType":53,"taxonomyTypeDesc":54},"01JBSEEDCAT000000000000023","Skill与智能体开发",[219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238],"falco","detecting container runtime threats with falco","docker","kernel","kubernetes","security","cybersecurity","siem","deployment","routing","ebpf","monitoring","engineering","threat-detection","container-security","detection-engineering","detection","runtime-security","container-escape","syscall-monitoring","2026-11-10 10:12:30",{"skillNo":241,"name":242,"nameZh":13,"description":243,"descriptionZh":13,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":13,"sourceHtmlUrl":244,"categories":245,"keywords":247,"publishedAt":239},"01M6AEB8S2HGS4BM0H1KBM3ESF","detecting-container-escape-with-falco-rules","Writes and tunes Falco rule syntax for container escape detection - conditions, macros, lists, priorities, and output fields - covering host filesystem mounts, sensitive host path access, kernel module loading, and privileged capability abuse, including how to drive down false positives. Use when authoring or tuning a specific Falco rule for breakout behaviour, or triaging a noisy escape-related Falco alert. Keywords: Falco rule, macro, list, condition, priority, falco_rules.local.yaml, tuning, false positive. Do not use for deploying and operating Falco itself - use detecting-container-runtime-threats-with-falco; for tool-agnostic escape signals use detecting-container-escape-attempts.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-container-escape-with-falco-rules\u002FSKILL.md",[246],{"categoryNo":213,"categoryName":214,"taxonomyType":53,"taxonomyTypeDesc":54},[219,248,222,223,224,225,249,250,251,252,253,254,230,233,255,235,236,237,238],"detecting container escape with falco rules","pr","validation","protocol","metadata","file","yaml","macro",{"skillNo":257,"name":258,"nameZh":13,"description":259,"descriptionZh":13,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":13,"sourceHtmlUrl":260,"categories":261,"keywords":264,"publishedAt":239},"01M6AEB500ZH47G5010HZ1054W","detecting-container-escape-attempts","Detects container escape at runtime across tooling - namespace manipulation, capability abuse, kernel exploits, sensitive host mounts, and anomalous syscalls - and explains which signals matter regardless of whether Falco, Sysdig, auditd, or an EDR is doing the collection. Use when deciding what breakout behaviour to monitor, investigating a suspected Docker or Kubernetes breakout, or comparing escape coverage across runtime sensors. Keywords: container escape, breakout, namespaces, CAP_SYS_ADMIN, privileged, hostPath, kernel exploit, syscall. Do not use for Falco rule syntax itself - use detecting-container-escape-with-falco-rules; for a static configuration sweep use performing-container-escape-detection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-container-escape-attempts\u002FSKILL.md",[262,263],{"categoryNo":213,"categoryName":214,"taxonomyType":53,"taxonomyTypeDesc":54},{"categoryNo":216,"categoryName":217,"taxonomyType":53,"taxonomyTypeDesc":54},[265,266,221,222,223,225,249,267,268,250,269,270,230,233,271,235,272,236,219,273],"detecting container escape attempts","containers","monitor","code","verification","admin","auditd","edr","escape-detection",{"skillNo":275,"name":276,"nameZh":13,"description":277,"descriptionZh":13,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":13,"sourceHtmlUrl":278,"categories":279,"keywords":284,"publishedAt":239},"01M6AEB0XZK975F5JVHWS86PK4","detecting-container-drift-at-runtime","Detects unauthorized runtime drift in containers by monitoring binary execution, filesystem changes, and configuration deviation from the original immutable image, using Falco and Microsoft Defender for Containers. Use when validating immutable-infrastructure controls, hunting for unexpected package installs or binaries written inside a running container, or determining whether a container diverged from the image it was built from. Keywords: drift, immutable infrastructure, new binary executed, package install, image mismatch, Falco. Do not use for detecting breakout from the container to the host - use detecting-container-escape-attempts.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-container-drift-at-runtime\u002FSKILL.md",[280,281],{"categoryNo":213,"categoryName":214,"taxonomyType":53,"taxonomyTypeDesc":54},{"categoryNo":282,"categoryName":283,"taxonomyType":53,"taxonomyTypeDesc":54},"01JBSEEDCAT000000000000016","图像与多媒体",[285,286,266,223,224,225,99,287,249,288,289,230,233,290,235,291,236,292,219,293],"detecting container drift at runtime","image","defender","infrastructure","package","Microsoft-Defender","container-drift","immutable-containers","drift-detection",{"skillNo":295,"name":296,"nameZh":13,"description":297,"descriptionZh":13,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":13,"sourceHtmlUrl":298,"categories":299,"keywords":305,"publishedAt":239},"01M6AEAXTZVTVJNWERRMJ9B8YD","detecting-compromised-cloud-credentials","Detect compromised cloud credentials across AWS, Azure, and GCP by analyzing anomalous API activity, impossible-travel patterns, and credential-stuffing indicators using GuardDuty, Microsoft Defender for Identity, and Google SCC Event Threat Detection. Use when investigating alerts about cloud API activity from unfamiliar locations, responding to an exposed-credential notification, or scoping a credential compromise.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-compromised-cloud-credentials\u002FSKILL.md",[300,303,304],{"categoryNo":301,"categoryName":302,"taxonomyType":53,"taxonomyTypeDesc":54},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":216,"categoryName":217,"taxonomyType":53,"taxonomyTypeDesc":54},{"categoryNo":5,"categoryName":8,"taxonomyType":6,"taxonomyTypeDesc":7},[306,307,142,225,99,287,308,249,309,310,232,311,312,313,235,314,315,316,317,318],"cloud","detecting compromised cloud credentials","azure","development","cloud-security","analyzing","gcp","credential-compromise","defense","anomaly-detection","impossible-travel","credential-stuffing","guardduty",{"skillNo":320,"name":321,"nameZh":13,"description":322,"descriptionZh":13,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":13,"sourceHtmlUrl":323,"categories":324,"keywords":326,"publishedAt":239},"01M6AEATJJKMMC90RTSD0RBG26","detecting-command-and-control-over-dns","Detect command-and-control (C2) traffic tunneled over DNS from tools like Iodine, dnscat2, dns2tcp, and Cobalt Strike DNS beacon, using Shannon entropy analysis of query subdomains, ML-based DGA classification, passive DNS correlation, and Zeek\u002FSuricata signatures. Use when investigating suspected DNS tunneling, classifying DGA domains, detecting DNS beaconing, or building DNS anomaly rules for a SOC\u002FSIEM.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-command-and-control-over-dns\u002FSKILL.md",[325],{"categoryNo":216,"categoryName":217,"taxonomyType":53,"taxonomyTypeDesc":54},[327,328,224,225,226,329,249,330,331,332,333,334,335,232,336,337,338,339,340,341],"dns","detecting command and control over dns","ml","forensics","beacon","c2","command-and-control","soc","dga","network-forensics","network","Zeek","network-security","correlation","suricata",{"skillNo":343,"name":344,"nameZh":13,"description":345,"descriptionZh":13,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":13,"sourceHtmlUrl":346,"categories":347,"keywords":349,"publishedAt":239},"01M6AEAPY7A1YRM3T098QGTP20","detecting-cloud-threats-with-guardduty","Deploy and operationalize Amazon GuardDuty, covering protection plans for S3, EKS, EC2 runtime monitoring, and Lambda, interpreting finding severity, and building automated response with EventBridge and Lambda. Use when establishing threat detection for AWS accounts, investigating findings on compromised instances or credential abuse, or building automated incident-response playbooks.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-cloud-threats-with-guardduty\u002FSKILL.md",[348],{"categoryNo":216,"categoryName":217,"taxonomyType":53,"taxonomyTypeDesc":54},[306,318,350,225,249,230,351,310,334,232,352,353,354,235,355,356,357,358,359,360],"detecting cloud threats with guardduty","s3","aws","eks","severity","eventbridge","lambda","amazon-guardduty","aws-security","runtime-monitoring","cloud-soc",{"skillNo":362,"name":363,"nameZh":13,"description":364,"descriptionZh":13,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":13,"sourceHtmlUrl":365,"categories":366,"keywords":375,"publishedAt":239},"01M6AEAKFH3HQXTCCS3P5EMDCM","detecting-business-email-compromise","Detect Business Email Compromise (BEC) fraud, where attackers impersonate executives or vendors to trick employees into wire transfers or data disclosure without malicious links, using email gateway rules, behavioral analytics, and financial process controls. Use when investigating a suspected executive\u002Fvendor impersonation email or building detection rules for social-engineering fund-transfer fraud.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-business-email-compromise\u002FSKILL.md",[367,370,373,374],{"categoryNo":368,"categoryName":369,"taxonomyType":53,"taxonomyTypeDesc":54},"01JBSEEDCAT000000000000005","邮件与沟通",{"categoryNo":371,"categoryName":372,"taxonomyType":53,"taxonomyTypeDesc":54},"01JBSEEDCAT000000000000013","分析与可视化",{"categoryNo":216,"categoryName":217,"taxonomyType":53,"taxonomyTypeDesc":54},{"categoryNo":23,"categoryName":24,"taxonomyType":6,"taxonomyTypeDesc":7},[376,377,378,224,225,379,380,381,249,382,383,384,385,386,387,388,389,390,314,391],"email","detecting business email compromise","malicious","change","analytics","official","delete","gateway","phishing","dmarc","email-security","social-engineering","awareness","data","BEC","impersonation",{"skillNo":393,"name":394,"nameZh":13,"description":395,"descriptionZh":13,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":13,"sourceHtmlUrl":396,"categories":397,"keywords":401,"publishedAt":239},"01M6AEAFXGGVXA2VQKZHMV9R7S","detecting-business-email-compromise-with-ai","Deploy AI and NLP-powered detection systems to identify business email compromise attacks by analyzing writing style, behavioral patterns, and contextual anomalies that evade traditional rule-based filters.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-business-email-compromise-with-ai\u002FSKILL.md",[398,399,400],{"categoryNo":368,"categoryName":369,"taxonomyType":53,"taxonomyTypeDesc":54},{"categoryNo":213,"categoryName":214,"taxonomyType":53,"taxonomyTypeDesc":54},{"categoryNo":216,"categoryName":217,"taxonomyType":53,"taxonomyTypeDesc":54},[376,402,403,404,225,379,405,381,249,382,384,386,311,390,235,314,406,407,391,408],"detecting business email compromise with ai","writing","nlp","deploy","machine-learning","behavioral-analytics","fraud-detection",{"skillNo":410,"name":411,"nameZh":13,"description":412,"descriptionZh":13,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":13,"sourceHtmlUrl":413,"categories":414,"keywords":421,"publishedAt":239},"01M6AEAC5N212QBXJA89ABEYVV","detecting-broken-object-property-level-authorization","Detect and test for OWASP API3:2023 Broken Object Property Level Authorization (BOPLA), covering excessive data exposure in API responses and mass assignment via injected request-body properties. Use when reviewing API responses\u002Frequests for over-exposed or over-writable object fields, or building detection rules and test cases for property-level authorization gaps that object-level checks miss.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-broken-object-property-level-authorization\u002FSKILL.md",[415,418,419,420],{"categoryNo":416,"categoryName":417,"taxonomyType":53,"taxonomyTypeDesc":54},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":301,"categoryName":302,"taxonomyType":53,"taxonomyTypeDesc":54},{"categoryNo":5,"categoryName":8,"taxonomyType":6,"taxonomyTypeDesc":7},{"categoryNo":23,"categoryName":24,"taxonomyType":6,"taxonomyTypeDesc":7},[422,423,424,224,225,425,249,426,427,389,428,235,429,430,431,432,433,434],"authorization","detecting broken object property level authorization","testing","test","api-security","penetration-testing","owasp","bopla","owasp-api3","mass-assignment","excessive-data-exposure","property-level-authorization","api-testing",{"skillNo":436,"name":437,"nameZh":13,"description":438,"descriptionZh":13,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":13,"sourceHtmlUrl":439,"categories":440,"keywords":443,"publishedAt":239},"01M6AEA86F7M5XTEDPTMNAT6R6","detecting-bluetooth-low-energy-attacks","Detects and analyzes Bluetooth Low Energy (BLE) security attacks including sniffing, replay attacks, GATT enumeration abuse, and Man-in-the-Middle interception. Uses Ubertooth One and nRF52840 sniffers for packet capture, the bleak Python library for GATT service enumeration, and crackle for BLE encryption cracking. Use when assessing IoT device BLE security, monitoring for BLE-based attacks on wireless infrastructure, or performing authorized BLE penetration testing. Activates for requests involving BLE security assessment, Ubertooth sniffing, GATT enumeration, or BLE replay detection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-bluetooth-low-energy-attacks\u002FSKILL.md",[441,442],{"categoryNo":416,"categoryName":417,"taxonomyType":53,"taxonomyTypeDesc":54},{"categoryNo":216,"categoryName":217,"taxonomyType":53,"taxonomyTypeDesc":54},[444,424,445,225,249,446,447,230,448,449,450,451,452,453,454,455,456,457,458,459],"detecting bluetooth low energy attacks","python","assessment","iot","penetration testing","encryption","enumeration","man-in-the-middle","ble","bluetooth","ubertooth","nrf-sniffer","gatt","wireless-security","iot-security","replay-attack",{"skillNo":461,"name":462,"nameZh":13,"description":463,"descriptionZh":13,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":13,"sourceHtmlUrl":464,"categories":465,"keywords":466,"publishedAt":239},"01M6AEA4PNZW55PYT968BWKP0N","detecting-beaconing-patterns-with-zeek","Performs statistical analysis of Zeek conn.log connection intervals to detect C2 beaconing patterns. Uses the ZAT library to load Zeek logs into Pandas DataFrames, calculates inter-arrival time standard deviation, and flags periodic connections with low jitter. Use when hunting for command-and-control callbacks in network data.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-beaconing-patterns-with-zeek\u002FSKILL.md",[],[338,467,224,225,468,469,470,471,472,332,333,473,337,389,339,474,475,476,477],"detecting beaconing patterns with zeek","pandas","library","logs","security-operations","threat-hunting","log-analysis","c2-beaconing","conn-log-analysis","zat","statistical-analysis",{"skillNo":479,"name":480,"nameZh":13,"description":481,"descriptionZh":13,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":13,"sourceHtmlUrl":482,"categories":483,"keywords":484,"publishedAt":239},"01M6AEA16XVA2904DXEYFZ4D5H","detecting-azure-storage-account-misconfigurations","Audit Azure Blob and ADLS storage accounts for public access exposure, weak or long-lived SAS tokens, missing encryption at rest, disabled HTTPS-only traffic, and outdated TLS versions, using the azure-mgmt-storage Python SDK to generate a risk-scored report. Use when assessing an Azure subscription's storage accounts for misconfiguration, building cloud security posture checks, or investigating a suspected data exposure via public blob access.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-azure-storage-account-misconfigurations\u002FSKILL.md",[],[485,486,308,487,445,488,225,249,489,490,491,492,493,310,389,449,494,495,496,497],"storage","azure storage","detecting azure storage account misconfigurations","sdk","generate","report","https","audit","cloud security","REST","tls","cloud-misconfiguration","azure-mgmt-storage",{"skillNo":499,"name":500,"nameZh":13,"description":501,"descriptionZh":13,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":13,"sourceHtmlUrl":502,"categories":503,"keywords":504,"publishedAt":239},"01M6AE9XNNCK5C5XT6JRDD0M7Q","detecting-azure-service-principal-abuse","Detect Azure service principal abuse in Microsoft Entra ID using KQL detection queries (Sentinel\u002FSplunk) against Azure AD Audit and Sign-in Logs, covering added credentials, privileged role assignment, admin consent bypass, and service principal enumeration. Use when investigating suspected privilege escalation or persistence via service principals, or building threat-hunting queries for Entra ID identity abuse.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-azure-service-principal-abuse\u002FSKILL.md",[],[308,505,224,225,506,507,249,508,492,470,509,310,472,510,337,511,512,513,514,515],"detecting azure service principal abuse","identity","entra id","kql","privilege-escalation","splunk","entra-id","sentinel","escalation","service-principal","credential-abuse",{"skillNo":517,"name":518,"nameZh":13,"description":519,"descriptionZh":13,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":13,"sourceHtmlUrl":520,"categories":521,"keywords":524,"publishedAt":239},"01M6AE9TAW9FRR9FY8NNRC783H","detecting-azure-lateral-movement","Detect lateral movement in Azure AD\u002FEntra ID environments using Microsoft Graph API audit logs, Azure Sentinel KQL hunting queries, and sign-in anomaly correlation to identify privilege escalation, token theft, and cross-tenant pivoting.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-azure-lateral-movement\u002FSKILL.md",[522,523],{"categoryNo":301,"categoryName":302,"taxonomyType":53,"taxonomyTypeDesc":54},{"categoryNo":5,"categoryName":8,"taxonomyType":6,"taxonomyTypeDesc":7},[308,525,224,225,99,507,249,508,492,470,306,310,472,511,526,512,513,340,527,528],"detecting azure lateral movement","pivoting","lateral-movement","graph-api",{"skillNo":530,"name":531,"nameZh":13,"description":532,"descriptionZh":13,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":13,"sourceHtmlUrl":533,"categories":534,"keywords":535,"publishedAt":239},"01M6AE9QJVX4MWF619T1EGWSKC","detecting-aws-iam-privilege-escalation","Detect AWS IAM privilege escalation paths using boto3 and Cloudsplaining policy analysis to identify overly permissive policies, dangerous permission combinations, and least-privilege violations","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-aws-iam-privilege-escalation\u002FSKILL.md",[],[352,536,513,537,224,538,225,249,306,509,310,539,540,541,542],"iam","detecting aws iam privilege escalation","policy","least-privilege","boto3","cloudsplaining","policy-analysis",{"skillNo":544,"name":545,"nameZh":13,"description":546,"descriptionZh":13,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":13,"sourceHtmlUrl":547,"categories":548,"keywords":550,"publishedAt":239},"01M6AE9M84ZP9P52V4V95A48AV","detecting-aws-guardduty-findings-automation","Build automated AWS GuardDuty finding response pipelines using EventBridge and Lambda to trigger real-time incident response, automatically quarantine compromised resources, and route security notifications. Use when designing automated remediation playbooks for GuardDuty findings across VPC Flow Logs, CloudTrail, DNS, EKS, or S3 data events, or when reducing mean time to respond to cloud threats.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-aws-guardduty-findings-automation\u002FSKILL.md",[549],{"categoryNo":216,"categoryName":217,"taxonomyType":53,"taxonomyTypeDesc":54},[551,352,552,224,225,553,226,249,470,554,310,327,232,555,389,353,556,318,355,356],"automation","detecting aws guardduty findings automation","incident response","notifications","flow","remediation",{"skillNo":558,"name":559,"nameZh":13,"description":560,"descriptionZh":13,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":13,"sourceHtmlUrl":561,"categories":562,"keywords":566,"publishedAt":239},"01M6AE9GJY0K1V3AM4AFGYDVXP","detecting-aws-credential-exposure-with-trufflehog","Scan source code repositories, CI\u002FCD pipelines, and configuration files for exposed AWS credentials using TruffleHog, git-secrets, and AWS-native detection. Use when integrating secrets scanning into CI\u002FCD, auditing repositories (including git history) for historically committed AWS keys, responding to a GuardDuty alert about credential use from an unexpected location, or verifying credential rotation removed all exposed keys.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-aws-credential-exposure-with-trufflehog\u002FSKILL.md",[563,564,565],{"categoryNo":213,"categoryName":214,"taxonomyType":53,"taxonomyTypeDesc":54},{"categoryNo":216,"categoryName":217,"taxonomyType":53,"taxonomyTypeDesc":54},{"categoryNo":5,"categoryName":8,"taxonomyType":6,"taxonomyTypeDesc":7},[352,567,568,224,225,249,268,569,570,571,306,572,310,573,235,574,575,576],"detecting aws credential exposure with trufflehog","devsecops","authentication","git","search","ci","reconnaissance","credential-exposure","trufflehog","secrets-detection",116,18]