[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skills:stats":3,"skills:pro6":8,"skills:sce6":55,"skills:creators9":100,"skills:all:stars:121:":196},{"skillCount":4,"professionCount":5,"scenarioCount":6,"creatorCount":7},196836,11,7,1925,[9,20,27,34,41,48],{"categoryNo":10,"taxonomyType":11,"taxonomyTypeDesc":12,"categoryName":13,"categoryNameEn":14,"description":15,"level":16,"skillCount":17,"parentNo":18,"parentName":18,"children":19},"01JBSEEDCAT000000000000030","PROFESSION","适用职业","开发工程师","Software Engineer","从事软件编码、测试与运维的工程师",1,13273,null,[],{"categoryNo":21,"taxonomyType":11,"taxonomyTypeDesc":12,"categoryName":22,"categoryNameEn":23,"description":24,"level":16,"skillCount":25,"parentNo":18,"parentName":18,"children":26},"01JBSEEDCAT000000000000032","设计师","Designer","视觉、交互与品牌设计人员",7774,[],{"categoryNo":28,"taxonomyType":11,"taxonomyTypeDesc":12,"categoryName":29,"categoryNameEn":30,"description":31,"level":16,"skillCount":32,"parentNo":18,"parentName":18,"children":33},"01JBSEEDCAT000000000000033","数据分析师","Data Analyst","数据分析、报表与商业智能人员",4988,[],{"categoryNo":35,"taxonomyType":11,"taxonomyTypeDesc":12,"categoryName":36,"categoryNameEn":37,"description":38,"level":16,"skillCount":39,"parentNo":18,"parentName":18,"children":40},"01JBSEEDCAT000000000000036","内容创作者","Content Creator","作者、编辑与自媒体创作者",3940,[],{"categoryNo":42,"taxonomyType":11,"taxonomyTypeDesc":12,"categoryName":43,"categoryNameEn":44,"description":45,"level":16,"skillCount":46,"parentNo":18,"parentName":18,"children":47},"01JBSEEDCAT000000000000035","市场营销","Marketer","市场推广、增长与品牌运营人员",3446,[],{"categoryNo":49,"taxonomyType":11,"taxonomyTypeDesc":12,"categoryName":50,"categoryNameEn":51,"description":52,"level":16,"skillCount":53,"parentNo":18,"parentName":18,"children":54},"01JBSEEDCAT000000000000037","律师与法务","Legal","合同、合规与法律事务人员",3316,[],[56,65,72,79,86,93],{"categoryNo":57,"taxonomyType":58,"taxonomyTypeDesc":59,"categoryName":60,"categoryNameEn":61,"description":62,"level":16,"skillCount":63,"parentNo":18,"parentName":18,"children":64},"01JBSEEDCAT000000000000022","SCENARIO","使用场景","智能体与自动化","Agents & Automation","Skill、MCP、智能体与工作流自动化",39452,[],{"categoryNo":66,"taxonomyType":58,"taxonomyTypeDesc":59,"categoryName":67,"categoryNameEn":68,"description":69,"level":16,"skillCount":70,"parentNo":18,"parentName":18,"children":71},"01JBSEEDCAT000000000000006","软件开发","Software Development","编码、测试、部署等软件研发任务",26531,[],{"categoryNo":73,"taxonomyType":58,"taxonomyTypeDesc":59,"categoryName":74,"categoryNameEn":75,"description":76,"level":16,"skillCount":77,"parentNo":18,"parentName":18,"children":78},"01JBSEEDCAT000000000000014","设计创意","Design & Creative","视觉设计、品牌与多媒体创作",13568,[],{"categoryNo":80,"taxonomyType":58,"taxonomyTypeDesc":59,"categoryName":81,"categoryNameEn":82,"description":83,"level":16,"skillCount":84,"parentNo":18,"parentName":18,"children":85},"01JBSEEDCAT000000000000001","办公效率","Office Productivity","日常办公文档、表格、演示与沟通类任务",6286,[],{"categoryNo":87,"taxonomyType":58,"taxonomyTypeDesc":59,"categoryName":88,"categoryNameEn":89,"description":90,"level":16,"skillCount":91,"parentNo":18,"parentName":18,"children":92},"01JBSEEDCAT000000000000017","内容创作","Content Creation","写作、文案与营销内容生产",6029,[],{"categoryNo":94,"taxonomyType":58,"taxonomyTypeDesc":59,"categoryName":95,"categoryNameEn":96,"description":97,"level":16,"skillCount":98,"parentNo":18,"parentName":18,"children":99},"01JBSEEDCAT000000000000020","研究与学习","Research & Learning","资料检索、知识整理与学习辅导",5531,[],{"records":101,"total":194,"current":16,"size":195},[102,114,123,133,143,153,163,172,182],{"accountNo":103,"login":104,"displayName":105,"avatarUrl":106,"accountType":107,"accountTypeDesc":108,"profileDescription":109,"skillCount":110,"repoCount":111,"professionCount":5,"scenarioCount":6,"totalStars":112,"updatedAt":113},"01M698VYDXZ6JW5WH3CRV650R8","microsoft","Microsoft","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F6154722?v=4","ORGANIZATION","组织","Open source projects and samples from Microsoft",4160,229,829289,"2026-11-14 03:09:22",{"accountNo":115,"login":116,"displayName":116,"avatarUrl":117,"accountType":107,"accountTypeDesc":108,"profileDescription":118,"skillCount":119,"repoCount":120,"professionCount":6,"scenarioCount":6,"totalStars":121,"updatedAt":122},"01M698P3FSAZ6B4R928ZF19KPT","openclaw","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F252820863?v=4","Your personal, open source AI assistant.",362,32,437710,"2026-11-14 03:02:00",{"accountNo":124,"login":125,"displayName":126,"avatarUrl":127,"accountType":107,"accountTypeDesc":108,"profileDescription":18,"skillCount":128,"repoCount":129,"professionCount":6,"scenarioCount":130,"totalStars":131,"updatedAt":132},"01M6AC29YGCR4S2NTJFV0G8B81","openai","OpenAI","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F14957082?v=4",171,23,6,343687,"2026-11-14 03:12:46",{"accountNo":134,"login":135,"displayName":136,"avatarUrl":137,"accountType":107,"accountTypeDesc":108,"profileDescription":18,"skillCount":138,"repoCount":139,"professionCount":140,"scenarioCount":6,"totalStars":141,"updatedAt":142},"01M6AC83E6K4FDKK7HZ8WNMQKE","apache","The Apache Software Foundation","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F47359?v=4",419,75,8,298187,"2026-11-14 03:13:01",{"accountNo":144,"login":145,"displayName":146,"avatarUrl":147,"accountType":107,"accountTypeDesc":108,"profileDescription":148,"skillCount":149,"repoCount":150,"professionCount":5,"scenarioCount":6,"totalStars":151,"updatedAt":152},"01M698VYEFDM0VJBZDYYJ2T83S","google","Google","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1342004?v=4","Google ❤️ Open Source",528,48,242984,"2026-11-14 03:03:50",{"accountNo":154,"login":155,"displayName":156,"avatarUrl":157,"accountType":107,"accountTypeDesc":108,"profileDescription":158,"skillCount":159,"repoCount":160,"professionCount":5,"scenarioCount":6,"totalStars":161,"updatedAt":162},"01M6AC83DS133TPXFSP1DHNCC6","github","GitHub","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F9919?v=4","How people build software.",940,28,238680,"2026-11-14 03:13:39",{"accountNo":164,"login":165,"displayName":166,"avatarUrl":167,"accountType":107,"accountTypeDesc":108,"profileDescription":18,"skillCount":168,"repoCount":169,"professionCount":5,"scenarioCount":6,"totalStars":170,"updatedAt":171},"01M697XGDPXJAVQ8391V2BCYTE","anthropics","Anthropic","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F76263028?v=4",674,17,231826,"2026-11-13 04:18:26",{"accountNo":173,"login":174,"displayName":175,"avatarUrl":176,"accountType":107,"accountTypeDesc":108,"profileDescription":18,"skillCount":177,"repoCount":178,"professionCount":179,"scenarioCount":6,"totalStars":180,"updatedAt":181},"01M6AC83EPDGBFN19MWYRREJD0","Significant-Gravitas","AutoGPT","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F130738209?v=4",86,2,10,188019,"2026-11-14 03:13:09",{"accountNo":183,"login":184,"displayName":185,"avatarUrl":186,"accountType":187,"accountTypeDesc":188,"profileDescription":189,"skillCount":190,"repoCount":191,"professionCount":130,"scenarioCount":6,"totalStars":192,"updatedAt":193},"01M6DJCCDDG53MTYYRTXAXFG17","garrytan","Garry Tan","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F19957?v=4","USER","个人作者","Writes software, dreams. ",324,3,174614,"2026-11-13 04:05:07",1926,9,{"records":197,"total":4,"current":563,"size":564},[198,235,260,286,317,336,359,371,387,407,423,442,466,484,501,512,529,553],{"skillNo":199,"name":200,"nameZh":18,"description":201,"descriptionZh":18,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":18,"sourceHtmlUrl":210,"categories":211,"keywords":219,"publishedAt":234},"01M6AE1D14FVBSWB3WZCYMRKP7","bypassing-authentication-with-forced-browsing","Discovering and accessing unprotected pages, APIs, and administrative interfaces by enumerating URLs and bypassing authentication controls during authorized security assessments.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbypassing-authentication-with-forced-browsing\u002FSKILL.md",[212,215,218],{"categoryNo":213,"categoryName":214,"taxonomyType":58,"taxonomyTypeDesc":59},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":216,"categoryName":217,"taxonomyType":58,"taxonomyTypeDesc":59},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":10,"categoryName":13,"taxonomyType":11,"taxonomyTypeDesc":12},[220,221,222,223,224,225,226,227,228,229,230,231,232,233],"authentication","bypassing authentication with forced browsing","testing","directory","security","cybersecurity","web","pr","penetration-testing","authentication-bypass","forced-browsing","ffuf","directory-enumeration","owasp","2026-11-10 10:12:30",{"skillNo":236,"name":237,"nameZh":18,"description":238,"descriptionZh":18,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":18,"sourceHtmlUrl":239,"categories":240,"keywords":242,"publishedAt":234},"01M6AE19CWAKY7Z94AKK1SK9BQ","building-vulnerability-scanning-workflow","Builds a structured vulnerability scanning workflow using tools like Nessus, Qualys, and OpenVAS to discover, prioritize, and track remediation of security vulnerabilities across infrastructure. Use when SOC teams need to establish recurring vulnerability assessment processes, integrate scan results with SIEM alerting, and build remediation tracking dashboards.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-vulnerability-scanning-workflow\u002FSKILL.md",[241],{"categoryNo":216,"categoryName":217,"taxonomyType":58,"taxonomyTypeDesc":59},[243,244,245,224,225,246,247,248,249,250,251,252,253,254,255,256,257,258,259],"workflow","vulnerability scanning","building vulnerability scanning workflow","siem","vulnerabilities","infrastructure","assessment","teams","alerting","soc","patch-management","vulnerability-scanning","nessus","qualys","openvas","cvss","remediation",{"skillNo":261,"name":262,"nameZh":18,"description":263,"descriptionZh":18,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":18,"sourceHtmlUrl":264,"categories":265,"keywords":270,"publishedAt":234},"01M6AE15XMP1G5FCGZ6VSX1BPQ","building-vulnerability-exception-tracking-system","Build a vulnerability exception and risk acceptance tracking system covering approval workflows, compensating controls documentation, and automatic expiration for vulnerabilities that miss SLA remediation timelines. Use when standing up a governance process for risk acceptance and exception approvals to support PCI DSS, SOC 2, or NIST CSF compliance.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-vulnerability-exception-tracking-system\u002FSKILL.md",[266,269],{"categoryNo":267,"categoryName":268,"taxonomyType":58,"taxonomyTypeDesc":59},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":216,"categoryName":217,"taxonomyType":58,"taxonomyTypeDesc":59},[271,225,247,272,273,274,275,276,277,278,252,279,280,281,282,283,284,285],"building vulnerability exception tracking system","support","workflows","documentation","governance","acceptance","nist csf","compliance","NIST","sla","vulnerability-management","vulnerability-exception","risk-acceptance","compensating-controls","exception-tracking",{"skillNo":287,"name":288,"nameZh":18,"description":289,"descriptionZh":18,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":18,"sourceHtmlUrl":290,"categories":291,"keywords":301,"publishedAt":234},"01M6AE129KNVPH1M44SDP473R2","building-vulnerability-dashboard-with-defectdojo","Deploy DefectDojo as a centralized vulnerability management dashboard that ingests findings from 200+ security scanners, deduplicates results, tracks remediation metrics, and integrates with CI\u002FCD, Jira ticketing, and Slack notifications via its REST API. Use when consolidating scanner output into one dashboard or automating vulnerability ticketing and executive reporting.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-vulnerability-dashboard-with-defectdojo\u002FSKILL.md",[292,293,296,299,300],{"categoryNo":267,"categoryName":268,"taxonomyType":58,"taxonomyTypeDesc":59},{"categoryNo":294,"categoryName":295,"taxonomyType":58,"taxonomyTypeDesc":59},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":297,"categoryName":298,"taxonomyType":58,"taxonomyTypeDesc":59},"01JBSEEDCAT000000000000013","分析与可视化",{"categoryNo":10,"categoryName":13,"taxonomyType":11,"taxonomyTypeDesc":12},{"categoryNo":28,"categoryName":29,"taxonomyType":11,"taxonomyTypeDesc":12},[302,303,304,305,224,225,306,307,308,309,310,311,312,313,281,314,315,316],"dashboard","building vulnerability dashboard with defectdojo","slack","devsecops","deploy","jira","metrics","vulnerability management","integration","notifications","ci","reporting","defectdojo","deduplication","scanner-integration",{"skillNo":318,"name":319,"nameZh":18,"description":320,"descriptionZh":18,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":18,"sourceHtmlUrl":321,"categories":322,"keywords":326,"publishedAt":234},"01M6AE0XWSSSVJ8JT3FR6R9Q70","building-vulnerability-aging-and-sla-tracking","Implement a vulnerability aging dashboard and SLA tracking system that measures time-to-remediation against severity-based deadlines (e.g. 14 days critical, 30 days high, 60 days medium, 90 days low), with automated escalations and compliance metrics reporting. Use when designing SLA policies, building aging\u002Fremediation dashboards, or proving compliance with remediation timelines.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-vulnerability-aging-and-sla-tracking\u002FSKILL.md",[323,324,325],{"categoryNo":297,"categoryName":298,"taxonomyType":58,"taxonomyTypeDesc":59},{"categoryNo":216,"categoryName":217,"taxonomyType":58,"taxonomyTypeDesc":59},{"categoryNo":49,"categoryName":50,"taxonomyType":11,"taxonomyTypeDesc":12},[280,327,225,328,302,329,308,313,278,330,331,281,332,333,334,335],"building vulnerability aging and sla tracking","implement","report","severity","kpi","sla-tracking","remediation-metrics","aging-report","risk-management",{"skillNo":337,"name":338,"nameZh":18,"description":339,"descriptionZh":18,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":18,"sourceHtmlUrl":340,"categories":341,"keywords":344,"publishedAt":234},"01M6AE0T8Q6AK75XKSAPPYWN08","building-threat-intelligence-platform","Design and deploy a Threat Intelligence Platform (TIP) by integrating open-source CTI tools (MISP, OpenCTI, TheHive, Cortex) into a unified system with feed ingestion pipelines, enrichment workflows, STIX\u002FTAXII interoperability, and analyst dashboards. Use when architecting or standing up a centralized CTI platform to collect, analyze, and disseminate threat intelligence across a security team.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-threat-intelligence-platform\u002FSKILL.md",[342,343],{"categoryNo":294,"categoryName":295,"taxonomyType":58,"taxonomyTypeDesc":59},{"categoryNo":216,"categoryName":217,"taxonomyType":58,"taxonomyTypeDesc":59},[345,346,347,224,225,273,306,348,349,350,351,352,353,354,355,356,357,358],"threat intelligence","building threat intelligence platform","design","collect","mitre-attack","threat-intelligence","cti","ioc","stix","MISP","TAXII","enrichment","opencti","platform-building",{"skillNo":360,"name":361,"nameZh":18,"description":362,"descriptionZh":18,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":18,"sourceHtmlUrl":363,"categories":364,"keywords":366,"publishedAt":234},"01M6AE0Q2CFF8HRT8HF6TE4M8D","building-threat-intelligence-feed-integration","Builds automated threat intelligence feed integration pipelines connecting STIX\u002FTAXII feeds, open-source threat intel, and commercial TI platforms into SIEM and security tools for real-time IOC matching and alerting. Use when SOC teams need to operationalize threat intelligence by automating feed ingestion, normalization, scoring, and distribution to detection systems.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-threat-intelligence-feed-integration\u002FSKILL.md",[365],{"categoryNo":216,"categoryName":217,"taxonomyType":58,"taxonomyTypeDesc":59},[345,310,367,224,225,246,368,250,251,350,352,353,252,354,355,369,370],"building threat intelligence feed integration","security tools","siem-integration","feeds",{"skillNo":372,"name":373,"nameZh":18,"description":374,"descriptionZh":18,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":18,"sourceHtmlUrl":375,"categories":376,"keywords":377,"publishedAt":234},"01M6AE0KRCZ5EYHAR938E7Z7TA","building-threat-intelligence-enrichment-in-splunk","Build automated IOC enrichment pipelines in Splunk Enterprise Security by ingesting threat feeds into KV Store collections and correlating them against security events via lookup tables, modular inputs, and the Threat Intelligence Framework. Use when wiring threat intel into Splunk correlation searches to flag IOC matches and cut SOC triage time.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-threat-intelligence-enrichment-in-splunk\u002FSKILL.md",[],[345,378,356,379,224,225,246,380,381,382,350,352,252,383,384,385,386],"splunk","building threat intelligence enrichment in splunk","triage","modular","framework","Enterprise","enterprise-security","correlation","lookup",{"skillNo":388,"name":389,"nameZh":18,"description":390,"descriptionZh":18,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":18,"sourceHtmlUrl":391,"categories":392,"keywords":394,"publishedAt":234},"01M6AE0G29ZAGG1RY0TWWEWDND","building-threat-hunt-hypothesis-framework","Build a systematic threat-hunt workflow that turns threat intelligence and ATT&CK gap analysis into testable hypotheses, then executes and validates them via EDR\u002FSIEM queries (CrowdStrike, Defender, Splunk, Elastic, Sysmon, Velociraptor, Sigma) and documents findings in a standardized hunt report. Use when planning or running a proactive threat hunt or scoping compromise from an intel- or anomaly-driven lead.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-threat-hunt-hypothesis-framework\u002FSKILL.md",[393],{"categoryNo":216,"categoryName":217,"taxonomyType":58,"taxonomyTypeDesc":59},[382,395,225,246,345,243,396,397,398,329,350,399,378,400,401,402,403,404,405,406],"building threat hunt hypothesis framework","documents","defender","planning","threat-hunting","T1059.001","sysmon","sigma","methodology","hypothesis","hunting-framework","proactive-detection",{"skillNo":408,"name":409,"nameZh":18,"description":410,"descriptionZh":18,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":18,"sourceHtmlUrl":411,"categories":412,"keywords":415,"publishedAt":234},"01M6AE0CH5FR6C1DA3YCC33VSJ","building-threat-feed-aggregation-with-misp","Deploy MISP via Docker and configure feeds from sources like abuse.ch, AlienVault OTX, and CIRCL to aggregate, correlate, and distribute threat intelligence, including automated feed synchronization and STIX\u002FTAXII-based integration with Splunk, Elasticsearch, and SOAR platforms. Use when standing up centralized IOC management or wiring multi-source threat feeds into a SIEM.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-threat-feed-aggregation-with-misp\u002FSKILL.md",[413,414],{"categoryNo":294,"categoryName":295,"taxonomyType":58,"taxonomyTypeDesc":59},{"categoryNo":216,"categoryName":217,"taxonomyType":58,"taxonomyTypeDesc":59},[354,416,417,225,246,418,345,306,310,350,352,353,378,355,419,420,421,422,385,369],"building threat feed aggregation with misp","docker","soar","indicator","threat-feed","aggregation","sharing",{"skillNo":424,"name":425,"nameZh":18,"description":426,"descriptionZh":18,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":18,"sourceHtmlUrl":427,"categories":428,"keywords":430,"publishedAt":234},"01M6AE08EKVE7XP03DT3FD648D","building-threat-actor-profile-from-osint","Build threat actor profiles by collecting OSINT from vendor reports, paste sites, dark web forums, social media, and code repos, correlating indicators, mapping adversary infrastructure with tools like Maltego and SpiderFoot, and producing structured dossiers of motivations, capabilities, infrastructure, and TTPs. Use when performing attribution or building an adversary dossier from open-source intelligence.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-threat-actor-profile-from-osint\u002FSKILL.md",[429],{"categoryNo":216,"categoryName":217,"taxonomyType":58,"taxonomyTypeDesc":59},[431,432,225,226,433,248,434,435,436,350,437,438,439,440,441],"osint","building threat actor profile from osint","repos","code","capabilities","threat-actor","attribution","threat-actor-profiling","maltego","spiderfoot","reconnaissance",{"skillNo":443,"name":444,"nameZh":18,"description":445,"descriptionZh":18,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":18,"sourceHtmlUrl":446,"categories":447,"keywords":449,"publishedAt":234},"01M6AE055FZV9K1PBXHZHYJWNF","building-super-timelines-with-plaso","Generate forensic super-timelines with Plaso's log2timeline.py, pinfo.py, psort.py, and psteal.py CLI tools (fusing file-system MACB, registry, EVTX, browser history, prefetch, LNK, and more), then triage and filter the results in Timesketch. Use when reconstructing the full sequence of events on a compromised or forensically imaged host during a DFIR investigation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-super-timelines-with-plaso\u002FSKILL.md",[448],{"categoryNo":216,"categoryName":217,"taxonomyType":58,"taxonomyTypeDesc":59},[450,451,452,225,380,453,454,455,456,457,458,459,460,461,462,463,464,465],"plaso","building super timelines with plaso","cli","generate","registry","browser","file","forensics","dfir","incident-response","prefetch","timeline-analysis","digital-forensics","timesketch","log2timeline","super-timeline",{"skillNo":467,"name":468,"nameZh":18,"description":469,"descriptionZh":18,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":18,"sourceHtmlUrl":470,"categories":471,"keywords":473,"publishedAt":234},"01M6AE0297GWWQPN5DWGQVW4YG","building-soc-playbook-for-ransomware","Builds a structured SOC incident response playbook for ransomware attacks covering detection, containment, eradication, and recovery phases with specific SIEM queries, isolation procedures, and decision trees. Use when SOC teams need formalized response procedures for ransomware incidents aligned to NIST SP 800-61 and MITRE ATT&CK ransomware techniques.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-soc-playbook-for-ransomware\u002FSKILL.md",[472],{"categoryNo":216,"categoryName":217,"taxonomyType":58,"taxonomyTypeDesc":59},[252,474,475,476,225,477,246,250,478,479,349,480,459,400,481,482,279,483],"ransomware","playbook","building soc playbook for ransomware","incident response","update","transfer","phishing","cryptocurrency","hardening","containment",{"skillNo":485,"name":486,"nameZh":18,"description":487,"descriptionZh":18,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":18,"sourceHtmlUrl":488,"categories":489,"keywords":492,"publishedAt":234},"01M6ADZYR7P2PQQCP75TA5TWPG","building-soc-metrics-and-kpi-tracking","Builds SOC performance metrics and KPI tracking dashboards measuring Mean Time to Detect (MTTD), Mean Time to Respond (MTTR), alert quality ratios, analyst productivity, and detection coverage using SIEM data. Use when SOC leadership needs operational visibility, continuous improvement tracking, or executive-level reporting on security operations effectiveness.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-soc-metrics-and-kpi-tracking\u002FSKILL.md",[490,491],{"categoryNo":216,"categoryName":217,"taxonomyType":58,"taxonomyTypeDesc":59},{"categoryNo":28,"categoryName":29,"taxonomyType":11,"taxonomyTypeDesc":12},[308,252,493,224,494,225,495,246,302,313,496,497,331,498,499,500],"building soc metrics and kpi tracking","performance","security operations","productivity","data","mttd","mttr","continuous-improvement",{"skillNo":502,"name":503,"nameZh":18,"description":504,"descriptionZh":18,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":18,"sourceHtmlUrl":505,"categories":506,"keywords":507,"publishedAt":234},"01M6ADZTWGXJGR5XCXCM6K58HY","building-soc-escalation-matrix","Build a structured SOC escalation matrix defining severity tiers, response SLAs, tiered escalation paths, and notification procedures for security incidents, using context-driven criteria that combine business risk, asset criticality, and data sensitivity. Use when designing or revising how a SOC triages and escalates incidents across analyst tiers.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-soc-escalation-matrix\u002FSKILL.md",[],[252,508,224,225,380,497,509,510,330,280,511],"building soc escalation matrix","escalation","incident-management","tiered-soc",{"skillNo":513,"name":514,"nameZh":18,"description":515,"descriptionZh":18,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":18,"sourceHtmlUrl":516,"categories":517,"keywords":519,"publishedAt":234},"01M6ADZQE0S7H8X77TCMHS7PX0","building-role-mining-for-rbac-optimization","Apply bottom-up and top-down role mining techniques, including clustering algorithms and formal concept analysis, to discover optimal RBAC roles from existing user-permission assignments, consolidating overlapping roles and enforcing least privilege. Use when an identity program needs to reduce role explosion or redesign its RBAC role set from access data.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-role-mining-for-rbac-optimization\u002FSKILL.md",[518],{"categoryNo":216,"categoryName":217,"taxonomyType":58,"taxonomyTypeDesc":59},[520,521,522,225,523,275,227,497,524,525,526,527,528],"rbac","Optimization","building role mining for rbac optimization","identity","access-control","least-privilege","identity-governance","role-mining","clustering",{"skillNo":530,"name":531,"nameZh":18,"description":532,"descriptionZh":18,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":18,"sourceHtmlUrl":533,"categories":534,"keywords":536,"publishedAt":234},"01M6ADZKV0JGVZZTCQDF9FQETV","building-red-team-c2-infrastructure-with-havoc","Deploy and configure the Havoc C2 framework (teamserver, HTTPS\u002FHTTP\u002FSMB listeners, Nginx redirectors, and Demon agents) with malleable traffic profiles and OPSEC-hardened infrastructure for authorized red team operations. Use when standing up or hardening Havoc C2 infrastructure for a written, authorized adversary emulation engagement.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-red-team-c2-infrastructure-with-havoc\u002FSKILL.md",[535],{"categoryNo":216,"categoryName":217,"taxonomyType":58,"taxonomyTypeDesc":59},[248,537,538,539,225,540,541,542,382,543,456,544,545,546,547,548,549,550,551,552],"red team","c2","building red team c2 infrastructure with havoc","http","validation","protocol","https","red-team","post-exploitation","nginx","command-and-control","opsec","havoc-c2","red-team-infrastructure","adversary-emulation","demon-agent",{"skillNo":554,"name":555,"nameZh":18,"description":556,"descriptionZh":18,"repositoryFullName":202,"ownerLogin":203,"ownerAvatarUrl":204,"ownerAccountNo":205,"ownerDisplayName":206,"repositoryNo":207,"starsCount":208,"licenseSpdxId":209,"licenseFileUrl":18,"sourceHtmlUrl":557,"categories":558,"keywords":560,"publishedAt":234},"01M6ADZG5N82XERSNTAF6AQ2ZG","building-ransomware-playbook-with-cisa-framework","Builds a structured ransomware incident response playbook aligned with the CISA StopRansomware Guide and NIST Cybersecurity Framework, covering preparation, detection, containment, eradication, recovery, and post-incident phases with actionable checklists. Use when creating or updating a ransomware playbook, running a CISA-aligned readiness assessment, or validating response steps during a tabletop exercise.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-ransomware-playbook-with-cisa-framework\u002FSKILL.md",[559],{"categoryNo":216,"categoryName":217,"taxonomyType":58,"taxonomyTypeDesc":59},[382,474,561,225,477,227,249,479,278,480,459,481,562,475,279],"building ransomware playbook with cisa framework","CISA",121,18]