chore: auto-update index.json and skill count

Fix index.json generator to parse folded YAML descriptions
The generator's `^description:\s*(.+)$` regex captured the block-scalar indicator (">-") instead of the wrapped text, corrupting 43 descriptions in index.json. Parse `>`/`|` block scalars properly and regenerate (0 broken). Also refresh the count-update comment examples 754 -> 817.
2026-08-07 11:10:19 +03:00 · 2026-08-02 17:47:41 +00:00 · 2026-08-02 10:47:14 -07:00 · 2026-08-02 10:47:14 -07:00 · 2026-08-02 10:47:14 -07:00 · 2026-08-02 09:53:50 -07:00
570 changed files with 2505 additions and 2070 deletions
@@ -6,14 +6,14 @@
  },
  "metadata": {
    "description": "817 cybersecurity skills for AI agents mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF, and the MITRE Fight Fraud Framework (F3).",
-    "version": "1.2.0"
+    "version": "1.3.0"
  },
  "plugins": [
    {
      "name": "cybersecurity-skills",
      "source": "./",
      "description": "817 cybersecurity skills covering web security, pentesting, DFIR, threat intelligence, cloud security, malware analysis, and more. Mapped to 6 frameworks.",
-      "version": "1.2.0",
+      "version": "1.3.0",
      "author": {
        "name": "mukul975"
      },
@@ -1,5 +1,5 @@
 {
  "name": "cybersecurity-skills",
  "description": "817 cybersecurity skills covering web security, pentesting, DFIR, threat intelligence, cloud security, malware analysis, and more.",
-  "version": "1.2.0"
+  "version": "1.3.0"
 }
@@ -36,9 +36,33 @@ jobs:
              fm_match = re.match(r"^---\n(.*?)\n---", content, re.DOTALL)
              description = ""
              if fm_match:
-                  m = re.search(r"^description:\s*(.+)$", fm_match.group(1), re.MULTILINE)
-                  if m:
-                      description = m.group(1).strip().strip('"')
+                  fm = fm_match.group(1)
+                  dm = re.search(r"^description:[ \t]*(.*)$", fm, re.MULTILINE)
+                  if dm:
+                      first = dm.group(1).strip()
+                      if first[:1] in (">", "|"):
+                          # YAML block scalar: gather the following more-indented lines
+                          buf = []
+                          for ln in fm[dm.end():].split("\n"):
+                              if ln.strip() == "":
+                                  buf.append("")
+                              elif re.match(r"^[ \t]+\S", ln):
+                                  buf.append(ln.strip())
+                              else:
+                                  break
+                          if first.startswith(">"):  # folded: blank line = break, else join w/ space
+                              paras, cur = [], []
+                              for b in buf:
+                                  if b == "":
+                                      if cur: paras.append(" ".join(cur)); cur = []
+                                  else:
+                                      cur.append(b)
+                              if cur: paras.append(" ".join(cur))
+                              description = " ".join(paras).strip()
+                          else:  # literal
+                              description = " ".join(b for b in buf if b).strip()
+                      else:
+                          description = first.strip('"').strip("'")
              skills.append({
                  "name": skill_name,
                  "description": description,
@@ -80,8 +104,8 @@ jobs:
          with open("README.md", encoding="utf-8") as f:
              readme = f.read()
          readme = re.sub(r"(badge/skills-)\d+", rf"\g<1>{count}", readme)
-          # "754 production-grade", "754 structured", "754 skills", "all 754 skills",
-          # "Scans 754 skill", "contains **754 skills**", BibTeX "{754 structured"
+          # "817 production-grade", "817 structured", "817 skills", "all 817 skills",
+          # "Scans 817 skill", "contains **817 skills**", BibTeX "{817 structured"
          readme = re.sub(r"\b\d+(?=\s+production-grade cybersecurity skills)", str(count), readme)
          readme = re.sub(r"\b\d+(?=\s+structured cybersecurity skills)", str(count), readme)
          readme = re.sub(r"(all\s+)\d+(?=\s+skills)", rf"\g<1>{count}", readme)
@@ -15,57 +15,11 @@ jobs:
    steps:
      - uses: actions/checkout@v4

-      - name: Validate SKILL.md frontmatter with Python
-        run: |
-          python3 << 'EOF'
-          import os
-          import re
-          import sys
-
-          REQUIRED_FIELDS = ['name', 'description', 'domain', 'subdomain', 'tags', 'version', 'author', 'license']
-          errors = []
-          checked = 0
-
-          for root, dirs, files in os.walk('skills'):
-              for file in files:
-                  if file == 'SKILL.md':
-                      path = os.path.join(root, file)
-                      checked += 1
-                      with open(path, 'r', encoding='utf-8') as f:
-                          content = f.read()
-
-                      # Check frontmatter exists
-                      fm_match = re.match(r'^---\n(.*?)\n---', content, re.DOTALL)
-                      if not fm_match:
-                          errors.append(f"{path}: Missing YAML frontmatter")
-                          continue
-
-                      fm = fm_match.group(1)
-
-                      # Check required fields
-                      for field in REQUIRED_FIELDS:
-                          if not re.search(rf'^{field}:', fm, re.MULTILINE):
-                              errors.append(f"{path}: Missing required field '{field}'")
-
-                      # Check name format (kebab-case)
-                      name_match = re.search(r'^name:\s*(.+)$', fm, re.MULTILINE)
-                      if name_match:
-                          name = name_match.group(1).strip().strip('"')
-                          if not re.match(r'^[a-z0-9-]+$', name):
-                              errors.append(f"{path}: Name '{name}' must be kebab-case")
-                          if len(name) > 64:
-                              errors.append(f"{path}: Name '{name}' exceeds 64 characters")
-
-          print(f"Checked {checked} SKILL.md files")
-
-          if errors:
-              print(f"\n{len(errors)} validation error(s):")
-              for e in errors:
-                  print(f"  ❌ {e}")
-              sys.exit(1)
-          else:
-              print(f"✅ All {checked} skills valid")
-          EOF
+      # Single source of truth: tools/validate-skill.py validates required
+      # frontmatter fields, kebab-case name, description length, subdomain, and
+      # tag count. (Previously this step duplicated a weaker inline parser.)
+      - name: Validate SKILL.md frontmatter
+        run: python3 tools/validate-skill.py --all

      - name: Check for duplicate skill names
        run: |
@@ -6,7 +6,7 @@
  <img src="https://img.shields.io/badge/Tactics-14%2F14-green?style=for-the-badge" alt="Tactics" />
 </p>

-This document maps all **291 unique MITRE ATT&CK techniques** (across **149 parent techniques**) referenced in our **753+ cybersecurity skills** to the 14 Enterprise ATT&CK tactics. Use this to identify coverage gaps, plan detection engineering priorities, or validate your security program against the ATT&CK framework.
+This document maps all **291 unique MITRE ATT&CK techniques** (across **149 parent techniques**) referenced in our **817 cybersecurity skills** to the 14 Enterprise ATT&CK tactics. Use this to identify coverage gaps, plan detection engineering priorities, or validate your security program against the ATT&CK framework.

 > **How to read this:** Each technique links to its official ATT&CK page. Skills listed under each technique are the ones in this repository that teach detection, hunting, exploitation, or response for that technique.

@@ -505,5 +505,5 @@ GenAI-specific subcategories applied: GOVERN-6.1, GOVERN-6.2 (responsible deploy
 ---

 <p align="center">
-  <sub>Part of <a href="https://github.com/mukul975/Anthropic-Cybersecurity-Skills">Anthropic Cybersecurity Skills</a> — 753+ open-source cybersecurity skills for AI agents</sub>
+  <sub>Part of <a href="https://github.com/mukul975/Anthropic-Cybersecurity-Skills">Anthropic Cybersecurity Skills</a> — 817 open-source cybersecurity skills for AI agents</sub>
 </p>
@@ -3,7 +3,7 @@ message: "If you use this repository in your research, tools, or publications, p
 type: software
 title: "Anthropic-Cybersecurity-Skills"
 abstract: >
-  A structured collection of 753 cybersecurity skills for AI agents, covering
+  A structured collection of 817 cybersecurity skills for AI agents, covering
  penetration testing, digital forensics, threat intelligence, incident response,
  cloud security, OT/SCADA security, AI security, and more. Each skill follows
  a standardized format with YAML frontmatter metadata, step-by-step procedures,
@@ -26,34 +26,36 @@

 **817 production-grade cybersecurity skills · 29 security domains · 6 framework mappings · 26+ AI platforms**

-[Get Started](#quick-start) · [What's Inside](#whats-inside--29-security-domains) · [Frameworks](#five-frameworks-one-skill-library) · [Platforms](#compatible-platforms) · [Contributing](#contributing)
+[Get Started](#quick-start) · [What's Inside](#whats-inside--29-security-domains) · [Frameworks](#six-frameworks-one-skill-library) · [Platforms](#compatible-platforms) · [Contributing](#contributing)

 </div>

 ---

 > ⚠️ **Community Project** — This is an independent, community-created project. Not affiliated with Anthropic PBC.
+>
+> 🔐 **Authorized & lawful use only.** This library includes offensive and dual-use techniques (e.g. red-team C2, phishing simulation, exploitation) intended for **authorized penetration testing, security research, defense, and education**. Only use them against systems you own or have **explicit written permission** to test, and comply with all applicable laws and rules of engagement. You are solely responsible for how you use these skills. See [SECURITY.md](SECURITY.md) and [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md).

 ## Give any AI agent the security skills of a senior analyst

 A junior analyst knows which Volatility3 plugin to run on a suspicious memory dump, which Sigma rules catch Kerberoasting, and how to scope a cloud breach across three providers. **Your AI agent doesn't — unless you give it these skills.**

-This repo contains **817 structured cybersecurity skills** spanning **29 security domains**, each following the [agentskills.io](https://agentskills.io) open standard.  Every skill is mapped to **six industry frameworks** — MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, MITRE D3FEND, NIST AI RMF, and the MITRE Fight Fraud Framework (F3) — making this the only open-source skills library with unified cross-framework coverage.  Clone it, point your agent at it, and your next security investigation gets expert-level guidance in seconds.
+This repo contains **817 structured cybersecurity skills** spanning **29 security domains**, each following the [agentskills.io](https://agentskills.io) open standard.  The library maps across **six industry frameworks** — MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, MITRE D3FEND, NIST AI RMF, and the MITRE Fight Fraud Framework (F3) — with each skill mapped to the frameworks **relevant to its type** (a forensics skill carries ATT&CK + CSF; an AI-security skill adds ATLAS and AI RMF).  Clone it, point your agent at it, and your next security investigation gets expert-level guidance in seconds.

 ## Six frameworks, one skill library

-No other open-source skills library maps every skill to all of these frameworks.  One skill, six compliance checkboxes. 
+Each skill maps to the frameworks that fit its subject — ATT&CK and NIST CSF are near-universal, while ATLAS, AI RMF, D3FEND, and F3 apply where they're relevant. **Framework coverage across the 817 skills:** MITRE ATT&CK **805** · NIST CSF 2.0 **804** · MITRE D3FEND **139** · NIST AI RMF **97** · MITRE F3 **94** · MITRE ATLAS **93**.

-| Framework | Version | Scope in this repo | What it maps |
+| Framework | Version | Framework scope | What it maps |
 |---|---|---|---|
-| [MITRE ATT&CK](https://attack.mitre.org) | v19.1 | 15 tactics · 286 techniques | Adversary behaviors and TTPs |
-| [NIST CSF 2.0](https://www.nist.gov/cyberframework) | 2.0 | 6 functions · 22 categories | Organizational security posture |
-| [MITRE ATLAS](https://atlas.mitre.org) | v5.4 | 16 tactics · 84 techniques | AI/ML adversarial threats |
-| [MITRE D3FEND](https://d3fend.mitre.org) | v1.3 | 7 categories · 267 techniques | Defensive countermeasures |
-| [NIST AI RMF](https://airc.nist.gov/AI_RMF) | 1.0 | 4 functions · 72 subcategories | AI risk management |
+| [MITRE ATT&CK](https://attack.mitre.org) | v19.1 | 15 tactics · Enterprise/Mobile/ICS | Adversary behaviors and TTPs |
+| [NIST CSF 2.0](https://www.nist.gov/cyberframework) | 2.0 | 6 functions · 22 categories · 106 subcategories | Organizational security posture |
+| [MITRE ATLAS](https://atlas.mitre.org) | 2026.07 | 101 techniques · 77 sub-techniques | AI/ML adversarial threats |
+| [MITRE D3FEND](https://d3fend.mitre.org) | v1.4.0 | 270 techniques | Defensive countermeasures |
+| [NIST AI RMF](https://airc.nist.gov/AI_RMF) | 1.0 | 4 functions (Govern/Map/Measure/Manage) | AI risk management |
 | [MITRE F3 (Fight Fraud Framework)](https://ctid.mitre.org/fraud/) | v1.1 (2026-04-09) | 8 tactics · 123 techniques · 94 fraud-relevant skills | Cyber-enabled financial fraud TTPs |

-**Example — a single skill maps across all six:**
+**Example — each skill maps only to the frameworks relevant to it (one may hit all six, another just a couple):**

 | Skill | ATT&CK | NIST CSF | ATLAS | D3FEND | AI RMF | F3 |
 |---|---|---|---|---|---|---|
@@ -72,9 +74,9 @@ F3 v1.1 adds **two fraud-specific tactics** that ATT&CK does not enumerate:

 Fraud-specific techniques use `F1XXX` IDs (e.g. `F1005.003` Add Beneficiary, `F1025.003` Wire Transfer, `F1007` Adversary-in-the-Browser); reused ATT&CK techniques keep their `T1XXX` IDs. Mappings live in each skill's `mitre_f3:` frontmatter block — all 123 F3 v1.1 technique IDs were verified against the upstream STIX bundle. See [`docs/mitre-f3-mapping.md`](docs/mitre-f3-mapping.md) for the schema.

-### MITRE ATT&CK v19.1 — 754/754 skills mapped
+### MITRE ATT&CK v19.1 — 805/817 skills mapped

-Every skill carries a `mitre_attack` frontmatter list validated against **MITRE ATT&CK v19.1** (the latest release) using the official `mitreattack-python` library — 286 distinct techniques across all 15 Enterprise tactics, plus ICS and Mobile techniques where relevant. Zero revoked or deprecated IDs. v19.1's restructured Defense Evasion (now split into **Stealth** and **Defense Impairment**) is reflected below.
+Every skill carries a `mitre_attack` frontmatter list validated against **MITRE ATT&CK v19.1** (the latest release) using the official `mitreattack-python` library — 290 distinct techniques and sub-techniques (146 base + 144 sub) across Enterprise, ICS, and Mobile. Zero revoked or deprecated IDs. v19.1's restructured Defense Evasion (now split into **Stealth** and **Defense Impairment**) is reflected below.

 | Tactic | ID | Skills |
 |--------|----|--------|
@@ -262,7 +264,7 @@ How to confirm the skill was executed successfully.
 Frontmatter fields: `name` (kebab-case, 1–64 chars), `description` (keyword-rich for agent discovery), `domain`, `subdomain`, `tags`,  `atlas_techniques` (MITRE ATLAS IDs), `d3fend_techniques` (MITRE D3FEND IDs), `nist_ai_rmf` (NIST AI RMF references), `nist_csf` (NIST CSF 2.0 categories).  MITRE ATT&CK technique mappings are documented in each skill's `references/standards.md` file and in the ATT&CK Navigator layer included with releases. 

 <details>
-<summary><strong>📊 MITRE ATT&CK Enterprise coverage — all 14 tactics</strong></summary>
+<summary><strong>📊 MITRE ATT&CK Enterprise coverage — all 15 tactics</strong></summary>

 &nbsp;

@@ -274,7 +276,8 @@ Frontmatter fields: `name` (kebab-case, 1–64 chars), `description` (keyword-ri
 | Execution | TA0002 | Strong | PowerShell analysis, fileless malware, script block logging |
 | Persistence | TA0003 | Strong | Scheduled tasks, registry, service accounts, LOTL |
 | Privilege Escalation | TA0004 | Strong | Kerberoasting, AD attacks, cloud privilege escalation |
-| Defense Evasion | TA0005 | Strong | Obfuscation, rootkit analysis, evasion detection |
+| Stealth | TA0005 | Strong | Obfuscation, rootkit analysis, evasion detection |
+| Defense Impairment | TA0112 | Moderate | Impair Defenses (T1562), log/indicator removal, EDR tampering |
 | Credential Access | TA0006 | Strong | Mimikatz detection, pass-the-hash, credential dumping |
 | Discovery | TA0007 | Moderate | BloodHound, AD enumeration, network scanning |
 | Lateral Movement | TA0008 | Strong | SMB exploits, lateral movement detection with Splunk |
@@ -312,11 +315,11 @@ NIST CSF 2.0 (February 2024) added the **Govern** function  and expanded scope f

 &nbsp;

-### MITRE ATLAS v5.4 — AI/ML adversarial threats
-ATLAS maps adversarial tactics, techniques, and case studies specific to AI and machine learning systems. Version 5.4 covers **16 tactics and 84 techniques** including agentic AI attack vectors added in late 2025: AI agent context poisoning, tool invocation abuse, MCP server compromises, and malicious agent deployment.  Skills mapped to ATLAS help agents identify and defend against threats to ML pipelines, model weights, inference APIs, and autonomous workflows. 
+### MITRE ATLAS 2026.07 — AI/ML adversarial threats
+ATLAS maps adversarial tactics, techniques, and case studies specific to AI and machine learning systems. Release 2026.07 covers **101 techniques and 77 sub-techniques** including agentic AI attack vectors added in late 2025: AI agent context poisoning, tool invocation abuse, MCP server compromises, and malicious agent deployment.  Skills mapped to ATLAS help agents identify and defend against threats to ML pipelines, model weights, inference APIs, and autonomous workflows. 

-### MITRE D3FEND v1.3 — Defensive countermeasures
-D3FEND is an NSA-funded knowledge graph of **267 defensive techniques** organized across 7 tactical categories: Model, Harden, Detect, Isolate, Deceive, Evict, and Restore.  Built on OWL 2 ontology, it uses a shared Digital Artifact layer to bidirectionally map defensive countermeasures to ATT&CK offensive techniques.  Skills tagged with D3FEND identifiers let agents recommend specific countermeasures for detected threats.
+### MITRE D3FEND v1.4.0 — Defensive countermeasures
+D3FEND is an NSA-funded knowledge graph of **270 defensive techniques** organized across 7 tactical categories: Model, Harden, Detect, Isolate, Deceive, Evict, and Restore.  Built on OWL 2 ontology, it uses a shared Digital Artifact layer to bidirectionally map defensive countermeasures to ATT&CK offensive techniques.  Skills tagged with D3FEND identifiers let agents recommend specific countermeasures for detected threats.

 ### NIST AI RMF 1.0 + GenAI Profile (AI 600-1)
 The AI Risk Management Framework defines 4 core functions — Govern, Map, Measure, Manage — with **72 subcategories** for trustworthy AI development.  The GenAI Profile (AI 600-1, July 2024) adds **12 risk categories** specific to generative AI, from confabulation and data privacy to prompt injection and supply chain risks.  Colorado's AI Act (effective February 2026) provides a **legal safe harbor** for organizations complying with NIST AI RMF, making these mappings directly relevant to regulatory compliance.
@@ -390,6 +393,23 @@ Every PR is reviewed for technical accuracy and agentskills.io standard complian

 This project follows the [Contributor Covenant](https://www.contributor-covenant.org/). By participating, you agree to uphold this code. 

+## 🙏 Thanks to our contributors
+
+This library is built by the community. Thank you to everyone who has contributed:
+
+<p align="center">
+<a href="https://github.com/mukul975" title="mukul975 — maintainer"><img src="https://github.com/mukul975.png?size=100" width="72" height="72" alt="@mukul975"></a>
+<a href="https://github.com/juliosuas" title="juliosuas"><img src="https://github.com/juliosuas.png?size=100" width="72" height="72" alt="@juliosuas"></a>
+<a href="https://github.com/andrewibrah" title="andrewibrah"><img src="https://github.com/andrewibrah.png?size=100" width="72" height="72" alt="@andrewibrah"></a>
+<a href="https://github.com/Bortlesboat" title="Bortlesboat"><img src="https://github.com/Bortlesboat.png?size=100" width="72" height="72" alt="@Bortlesboat"></a>
+<a href="https://github.com/DevRedious" title="DevRedious"><img src="https://github.com/DevRedious.png?size=100" width="72" height="72" alt="@DevRedious"></a>
+<a href="https://github.com/ioxoi" title="ioxoi"><img src="https://github.com/ioxoi.png?size=100" width="72" height="72" alt="@ioxoi"></a>
+<a href="https://github.com/shanujans" title="shanujans"><img src="https://github.com/shanujans.png?size=100" width="72" height="72" alt="@shanujans"></a>
+<a href="https://github.com/nyxst4ck" title="nyxst4ck"><img src="https://github.com/nyxst4ck.png?size=100" width="72" height="72" alt="@nyxst4ck"></a>
+</p>
+
+<p align="center"><sub>Ordered by contribution count · see the full <a href="https://github.com/mukul975/Anthropic-Cybersecurity-Skills/graphs/contributors">contributor graph</a></sub></p>
+
 ## Community

 💬 [Discussions](https://github.com/mukul975/Anthropic-Cybersecurity-Skills/discussions) — Questions, ideas, and roadmap conversations
@@ -21,7 +21,7 @@ Alternatively, paste the raw JSON URL into the Navigator's "Load from URL" optio

 | Metric | Value |
 |--------|-------|
-| Total skills scanned | 742 |
+| Total skills scanned | 817 |
 | Unique ATT&CK techniques referenced | 218 |
 | Parent techniques | 94 |
 | Sub-techniques | 124 |
@@ -1,6 +1,6 @@
 # ATT&CK Coverage Summary

-Coverage analysis of the 753 cybersecurity skills mapped to MITRE ATT&CK Enterprise v15 tactics.
+Coverage analysis of the 805 cybersecurity skills mapped to MITRE ATT&CK Enterprise tactics.

 ## Tactic Coverage Matrix

@@ -1,6 +1,6 @@
 ---
 name: abusing-dpapi-for-credential-access
-description: Extract DPAPI-protected secrets such as credentials and browser data offline and online.
+description: Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key. Use during authorized red-team credential-access engagements after gaining a foothold or when triaging DPAPI blobs pulled from a host.
 domain: cybersecurity
 subdomain: red-teaming
 tags:
@@ -1,6 +1,6 @@
 ---
 name: abusing-shadow-credentials-for-privesc
-description: Take over Active Directory user and computer accounts by writing alternate certificate keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, and Certipy, then authenticate via PKINIT.
+description: Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset. Use when BloodHound shows GenericWrite/GenericAll/AddKeyCredentialLink over a target, as a stealthier alternative to ForceChangePassword, during authorized red-team engagements.
 domain: cybersecurity
 subdomain: red-teaming
 tags:
@@ -1,7 +1,6 @@
 ---
 name: acquiring-disk-image-with-dd-and-dcfldd
-description: Create forensically sound bit-for-bit disk images using dd and dcfldd
-  while preserving evidence integrity through hash verification.
+description: Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.
 domain: cybersecurity
 subdomain: digital-forensics
 tags:
@@ -15,7 +14,6 @@ version: '1.0'
 author: mahipal
 license: Apache-2.0
 nist_csf:
- RS.AN-01
 - RS.AN-03
 - DE.AE-02
 - RS.MA-01
@@ -1,8 +1,6 @@
 ---
 name: analyzing-android-malware-with-apktool
-description: Perform static analysis of Android APK malware samples using apktool
-  for decompilation, jadx for Java source recovery, and androguard for permission
-  analysis, manifest inspection, and suspicious API call detection.
+description: Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection, dangerous permission-combination detection, and identification of obfuscated code, dynamic code loading, and reflection-based API calls. Use to statically triage a suspicious APK without executing it or to build mobile malware detection rules.
 domain: cybersecurity
 subdomain: malware-analysis
 tags:
@@ -1,8 +1,6 @@
 ---
 name: analyzing-apt-group-with-mitre-navigator
-description: Analyze advanced persistent threat (APT) group techniques using MITRE
-  ATT&CK Navigator to create layered heatmaps of adversary TTPs for detection gap
-  analysis and threat-informed defense.
+description: Query ATT&CK data with attackcti, mitreattack-python, and stix2, then build MITRE ATT&CK Navigator layers and multi-layer heatmap overlays mapping one or more APT groups' TTPs for detection-gap analysis. Use to compare threat-actor technique coverage, find gaps in detection engineering, or produce Navigator visualizations for threat-intel reporting.
 domain: cybersecurity
 subdomain: threat-intelligence
 tags:
@@ -1,11 +1,10 @@
 ---
 name: analyzing-bootkit-and-rootkit-samples
-description: 'Analyzes bootkit and advanced rootkit malware that infects the Master
-  Boot Record (MBR), Volume Boot Record (VBR), or UEFI firmware to gain persistence
-  below the operating system. Covers boot sector analysis, UEFI module inspection,
-  and anti-rootkit detection techniques. Activates for requests involving bootkit
-  analysis, MBR malware investigation, UEFI persistence analysis, or pre-OS malware
-  detection.
+description: 'Analyzes bootkit and advanced rootkit malware infecting the Master
+  Boot Record (MBR), Volume Boot Record (VBR), or UEFI firmware for below-OS persistence,
+  covering boot sector analysis, UEFI module inspection, and anti-rootkit detection.
+  Use when compromise survives OS reinstallation or antivirus/EDR fails to detect
+  malware despite clear infection signs.

  '
 domain: cybersecurity
@@ -1,8 +1,6 @@
 ---
 name: analyzing-browser-forensics-with-hindsight
-description: Analyze Chromium-based browser artifacts using Hindsight to extract browsing
-  history, downloads, cookies, cached content, autofill data, saved passwords, and
-  browser extensions from Chrome, Edge, Brave, and Opera for forensic investigation.
+description: Parse Chromium-based browser databases with Hindsight to extract and correlate browsing history, downloads, cookies, cached content, autofill data, saved passwords, and extensions from Chrome, Edge, Brave, Opera, and Vivaldi into a unified timeline (XLSX, JSON, or SQLite output). Use during incident response, insider-threat investigations, or criminal cases when you need to reconstruct a user's web activity from a browser profile.
 domain: cybersecurity
 subdomain: digital-forensics
 tags:
@@ -20,7 +18,6 @@ version: '1.0'
 author: mahipal
 license: Apache-2.0
 nist_csf:
- RS.AN-01
 - RS.AN-03
 - DE.AE-02
 - RS.MA-01
@@ -1,8 +1,6 @@
 ---
 name: analyzing-campaign-attribution-evidence
-description: Campaign attribution analysis involves systematically evaluating evidence
-  to determine which threat actor or group is responsible for a cyber operation. This
-  skill covers collecting and weighting attr
+description: Systematically evaluate cyber-campaign evidence to attribute an operation to a threat actor, using the Diamond Model and Analysis of Competing Hypotheses (ACH) to weigh infrastructure overlaps, TTP consistency, malware code similarity, and timing/language artifacts into confidence-weighted attribution assessments. Use when an incident investigation needs a defensible attribution confidence level.
 domain: cybersecurity
 subdomain: threat-intelligence
 tags:
@@ -1,10 +1,6 @@
 ---
 name: analyzing-cloud-storage-access-patterns
-description: Detect abnormal access patterns in AWS S3, GCS, and Azure Blob Storage
-  by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics.
-  Identifies after-hours bulk downloads, access from new IP addresses, unusual API
-  calls (GetObject spikes), and potential data exfiltration using statistical baselines
-  and time-series anomaly detection.
+description: Detect abnormal access in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics for after-hours bulk downloads, new-IP access, and API-call spikes (e.g. GetObject) via statistical baselines and time-series anomaly detection. Use when investigating suspected cloud data exfiltration or building related detection rules.
 domain: cybersecurity
 subdomain: cloud-security
 tags:
@@ -1,8 +1,6 @@
 ---
 name: analyzing-cobaltstrike-malleable-c2-profiles
-description: Parse and analyze Cobalt Strike Malleable C2 profiles using dissect.cobaltstrike
-  and pyMalleableC2 to extract C2 indicators, detect evasion techniques, and generate
-  network detection signatures.
+description: Parse and analyze Cobalt Strike Malleable C2 profiles with dissect.cobaltstrike (profiles and beacon-payload configs) and pyMalleableC2 (AST parsing) to extract HTTP/DNS transforms, URIs, headers, sleep/jitter, and injection behavior, then generate network detection signatures. Use when reverse-engineering a captured malleable profile or building detections against Cobalt Strike Beacon traffic.
 domain: cybersecurity
 subdomain: malware-analysis
 tags:
@@ -1,10 +1,11 @@
 ---
 name: analyzing-command-and-control-communication
-description: 'Analyzes malware command-and-control (C2) communication protocols to
-  understand beacon patterns, command structures, data encoding, and infrastructure.
-  Covers HTTP, HTTPS, DNS, and custom protocol C2 analysis for detection development
-  and threat intelligence. Activates for requests involving C2 analysis, beacon detection,
-  C2 protocol reverse engineering, or command-and-control infrastructure mapping.
+description: 'Analyzes malware C2 communication over HTTP, HTTPS, DNS, and custom
+  protocols to reverse-engineer beacon patterns, command structures, data encoding,
+  and infrastructure (primary servers, fallback domains, dead drops). Use after
+  reverse engineering reveals network traffic needing protocol analysis or when
+  building detection signatures for a framework like Cobalt Strike, Metasploit,
+  or Sliver.

  '
 domain: cybersecurity
@@ -1,7 +1,6 @@
 ---
 name: analyzing-disk-image-with-autopsy
-description: Perform comprehensive forensic analysis of disk images using Autopsy
-  to recover files, examine artifacts, and build investigation timelines.
+description: Perform comprehensive forensic analysis of raw (dd), E01, or AFF disk images with Autopsy and The Sleuth Kit, recovering deleted files, examining metadata and embedded artifacts, keyword searching, and building investigation timelines with visual reports. Use for structured analysis of a forensic disk image or when stakeholders need visual reports from evidence.
 domain: cybersecurity
 subdomain: digital-forensics
 tags:
@@ -15,7 +14,6 @@ version: '1.0'
 author: mahipal
 license: Apache-2.0
 nist_csf:
- RS.AN-01
 - RS.AN-03
 - DE.AE-02
 - RS.MA-01
@@ -15,7 +15,6 @@ version: '1.0'
 author: mahipal
 license: Apache-2.0
 nist_csf:
- RS.AN-01
 - RS.AN-03
 - DE.AE-02
 - RS.MA-01
@@ -1,7 +1,10 @@
 ---
 name: analyzing-email-headers-for-phishing-investigation
-description: Parse and analyze email headers to trace the origin of phishing emails,
-  verify sender authenticity, and identify spoofing through SPF, DKIM, and DMARC validation.
+description: Parse and analyze email headers (Received chain, Return-Path, Message-ID)
+  to trace the true origin of a phishing email and validate SPF, DKIM, and DMARC
+  results to confirm or rule out sender spoofing. Use when triaging a suspicious or
+  reported email, investigating a phishing incident, or verifying whether a message's
+  sender domain was spoofed.
 domain: cybersecurity
 subdomain: digital-forensics
 tags:
@@ -18,7 +21,6 @@ license: Apache-2.0
 atlas_techniques:
 - AML.T0052
 nist_csf:
- RS.AN-01
 - RS.AN-03
 - DE.AE-02
 - RS.MA-01
@@ -1,8 +1,11 @@
 ---
 name: analyzing-golang-malware-with-ghidra
-description: Reverse engineer Go-compiled malware using Ghidra with specialized scripts
-  for function recovery, string extraction, and type reconstruction in stripped Go
-  binaries.
+description: Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo
+  and pclntab structures, recovering stripped/obfuscated function names (e.g. via
+  GoResolver), and extracting embedded module/dependency strings and types from Go
+  binaries. Use when analyzing a Go-language malware sample, deobfuscating a garble-packed
+  Go binary, or recovering function names and third-party dependencies from a stripped
+  Go executable.
 domain: cybersecurity
 subdomain: malware-analysis
 tags:
@@ -1,11 +1,10 @@
 ---
 name: analyzing-linux-elf-malware
-description: 'Analyzes malicious Linux ELF (Executable and Linkable Format) binaries
-  including botnets, cryptominers, ransomware, and rootkits targeting Linux servers,
-  containers, and cloud infrastructure. Covers static analysis, dynamic tracing, and
-  reverse engineering of x86_64 and ARM ELF samples. Activates for requests involving
-  Linux malware analysis, ELF binary investigation, Linux server compromise assessment,
-  or container malware analysis.
+description: 'Analyze malicious Linux ELF binaries — botnets, cryptominers, ransomware,
+  and rootkits targeting Linux servers, containers, and cloud infrastructure — through
+  static analysis, dynamic tracing, and reverse engineering of x86_64 and ARM samples.
+  Use when investigating Linux malware, triaging a suspicious ELF binary, assessing
+  a compromised Linux server, or analyzing container-targeted malware.

  '
 domain: cybersecurity
@@ -19,7 +19,6 @@ version: '1.0'
 author: mahipal
 license: Apache-2.0
 nist_csf:
- RS.AN-01
 - RS.AN-03
 - DE.AE-02
 - RS.MA-01
@@ -1,8 +1,10 @@
 ---
 name: analyzing-linux-system-artifacts
-description: Examine Linux system artifacts including auth logs, cron jobs, shell
-  history, and system configuration to uncover evidence of compromise or unauthorized
-  activity.
+description: Examine Linux system artifacts (auth logs, cron/systemd persistence,
+  shell history, SSH keys, and system configuration) to uncover evidence of compromise,
+  detect rootkits or backdoors, and reconstruct user/attacker activity. Use when
+  investigating a compromised Linux server or workstation, hunting for persistence
+  mechanisms, or scoping a Linux-based breach during incident response.
 domain: cybersecurity
 subdomain: digital-forensics
 tags:
@@ -16,7 +18,6 @@ version: '1.0'
 author: mahipal
 license: Apache-2.0
 nist_csf:
- RS.AN-01
 - RS.AN-03
 - DE.AE-02
 - RS.MA-01
@@ -1,8 +1,11 @@
 ---
 name: analyzing-lnk-file-and-jump-list-artifacts
-description: Analyze Windows LNK shortcut files and Jump List artifacts to establish
-  evidence of file access, program execution, and user activity using LECmd, JLECmd,
-  and manual binary parsing of the Shell Link Binary format.
+description: Analyze Windows LNK shortcut files and Jump List artifacts with LECmd,
+  JLECmd, and manual Shell Link Binary Format parsing to establish evidence of file
+  access, program execution, and user activity that persists even after the target
+  file is deleted. Use when investigating Windows user activity, reconstructing file-access
+  or program-execution timelines, or examining recent/frequently-used file evidence
+  in a forensic exam.
 domain: cybersecurity
 subdomain: digital-forensics
 tags:
@@ -20,7 +23,6 @@ version: '1.0'
 author: mahipal
 license: Apache-2.0
 nist_csf:
- RS.AN-01
 - RS.AN-03
 - DE.AE-02
 - RS.MA-01
@@ -2,6 +2,9 @@
 name: analyzing-malicious-pdf-with-peepdf
 description: Perform static analysis of malicious PDF documents using peepdf, pdfid,
  and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects.
+  Use when triaging a suspicious PDF attachment from a phishing email, analyzing a
+  PDF-based exploit document, or building detection signatures for weaponized PDF
+  threats.
 domain: cybersecurity
 subdomain: malware-analysis
 tags:
@@ -1,10 +1,11 @@
 ---
 name: analyzing-malware-behavior-with-cuckoo-sandbox
-description: 'Executes malware samples in Cuckoo Sandbox to observe runtime behavior
-  including process creation, file system modifications, registry changes, network
-  communications, and API calls. Generates comprehensive behavioral reports for malware
-  classification and IOC extraction. Activates for requests involving dynamic malware
-  analysis, sandbox detonation, behavioral analysis, or automated malware execution.
+description: 'Detonate malware samples in Cuckoo Sandbox to observe runtime behavior
+  — process creation, file system and registry changes, network communications,
+  and API calls — and generate behavioral reports for classification and IOC extraction.
+  Use when a sample has passed static triage and needs dynamic/behavioral analysis,
+  when mapping a full infection chain, or when building YARA/behavioral signatures
+  from observed sandbox activity.

  '
 domain: cybersecurity
@@ -1,8 +1,10 @@
 ---
 name: analyzing-malware-family-relationships-with-malpedia
-description: Use the Malpedia platform and API to research malware family relationships,
-  track variant evolution, link families to threat actors, and integrate YARA rules
-  for detection across malware lineages.
+description: Query the Malpedia API to look up malware family aliases and naming
+  (platform.family_name), pull community/vendor YARA rules, link families to threat
+  actors, and map family relationships such as loader-payload chains and shared authorship.
+  Use when researching a malware family's aliases, lineage, or actor attribution,
+  or when sourcing YARA rules for detection.
 domain: cybersecurity
 subdomain: threat-intelligence
 tags:
@@ -1,8 +1,10 @@
 ---
 name: analyzing-malware-persistence-with-autoruns
-description: Use Sysinternals Autoruns to systematically identify and analyze malware
-  persistence mechanisms across registry keys, scheduled tasks, services, drivers,
-  and startup locations on Windows systems.
+description: Use Sysinternals Autoruns to systematically enumerate and analyze malware
+  persistence mechanisms across Windows registry run keys, scheduled tasks, services,
+  drivers, and startup locations. Use when hunting for persistence during Windows
+  incident response, triaging a compromised endpoint, or validating that malware
+  autostart entries have been fully identified and removed.
 domain: cybersecurity
 subdomain: malware-analysis
 tags:
@@ -1,8 +1,10 @@
 ---
 name: analyzing-malware-sandbox-evasion-techniques
-description: Detect sandbox evasion techniques in malware samples by analyzing timing
-  checks, VM artifact queries, user interaction detection, and sleep inflation patterns
-  from Cuckoo/AnyRun behavioral reports
+description: Detect sandbox and VM evasion techniques in malware samples by analyzing
+  timing checks, VM/hypervisor artifact queries, user-interaction checks, and sleep-inflation
+  patterns from Cuckoo or AnyRun behavioral reports. Use when a sample shows no or
+  minimal activity in a sandbox, when a behavioral report needs review for evasion
+  indicators, or when building detections for anti-analysis techniques.
 domain: cybersecurity
 subdomain: malware-analysis
 tags:
@@ -1,8 +1,10 @@
 ---
 name: analyzing-mft-for-deleted-file-recovery
-description: Analyze the NTFS Master File Table ($MFT) to recover metadata and content
-  of deleted files by examining MFT record entries, $LogFile, $UsnJrnl, and MFT slack
-  space using MFTECmd, analyzeMFT, and X-Ways Forensics.
+description: Analyze the NTFS Master File Table ($MFT) with MFTECmd, analyzeMFT,
+  and X-Ways Forensics to recover metadata and content of deleted files by examining
+  MFT record entries, $LogFile, $UsnJrnl, and MFT slack space. Use when recovering
+  evidence of deleted files, reconstructing NTFS file-system timelines, or detecting
+  anti-forensic timestomping during a Windows forensic examination.
 domain: cybersecurity
 subdomain: digital-forensics
 tags:
@@ -20,7 +22,6 @@ version: '1.0'
 author: mahipal
 license: Apache-2.0
 nist_csf:
- RS.AN-01
 - RS.AN-03
 - DE.AE-02
 - RS.MA-01
@@ -1,8 +1,10 @@
 ---
 name: analyzing-network-covert-channels-in-malware
-description: Detect and analyze covert communication channels used by malware including
-  DNS tunneling, ICMP exfiltration, steganographic HTTP, and protocol abuse for C2
-  and data exfiltration.
+description: Detect and analyze covert communication channels used by malware, including
+  DNS tunneling, ICMP exfiltration, steganographic HTTP, and other protocol abuse
+  used for C2 and data exfiltration. Use when investigating suspicious DNS/ICMP/HTTP
+  traffic patterns, hunting for hidden C2 channels in network captures, or attributing
+  exfiltration traffic to a known tunneling toolset.
 domain: cybersecurity
 subdomain: malware-analysis
 tags:
@@ -1,8 +1,6 @@
 ---
 name: analyzing-network-packets-with-scapy
-description: Craft, send, sniff, and dissect network packets using Scapy for protocol
-  analysis, network reconnaissance, and traffic anomaly detection in authorized security
-  testing
+description: Use Scapy to craft, send, sniff, and dissect TCP/UDP/ICMP/DNS packets, analyze pcap files, implement SYN scans, and detect anomalous traffic such as fragmented or malformed packets. Use when performing authorized network reconnaissance, protocol-level forensic analysis, or building traffic anomaly detection during security testing.
 domain: cybersecurity
 subdomain: network-security
 tags:
@@ -1,9 +1,6 @@
 ---
 name: analyzing-outlook-pst-for-email-forensics
-description: Analyze Microsoft Outlook PST and OST files for email forensic evidence
-  including message content, headers, attachments, deleted items, and metadata using
-  libpff, pst-utils, and forensic email analysis tools for legal investigations and
-  incident response.
+description: Parse Microsoft Outlook PST and OST files using libpff and pst-utils to extract message content, headers, attachments, deleted items, and MAPI metadata, including recovery of items from the Recoverable Items folder. Use when conducting email forensic investigations, legal e-discovery, or incident response that requires reconstructing communication patterns or tracing message routing from Outlook archives.
 domain: cybersecurity
 subdomain: digital-forensics
 tags:
@@ -25,7 +22,6 @@ nist_ai_rmf:
 - MANAGE-3.1
 - MEASURE-3.1
 nist_csf:
- RS.AN-01
 - RS.AN-03
 - DE.AE-02
 - RS.MA-01
@@ -1,10 +1,6 @@
 ---
 name: analyzing-packed-malware-with-upx-unpacker
-description: 'Identifies and unpacks UPX-packed and other packed malware samples to
-  expose the original executable code for static analysis. Covers both standard UPX
-  unpacking and handling modified UPX headers that prevent automated decompression.
-  Activates for requests involving malware unpacking, UPX decompression, packer removal,
-  or preparing packed samples for analysis.
+description: 'Identifies and unpacks UPX-packed malware samples, including binaries with modified UPX magic bytes or headers that block automated decompression, to recover the original executable for static analysis. Use when a sample shows high entropy, minimal imports, or only LoadLibrary/GetProcAddress in its import table, or when preparing a packed binary for disassembly in Ghidra or IDA.

  '
 domain: cybersecurity
@@ -1,8 +1,6 @@
 ---
 name: analyzing-persistence-mechanisms-in-linux
-description: Detect and analyze Linux persistence mechanisms including crontab entries,
-  systemd service units, LD_PRELOAD hijacking, bashrc modifications, and authorized_keys
-  backdoors using auditd and file integrity monitoring
+description: Scan Linux systems for persistence mechanisms including crontab/systemd entries, LD_PRELOAD injection, shell profile modifications (.bashrc, .profile), and SSH authorized_keys backdoors, then correlate findings with auditd logs into an installation timeline. Use during incident response or threat hunting to detect or confirm how an adversary maintained access to a compromised Linux host.
 domain: cybersecurity
 subdomain: threat-hunting
 tags:
@@ -1,8 +1,6 @@
 ---
 name: analyzing-powershell-empire-artifacts
-description: Detect PowerShell Empire framework artifacts in Windows event logs by
-  identifying Base64 encoded launcher patterns, default user agents, staging URL structures,
-  stager IOCs, and known Empire module signatures in Script Block Logging events.
+description: Detect PowerShell Empire post-exploitation framework artifacts in Windows Script Block Logging (Event ID 4104) and Module Logging (Event ID 4103), including the default launcher string, Base64-encoded WebClient/FromBase64String payloads, known module invocations (Invoke-Mimikatz, Invoke-Kerberoast), and staging URL patterns. Use when hunting for or confirming Empire C2 activity in Windows event logs.
 domain: cybersecurity
 subdomain: threat-hunting
 tags:
@@ -1,7 +1,6 @@
 ---
 name: analyzing-prefetch-files-for-execution-history
-description: Parse Windows Prefetch files to determine program execution history including
-  run counts, timestamps, and referenced files for forensic investigation.
+description: Parse Windows Prefetch files (versions 17, 23, 26, 30) with tools like PECmd, WinPrefetchView, or python-prefetch to determine program execution history, including run counts, execution timestamps, and referenced files/DLLs. Use when building a timeline of program execution on a Windows system, confirming whether a suspicious binary ran, or correlating execution evidence with other forensic artifacts during an investigation.
 domain: cybersecurity
 subdomain: digital-forensics
 tags:
@@ -15,7 +14,6 @@ version: '1.0'
 author: mahipal
 license: Apache-2.0
 nist_csf:
- RS.AN-01
 - RS.AN-03
 - DE.AE-02
 - RS.MA-01
@@ -1,8 +1,6 @@
 ---
 name: analyzing-ransomware-leak-site-intelligence
-description: Monitor and analyze ransomware group data leak sites (DLS) to track victim
-  postings, extract threat intelligence on group tactics, and assess sector-specific
-  ransomware risk for proactive defense.
+description: Safely monitor ransomware group Tor-hosted data leak sites (DLS) to collect and extract structured victim posting data, track group activity trends over time, and produce sector- and geography-specific ransomware risk assessments. Use when performing threat intelligence gathering on active ransomware groups or building proactive defense reporting from double-extortion leak-site activity.
 domain: cybersecurity
 subdomain: threat-intelligence
 tags:
@@ -1,8 +1,6 @@
 ---
 name: analyzing-ransomware-network-indicators
-description: Identify ransomware network indicators including C2 beaconing patterns,
-  TOR exit node connections, data exfiltration flows, and encryption key exchange
-  via Zeek conn.log and NetFlow analysis
+description: Identify ransomware-related network indicators, including C2 beaconing patterns, TOR exit node connections, data exfiltration flows, and encryption key exchange, by analyzing Zeek conn.log and NetFlow data. Use when threat hunting for active ransomware network activity or investigating suspected pre-encryption exfiltration during incident response.
 domain: cybersecurity
 subdomain: threat-hunting
 tags:
@@ -1,11 +1,6 @@
 ---
 name: analyzing-ransomware-payment-wallets
-description: 'Traces ransomware cryptocurrency payment flows using blockchain analysis
-  tools such as Chainalysis Reactor, WalletExplorer, and blockchain.com APIs. Identifies
-  wallet clusters, tracks fund movement through mixers and exchanges, and supports
-  law enforcement attribution. Activates for requests involving ransomware payment
-  tracing, bitcoin wallet analysis, cryptocurrency forensics, or blockchain intelligence
-  gathering.
+description: 'Traces ransomware cryptocurrency payment flows using blockchain analysis tools such as Chainalysis Reactor, WalletExplorer, and blockchain.com APIs, identifying wallet clusters and tracking fund movement through mixers and exchanges to support law enforcement attribution. Use when tracing ransomware bitcoin payments, performing cryptocurrency wallet forensics, or gathering blockchain threat intelligence on extortion payments.

  '
 domain: cybersecurity
@@ -26,7 +26,6 @@ author: mukul975
 license: Apache-2.0
 atlas_techniques:
 - AML.T0010
- AML.T0104
 nist_ai_rmf:
 - GOVERN-5.2
 - MAP-1.6
@@ -1,7 +1,6 @@
 ---
 name: analyzing-slack-space-and-file-system-artifacts
-description: Examine file system slack space, MFT entries, USN journal, and alternate
-  data streams to recover hidden data and reconstruct file activity on NTFS volumes.
+description: Examine NTFS slack space, MFT entries, the USN Change Journal, and Alternate Data Streams (ADS) to recover hidden or residual data, reconstruct deleted-file metadata, and reconstruct available file-system change activity from USN records. Use during deep forensic analysis of an NTFS image when standard file recovery is insufficient, such as hunting for data hidden in ADS.
 domain: cybersecurity
 subdomain: digital-forensics
 tags:
@@ -16,7 +15,6 @@ version: '1.0'
 author: mahipal
 license: Apache-2.0
 nist_csf:
- RS.AN-01
 - RS.AN-03
 - DE.AE-02
 - RS.MA-01
@@ -18,7 +18,6 @@ author: mahipal
 license: Apache-2.0
 atlas_techniques:
 - AML.T0010
- AML.T0104
 nist_ai_rmf:
 - GOVERN-5.2
 - MAP-1.6
@@ -1,8 +1,6 @@
 ---
 name: analyzing-threat-actor-ttps-with-mitre-attack
-description: MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics,
-  techniques, and procedures (TTPs) based on real-world observations. This skill covers
-  systematically mapping threat actor beh
+description: Systematically map threat actor behavior and observed IOCs to the MITRE ATT&CK framework, build technique coverage heatmaps with the ATT&CK Navigator, identify detection gaps, and produce actionable threat intelligence reports across the Enterprise, Mobile, and ICS matrices. Use when analyzing threat actor TTPs, correlating IOCs to specific ATT&CK techniques, or assessing defensive detection coverage against adversary behavior.
 domain: cybersecurity
 subdomain: threat-intelligence
 tags:
@@ -1,11 +1,6 @@
 ---
 name: analyzing-threat-actor-ttps-with-mitre-navigator
-description: 'Map advanced persistent threat (APT) group tactics, techniques, and
-  procedures (TTPs) to the MITRE ATT&CK framework using the ATT&CK Navigator and attackcti
-  Python library. The analyst queries STIX/TAXII data for group-technique associations,
-  generates Navigator layer files for visualization, and compares defensive coverage
-  against adversary profiles. Activates for requests involving APT TTP mapping, ATT&CK
-  Navigator layers, threat actor profiling, or MITRE technique coverage analysis.
+description: 'Map advanced persistent threat (APT) group TTPs to the MITRE ATT&CK framework using the attackcti Python library to query STIX/TAXII data for group-technique associations, then generate ATT&CK Navigator layer files to visualize and compare defensive coverage against adversary profiles. Use when profiling an APT group''s techniques, building Navigator coverage heatmaps, or assessing technique coverage gaps against a specific threat actor.

  '
 domain: cybersecurity
@@ -1,10 +1,10 @@
 ---
 name: analyzing-threat-landscape-with-misp
-description: Analyze the threat landscape using MISP (Malware Information Sharing
-  Platform) by querying event statistics, attribute distributions, threat actor galaxy
-  clusters, and tag trends over time. Uses PyMISP to pull event data, compute IOC
-  type breakdowns, identify top threat actors and malware families, and generate threat
-  landscape reports with temporal trends.
+description: Query a MISP (Malware Information Sharing Platform) instance via PyMISP
+  to compute event statistics, IOC type breakdowns, threat actor galaxy clusters,
+  and tag trends, and generate threat landscape reports with temporal trends. Use
+  when asked to analyze threat intelligence data, summarize top threat actors or
+  malware families, or produce a CTI landscape report from MISP events.
 domain: cybersecurity
 subdomain: threat-intelligence
 tags:
@@ -1,8 +1,9 @@
 ---
 name: analyzing-typosquatting-domains-with-dnstwist
-description: Detect typosquatting, homograph phishing, and brand impersonation domains
-  using dnstwist to generate domain permutations and identify registered lookalike
-  domains targeting your organization.
+description: Generate domain permutations with dnstwist and check DNS resolution
+  to detect typosquatting, homograph phishing, and brand impersonation domains registered
+  against your organization. Use when asked to monitor for lookalike domains, investigate
+  a phishing domain, or assess brand-impersonation risk.
 domain: cybersecurity
 subdomain: threat-intelligence
 tags:
@@ -1,12 +1,10 @@
 ---
 name: analyzing-uefi-bootkit-persistence
-description: 'Analyzes UEFI bootkit persistence mechanisms including firmware implants
-  in SPI flash, EFI System Partition (ESP) modifications, Secure Boot bypass techniques,
-  and UEFI variable manipulation. Covers detection of known bootkit families (BlackLotus,
-  LoJax, MosaicRegressor, MoonBounce, CosmicStrand), ESP partition forensic inspection,
-  chipsec-based firmware integrity verification, and Secure Boot configuration auditing.
-  Activates for requests involving UEFI malware analysis, firmware persistence investigation,
-  boot chain integrity verification, or Secure Boot bypass detection.
+description: 'Analyzes UEFI bootkit persistence (SPI flash implants, ESP modifications,
+  Secure Boot bypass, UEFI variable manipulation) using chipsec for firmware integrity
+  verification, detecting known families like BlackLotus, LoJax, and MoonBounce.
+  Use for UEFI malware analysis, firmware persistence investigation, or Secure Boot
+  bypass detection.

  '
 domain: cybersecurity
@@ -1,7 +1,9 @@
 ---
 name: analyzing-usb-device-connection-history
-description: Investigate USB device connection history from Windows registry, event
-  logs, and setupapi logs to track removable media usage and potential data exfiltration.
+description: Correlate Windows registry keys (USBSTOR, MountedDevices), Event Logs,
+  and setupapi.dev.log to reconstruct USB device connection history, first/last-plugged
+  timestamps, and drive letter mappings. Use when investigating removable media usage,
+  tracking device provenance, or building a timeline for suspected data exfiltration.
 domain: cybersecurity
 subdomain: digital-forensics
 tags:
@@ -15,7 +17,6 @@ version: '1.0'
 author: mahipal
 license: Apache-2.0
 nist_csf:
- RS.AN-01
 - RS.AN-03
 - DE.AE-02
 - RS.MA-01
@@ -1,12 +1,10 @@
 ---
 name: analyzing-windows-amcache-artifacts
-description: 'Parses and analyzes the Windows Amcache.hve registry hive to extract
-  evidence of program execution, application installation, and driver loading for
-  digital forensics investigations. Uses Eric Zimmerman''s AmcacheParser and Timeline
-  Explorer for artifact extraction, SHA-1 hash correlation with threat intel, and
-  timeline reconstruction. Activates for requests involving Amcache forensics, program
-  execution evidence, Windows artifact analysis, or application compatibility cache
-  investigation.
+description: 'Parses the Windows Amcache.hve registry hive with Eric Zimmerman''s
+  AmcacheParser and Timeline Explorer to extract evidence of program execution, application
+  installation, and driver loading, including SHA-1 hash correlation with threat
+  intel and timeline reconstruction. Use for Amcache forensics, program execution
+  evidence gathering, or application compatibility cache investigations in DFIR work.

  '
 domain: cybersecurity
@@ -23,7 +21,6 @@ version: 1.0.0
 author: mahipal
 license: Apache-2.0
 nist_csf:
- RS.AN-01
 - RS.AN-03
 - DE.AE-02
 - RS.MA-01
@@ -1,7 +1,9 @@
 ---
 name: analyzing-windows-lnk-files-for-artifacts
-description: Parse Windows LNK shortcut files to extract target paths, timestamps,
-  volume information, and machine identifiers for forensic timeline reconstruction.
+description: Parse Windows LNK shortcut files to extract target paths, MAC timestamps,
+  volume serial numbers, and machine identifiers for forensic timeline reconstruction.
+  Use when investigating recently-accessed files, tracking removable media or network
+  paths referenced by shortcuts, or building a DFIR timeline from LNK artifacts.
 domain: cybersecurity
 subdomain: digital-forensics
 tags:
@@ -15,7 +17,6 @@ version: '1.0'
 author: mahipal
 license: Apache-2.0
 nist_csf:
- RS.AN-01
 - RS.AN-03
 - DE.AE-02
 - RS.MA-01
@@ -1,8 +1,10 @@
 ---
 name: analyzing-windows-prefetch-with-python
-description: Parse Windows Prefetch files using the windowsprefetch Python library
-  to reconstruct application execution history, detect renamed or masquerading binaries,
-  and identify suspicious program execution patterns.
+description: Parse Windows Prefetch (.pf) files with the windowsprefetch Python
+  library to reconstruct application execution history, run counts, and accessed
+  file/volume lists. Use when investigating renamed or masquerading binaries, verifying
+  program execution timelines, or hunting for suspicious execution patterns in incident
+  response.
 domain: cybersecurity
 subdomain: digital-forensics
 tags:
@@ -22,7 +24,6 @@ version: '1.0'
 author: mahipal
 license: Apache-2.0
 nist_csf:
- RS.AN-01
 - RS.AN-03
 - DE.AE-02
 - RS.MA-01
@@ -1,7 +1,10 @@
 ---
 name: analyzing-windows-registry-for-artifacts
-description: Extract and analyze Windows Registry hives to uncover user activity,
-  installed software, autostart entries, and evidence of system compromise.
+description: Extract and analyze Windows Registry hives with tools like RegRipper
+  and Registry Explorer to uncover user activity, installed software, autostart/persistence
+  entries, and evidence of system compromise. Use when investigating registry-based
+  persistence, reconstructing user or system activity, or performing DFIR triage
+  on a Windows image.
 domain: cybersecurity
 subdomain: digital-forensics
 tags:
@@ -15,7 +18,6 @@ version: '1.0'
 author: mahipal
 license: Apache-2.0
 nist_csf:
- RS.AN-01
 - RS.AN-03
 - DE.AE-02
 - RS.MA-01
@@ -1,8 +1,10 @@
 ---
 name: analyzing-windows-shellbag-artifacts
-description: Analyze Windows Shellbag registry artifacts to reconstruct folder browsing
-  activity, detect access to removable media and network shares, and establish user
-  interaction with directories even after deletion using SBECmd and ShellBags Explorer.
+description: Analyze Windows Shellbag (BagMRU) registry artifacts with SBECmd and
+  Shellbags Explorer to reconstruct folder browsing activity and prove user interaction
+  with directories, including removable media and network shares, even after the
+  folders are deleted. Use when reconstructing a user's folder access history or
+  proving access to a since-removed directory in DFIR work.
 domain: cybersecurity
 subdomain: digital-forensics
 tags:
@@ -20,7 +22,6 @@ version: '1.0'
 author: mahipal
 license: Apache-2.0
 nist_csf:
- RS.AN-01
 - RS.AN-03
 - DE.AE-02
 - RS.MA-01
@@ -1,6 +1,9 @@
 ---
 name: assessing-vector-and-embedding-weaknesses
-description: Test vector stores for embedding inversion, cross-tenant leakage, and poisoning.
+description: Test RAG vector stores (Pinecone, Qdrant, Weaviate, Chroma, pgvector,
+  FAISS) for embedding inversion, cross-tenant data leakage, and data poisoning per
+  OWASP LLM08:2025. Use when performing an authorized security assessment of a RAG
+  pipeline's retrieval layer or auditing multi-tenant vector-store isolation.
 domain: cybersecurity
 subdomain: ai-security
 tags:
@@ -15,9 +18,9 @@ tags:
 version: '1.0'
 author: mahipal
 license: Apache-2.0
-nist_csf:
+nist_ai_rmf:
 - MEASURE-2.7
-mitre_attack:
+atlas_techniques:
 - AML.T0024
 ---
 # Assessing Vector and Embedding Weaknesses
@@ -1,6 +1,10 @@
 ---
 name: attacking-entra-id-with-roadtools
-description: Enumerate Entra ID with ROADrecon and acquire and exchange tokens with roadtx.
+description: Enumerate Microsoft Entra ID (Azure AD) tenants with ROADrecon and
+  acquire, exchange, and abuse tokens (including primary refresh tokens) with roadtx.
+  Use for authorized red-team enumeration of a tenant's directory objects or for
+  token-based identity attacks against Entra ID you are explicitly authorized to
+  test.
 domain: cybersecurity
 subdomain: identity-access-management
 tags:
@@ -1,6 +1,10 @@
 ---
 name: attacking-oauth-with-device-code-phishing
-description: Run OAuth 2.0 device-code and illicit-consent phishing against Microsoft Entra ID to steal access and refresh tokens, bypass MFA, and pivot across Microsoft 365 services.
+description: Run OAuth 2.0 device-code and illicit-consent phishing attacks against
+  Microsoft Entra ID, using TokenTactics-style tooling to steal access and refresh
+  tokens, bypass MFA, and pivot across Microsoft 365 services. Use for authorized
+  red-team engagements simulating device-code or consent-grant phishing against a
+  tenant you have explicit written permission to test.
 domain: cybersecurity
 subdomain: identity-access-management
 tags:
@@ -1,12 +1,6 @@
 ---
 name: auditing-cloud-with-cis-benchmarks
-description: 'This skill details how to conduct cloud security audits using Center
-  for Internet Security benchmarks for AWS, Azure, and GCP. It covers interpreting
-  CIS Foundations Benchmark controls, running automated assessments with tools like
-  Prowler and ScoutSuite, remediating failed controls, and maintaining continuous
-  compliance monitoring against CIS v5 for AWS, v4 for Azure, and v4 for GCP.
-
-  '
+description: Audit AWS, Azure, and GCP environments against the CIS Foundations Benchmarks by running automated scans with tools like Prowler and ScoutSuite, interpreting failed controls, and tracking remediation for continuous compliance. Use when conducting a cloud security audit, validating CIS benchmark compliance (CIS v5 AWS, v4 Azure, v4 GCP), or setting up continuous cloud compliance monitoring.
 domain: cybersecurity
 subdomain: cloud-security
 tags:
@@ -1,6 +1,6 @@
 ---
 name: auditing-entra-id-with-aadinternals
-description: Run Microsoft Entra ID tenant reconnaissance, token acquisition and manipulation, and federation backdoor testing with the AADInternals PowerShell toolkit to validate identity-attack resilience.
+description: Drive the AADInternals PowerShell toolkit to perform Microsoft Entra ID tenant reconnaissance, access-token acquisition across Microsoft APIs, and federation/AD FS backdoor testing (Golden SAML, T1606.002) for defensive validation. Use during an authorized Entra ID/Microsoft 365 red-team assessment to map external attack surface or verify AD FS signing certs resist Golden SAML.
 domain: cybersecurity
 subdomain: identity-access-management
 tags:
@@ -1,6 +1,6 @@
 ---
 name: auditing-mcp-servers-for-tool-poisoning
-description: Scan Model Context Protocol servers and tool metadata for poisoning, SSRF, and unauthenticated exposure.
+description: Audit MCP servers for tool poisoning, tool shadowing, rug pulls, SSRF, and unauthenticated exposure using Invariant Labs' mcp-scan for static/runtime scanning plus manual SSRF/auth checks and description pinning. Use before adding a new MCP server to an agent stack, when reviewing an internal MCP server, detecting rug pulls, or investigating an agent's unexpected tool-driven behavior.
 domain: cybersecurity
 subdomain: ai-security
 tags:
@@ -15,9 +15,9 @@ tags:
 version: '1.0'
 author: mahipal
 license: Apache-2.0
-nist_csf:
+nist_ai_rmf:
 - MANAGE-2.2
-mitre_attack:
+atlas_techniques:
 - AML.T0010
 ---
 # Auditing MCP Servers for Tool Poisoning
@@ -1,6 +1,6 @@
 ---
 name: benchmarking-kubernetes-with-kube-bench
-description: Run CIS Kubernetes Benchmark checks and remediate findings with kube-bench.
+description: Run kube-bench (Aqua Security) against a Kubernetes cluster's control-plane, kubelet, and node configuration to check compliance with the CIS Kubernetes Benchmark and remediate PASS/FAIL/WARN findings. Use when establishing a security baseline for a new cluster, performing periodic hardening audits, validating remediation after configuration changes, or gathering compliance evidence for SOC 2/PCI DSS.
 domain: cybersecurity
 subdomain: container-security
 tags:
@@ -1,8 +1,6 @@
 ---
 name: building-adversary-infrastructure-tracking-system
-description: Build an automated system to track adversary infrastructure using passive
-  DNS, certificate transparency, WHOIS data, and IP enrichment to map and monitor
-  threat actor command-and-control networks.
+description: Build an automated adversary infrastructure tracking system in Python (dnspython, python-whois, shodan, networkx) that pivots across passive DNS, certificate transparency logs, WHOIS records, and IP enrichment to map threat-actor C2 networks and flag newly registered domains matching known patterns. Use when pivoting from known indicators to discover related C2 infrastructure or maintaining a continuously updated map of a threat actor's network.
 domain: cybersecurity
 subdomain: threat-intelligence
 tags:
@@ -1,8 +1,6 @@
 ---
 name: building-attack-pattern-library-from-cti-reports
-description: Extract and catalog attack patterns from cyber threat intelligence reports
-  into a structured STIX-based library mapped to MITRE ATT&CK for detection engineering
-  and threat-informed defense.
+description: Parse cyber threat intelligence reports (Mandiant, CrowdStrike, Talos, Microsoft) with stix2, mitreattack-python, and spaCy to extract adversary behaviors, map them to MITRE ATT&CK technique IDs, and build a searchable STIX 2.1 attack-pattern library with detection templates. Use when cataloging attack patterns from CTI reports for threat-informed detection engineering, or generating Sigma/YARA templates from documented behaviors.
 domain: cybersecurity
 subdomain: threat-intelligence
 tags:
@@ -1,8 +1,6 @@
 ---
 name: building-c2-infrastructure-with-sliver-framework
-description: Build and configure a resilient command-and-control infrastructure using
-  BishopFox's Sliver C2 framework with redirectors, HTTPS listeners, and multi-operator
-  support for authorized red team engagements.
+description: Deploy and harden a Sliver C2 team server (BishopFox's Go-based adversary emulation framework) with multi-protocol listeners (mTLS, HTTP/S, DNS, WireGuard), redirectors, domain fronting, and multi-operator support for authorized red-team operations. Use when standing up resilient C2 for a red-team engagement or generating beacon/session implants that must survive blue-team detection.
 domain: cybersecurity
 subdomain: red-teaming
 tags:
@@ -1,7 +1,6 @@
 ---
 name: building-c2-redirector-infrastructure
-description: Architect redirectors with nginx and Apache, malleable profiles, and OPSEC
-  for resilient C2.
+description: Build dumb-pipe and traffic-filtering C2 redirectors with nginx (proxy_pass) and Apache (mod_rewrite), deriving filter rules from a Malleable C2 profile, layering Let's Encrypt TLS, and applying OPSEC controls like domain fronting and UA/geo filtering. Use when standing up red-team C2 that must survive blue-team triage or ensuring only profile-matching implant traffic reaches the hidden team server.
 domain: cybersecurity
 subdomain: red-teaming
 tags:
@@ -1,12 +1,6 @@
 ---
 name: building-cloud-siem-with-sentinel
-description: 'This skill covers deploying Microsoft Sentinel as a cloud-native SIEM
-  and SOAR platform for centralized security operations. It details configuring data
-  connectors for multi-cloud log ingestion, writing KQL detection queries, building
-  automated response playbooks with Logic Apps, and leveraging the Sentinel data lake
-  for petabyte-scale threat hunting across AWS, Azure, and GCP security telemetry.
-
-  '
+description: Deploy Microsoft Sentinel as a cloud-native SIEM/SOAR by configuring multi-cloud data connectors (AWS, Azure, GCP), writing KQL detection and hunting queries, and building automated Logic Apps response playbooks. Use when establishing a centralized SOC for multi-cloud environments, migrating from a legacy SIEM, or performing petabyte-scale threat hunting; not for AWS-only setups where Security Hub/GuardDuty suffice or for endpoint EDR needs.
 domain: cybersecurity
 subdomain: cloud-security
 tags:
@@ -1,7 +1,6 @@
 ---
 name: building-devsecops-pipeline-with-gitlab-ci
-description: Design and implement a comprehensive DevSecOps pipeline in GitLab CI/CD
-  integrating SAST, DAST, container scanning, dependency scanning, and secret detection.
+description: Configure a GitLab CI/CD pipeline that embeds SAST (Semgrep, SpotBugs, Gosec, Bandit, NodeJsScan), DAST, container scanning, dependency scanning, and secret detection via GitLab's managed security templates. Use when building a shift-left DevSecOps pipeline in GitLab, adding automated vulnerability scanning stages to .gitlab-ci.yml, or triaging scanner findings with GitLab Duo AI before deployment.
 domain: cybersecurity
 subdomain: devsecops
 tags:
@@ -1,8 +1,6 @@
 ---
 name: building-identity-federation-with-saml-azure-ad
-description: Establish SAML 2.0 identity federation between on-premises Active Directory
-  and Azure AD (Microsoft Entra ID) for seamless cross-domain authentication and SSO
-  to cloud applications.
+description: Configure SAML 2.0 identity federation between on-premises Active Directory (via AD FS or a third-party IdP) and Microsoft Entra ID, covering federation models (AD FS, password hash sync, pass-through auth, third-party IdP) and the SAML authentication flow. Use when extending on-premises authentication authority to cloud resources or designing hybrid identity SSO architecture for Entra ID.
 domain: cybersecurity
 subdomain: identity-access-management
 tags:
@@ -1,12 +1,6 @@
 ---
 name: building-identity-governance-lifecycle-process
-description: 'Builds comprehensive identity governance and lifecycle management processes
-  including joiner-mover-leaver automation, role mining, access request workflows,
-  periodic recertification, and orphaned account remediation using IGA platforms.
-  Activates for requests involving identity lifecycle management, JML processes, role-based
-  access provisioning, or identity governance program design.
-
-  '
+description: Design identity governance and lifecycle (IGA) programs on platforms like SailPoint, Saviynt, or Entra ID Governance, covering joiner-mover-leaver (JML) automation, role mining, access requests, periodic recertification, and orphaned-account remediation sourced from an HR feed. Use when automating cross-system JML provisioning, remediating former-employee access, or building lifecycle processes for SOX, HIPAA, or GDPR compliance.
 domain: cybersecurity
 subdomain: identity-access-management
 tags:
@@ -1,13 +1,10 @@
 ---
 name: building-incident-response-playbook
-description: 'Designs and documents structured incident response playbooks that define
-  step-by-step procedures for specific incident types aligned with NIST SP 800-61r3
-  and SANS PICERL frameworks. Covers playbook structure, decision trees, escalation
-  criteria, RACI matrices, and integration with SOAR platforms. Activates for requests
-  involving IR playbook creation, incident response procedure documentation, response
-  runbook development, or SOAR playbook design.
-
-  '
+description: Designs and documents structured incident response playbooks with step-by-step
+  procedures per incident type, decision trees, escalation criteria, RACI matrices,
+  and SOAR platform integration, aligned to NIST SP 800-61r3 and SANS PICERL. Use
+  when creating or maturing an IR program, documenting response runbooks for a new
+  incident type, or designing SOAR playbooks.
 domain: cybersecurity
 subdomain: incident-response
 tags:
@@ -1,8 +1,10 @@
 ---
 name: building-incident-timeline-with-timesketch
 description: Build collaborative forensic incident timelines using Timesketch to ingest,
-  normalize, and analyze multi-source event data for attack chain reconstruction and
-  investigation documentation.
+  normalize, and analyze multi-source event data (including Plaso output) for attack
+  chain reconstruction and investigation documentation. Use when reconstructing the
+  sequence of events during an incident investigation or when multiple analysts need
+  to jointly tag, annotate, and search a shared DFIR timeline.
 domain: cybersecurity
 subdomain: incident-response
 tags:
@@ -1,8 +1,10 @@
 ---
 name: building-ioc-defanging-and-sharing-pipeline
-description: Build an automated pipeline to defang indicators of compromise (URLs,
-  IPs, domains, emails) for safe sharing and distribute them in STIX format through
-  TAXII feeds and threat intelligence platforms.
+description: Build an automated pipeline that ingests raw IOCs (URLs, IPs, domains,
+  emails), normalizes and deduplicates them, then produces defanged renderings for
+  safe human reading alongside canonical STIX 2.1 bundles distributed via TAXII servers,
+  MISP, or email reports. Use when preparing indicators of compromise for safe analyst
+  sharing or automating threat intel distribution to TAXII/MISP feeds.
 domain: cybersecurity
 subdomain: threat-intelligence
 tags:
@@ -1,8 +1,10 @@
 ---
 name: building-ioc-enrichment-pipeline-with-opencti
-description: OpenCTI is an open-source platform for managing cyber threat intelligence
-  knowledge, built on STIX 2.1 as its native data model. This skill covers building
-  an automated IOC enrichment pipeline using O
+description: Build an automated IOC enrichment pipeline on OpenCTI (STIX 2.1 native
+  threat intel platform) using its internal enrichment connectors to pull context
+  from VirusTotal, Shodan, AbuseIPDB, and GreyNoise, correlate indicators with known
+  actors/campaigns, and score them for analyst prioritization. Use when deploying
+  OpenCTI or automating enrichment and confidence scoring of newly ingested indicators.
 domain: cybersecurity
 subdomain: threat-intelligence
 tags:
@@ -1,8 +1,10 @@
 ---
 name: building-malware-incident-communication-template
-description: Build structured communication templates for malware incidents including
-  stakeholder notifications, executive briefings, technical advisories, and regulatory
-  disclosures with severity-based escalation procedures.
+description: Build structured communication templates for malware incidents (ransomware,
+  wiper, trojan, worm), covering internal stakeholder notifications, executive briefings,
+  technical advisories for IT teams, customer notifications, and regulatory disclosures,
+  with severity-based escalation procedures. Use when drafting or standardizing incident
+  communications and notification workflows for a malware outbreak.
 domain: cybersecurity
 subdomain: incident-response
 tags:
@@ -1,7 +1,10 @@
 ---
 name: building-patch-tuesday-response-process
-description: Establish a structured operational process to triage, test, and deploy
-  Microsoft Patch Tuesday security updates within risk-based remediation SLAs.
+description: Establish a repeatable operational process for triaging, testing, and
+  deploying Microsoft Patch Tuesday security updates (Windows, Office, Exchange, SQL
+  Server, Azure) via WSUS/SCCM within risk-based remediation SLAs, from advisory review
+  through validation. Use when building or improving a monthly patch management workflow
+  or prioritizing which CVEs to remediate first.
 domain: cybersecurity
 subdomain: vulnerability-management
 tags:
@@ -1,8 +1,10 @@
 ---
 name: building-phishing-reporting-button-workflow
-description: Implement a phishing report button in email clients with automated triage
-  workflow that analyzes user-reported suspicious emails and provides feedback to
-  reporters.
+description: Implement a phishing report button (Microsoft 365 built-in Report button
+  or third-party like KnowBe4/Cofense) in email clients with a SOAR-driven automated
+  triage workflow that classifies reported emails, extracts IOCs, takes remediation
+  actions, and gives feedback to reporters. Use when deploying user-reported phishing
+  intake or automating triage of the resulting reporting mailbox.
 domain: cybersecurity
 subdomain: phishing-defense
 tags:
@@ -1,12 +1,10 @@
 ---
 name: building-ransomware-playbook-with-cisa-framework
-description: 'Builds a structured ransomware incident response playbook aligned with
-  the CISA StopRansomware Guide and NIST Cybersecurity Framework. Covers preparation,
+description: Builds a structured ransomware incident response playbook aligned with
+  the CISA StopRansomware Guide and NIST Cybersecurity Framework, covering preparation,
  detection, containment, eradication, recovery, and post-incident phases with actionable
-  checklists. Activates for requests involving ransomware response planning, CISA
-  compliance, incident response playbook creation, or ransomware preparedness assessment.
-
-  '
+  checklists. Use when creating or updating a ransomware playbook, running a CISA-aligned
+  readiness assessment, or validating response steps during a tabletop exercise.
 domain: cybersecurity
 subdomain: ransomware-defense
 tags:
@@ -1,7 +1,10 @@
 ---
 name: building-red-team-c2-infrastructure-with-havoc
-description: Deploy and configure the Havoc C2 framework with teamserver, HTTPS listeners,
-  redirectors, and Demon agents for authorized red team operations.
+description: Deploy and configure the Havoc C2 framework (teamserver, HTTPS/HTTP/SMB
+  listeners, Nginx redirectors, and Demon agents) with malleable traffic profiles and
+  OPSEC-hardened infrastructure for authorized red team operations. Use when standing
+  up or hardening Havoc C2 infrastructure for a written, authorized adversary emulation
+  engagement.
 domain: cybersecurity
 subdomain: red-teaming
 tags:
@@ -1,8 +1,10 @@
 ---
 name: building-role-mining-for-rbac-optimization
-description: Apply bottom-up and top-down role mining techniques to discover optimal
-  RBAC roles from existing user-permission assignments, reducing role explosion and
-  enforcing least privilege.
+description: Apply bottom-up and top-down role mining techniques, including clustering
+  algorithms and formal concept analysis, to discover optimal RBAC roles from existing
+  user-permission assignments, consolidating overlapping roles and enforcing least
+  privilege. Use when an identity program needs to reduce role explosion or redesign
+  its RBAC role set from access data.
 domain: cybersecurity
 subdomain: identity-access-management
 tags:
@@ -1,7 +1,10 @@
 ---
 name: building-soc-escalation-matrix
 description: Build a structured SOC escalation matrix defining severity tiers, response
-  SLAs, escalation paths, and notification procedures for security incidents.
+  SLAs, tiered escalation paths, and notification procedures for security incidents,
+  using context-driven criteria that combine business risk, asset criticality, and
+  data sensitivity. Use when designing or revising how a SOC triages and escalates
+  incidents across analyst tiers.
 domain: cybersecurity
 subdomain: soc-operations
 tags:
@@ -1,6 +1,10 @@
 ---
 name: building-super-timelines-with-plaso
-description: Generate log2timeline and Plaso super-timelines and triage them in Timesketch.
+description: Generate forensic super-timelines with Plaso's log2timeline.py, pinfo.py,
+  psort.py, and psteal.py CLI tools (fusing file-system MACB, registry, EVTX, browser
+  history, prefetch, LNK, and more), then triage and filter the results in Timesketch.
+  Use when reconstructing the full sequence of events on a compromised or forensically
+  imaged host during a DFIR investigation.
 domain: cybersecurity
 subdomain: digital-forensics
 tags:
@@ -1,8 +1,6 @@
 ---
 name: building-threat-actor-profile-from-osint
-description: Build comprehensive threat actor profiles using open-source intelligence
-  (OSINT) techniques to document adversary motivations, capabilities, infrastructure,
-  and TTPs for proactive defense.
+description: Build threat actor profiles by collecting OSINT from vendor reports, paste sites, dark web forums, social media, and code repos, correlating indicators, mapping adversary infrastructure with tools like Maltego and SpiderFoot, and producing structured dossiers of motivations, capabilities, infrastructure, and TTPs. Use when performing attribution or building an adversary dossier from open-source intelligence.
 domain: cybersecurity
 subdomain: threat-intelligence
 tags:
@@ -1,8 +1,6 @@
 ---
 name: building-threat-feed-aggregation-with-misp
-description: Deploy MISP (Malware Information Sharing Platform) to aggregate, correlate,
-  and distribute threat intelligence feeds from multiple sources for centralized IOC
-  management and automated SIEM integration.
+description: Deploy MISP via Docker and configure feeds from sources like abuse.ch, AlienVault OTX, and CIRCL to aggregate, correlate, and distribute threat intelligence, including automated feed synchronization and STIX/TAXII-based integration with Splunk, Elasticsearch, and SOAR platforms. Use when standing up centralized IOC management or wiring multi-source threat feeds into a SIEM.
 domain: cybersecurity
 subdomain: threat-intelligence
 tags:
@@ -1,7 +1,6 @@
 ---
 name: building-threat-hunt-hypothesis-framework
-description: Build a systematic threat hunt hypothesis framework that transforms threat
-  intelligence, attack patterns, and environmental data into testable hunting hypotheses.
+description: Build a systematic threat-hunt workflow that turns threat intelligence and ATT&CK gap analysis into testable hypotheses, then executes and validates them via EDR/SIEM queries (CrowdStrike, Defender, Splunk, Elastic, Sysmon, Velociraptor, Sigma) and documents findings in a standardized hunt report. Use when planning or running a proactive threat hunt or scoping compromise from an intel- or anomaly-driven lead.
 domain: cybersecurity
 subdomain: threat-hunting
 tags:
@@ -1,7 +1,6 @@
 ---
 name: building-threat-intelligence-enrichment-in-splunk
-description: Build automated threat intelligence enrichment pipelines in Splunk Enterprise
-  Security using lookup tables, modular inputs, and the Threat Intelligence Framework.
+description: Build automated IOC enrichment pipelines in Splunk Enterprise Security by ingesting threat feeds into KV Store collections and correlating them against security events via lookup tables, modular inputs, and the Threat Intelligence Framework. Use when wiring threat intel into Splunk correlation searches to flag IOC matches and cut SOC triage time.
 domain: cybersecurity
 subdomain: soc-operations
 tags:
@@ -1,8 +1,6 @@
 ---
 name: building-threat-intelligence-platform
-description: Building a Threat Intelligence Platform (TIP) involves deploying and
-  integrating multiple CTI tools into a unified system for collecting, analyzing,
-  enriching, and disseminating threat intelligence. T
+description: Design and deploy a Threat Intelligence Platform (TIP) by integrating open-source CTI tools (MISP, OpenCTI, TheHive, Cortex) into a unified system with feed ingestion pipelines, enrichment workflows, STIX/TAXII interoperability, and analyst dashboards. Use when architecting or standing up a centralized CTI platform to collect, analyze, and disseminate threat intelligence across a security team.
 domain: cybersecurity
 subdomain: threat-intelligence
 tags:
@@ -1,7 +1,6 @@
 ---
 name: building-vulnerability-aging-and-sla-tracking
-description: Implement a vulnerability aging dashboard and SLA tracking system to
-  measure remediation performance against severity-based timelines and drive accountability.
+description: Implement a vulnerability aging dashboard and SLA tracking system that measures time-to-remediation against severity-based deadlines (e.g. 14 days critical, 30 days high, 60 days medium, 90 days low), with automated escalations and compliance metrics reporting. Use when designing SLA policies, building aging/remediation dashboards, or proving compliance with remediation timelines.
 domain: cybersecurity
 subdomain: vulnerability-management
 tags:
@@ -1,7 +1,6 @@
 ---
 name: building-vulnerability-dashboard-with-defectdojo
-description: Deploy DefectDojo as a centralized vulnerability management dashboard
-  with scanner integrations, deduplication, metrics tracking, and Jira ticketing workflows.
+description: Deploy DefectDojo as a centralized vulnerability management dashboard that ingests findings from 200+ security scanners, deduplicates results, tracks remediation metrics, and integrates with CI/CD, Jira ticketing, and Slack notifications via its REST API. Use when consolidating scanner output into one dashboard or automating vulnerability ticketing and executive reporting.
 domain: cybersecurity
 subdomain: vulnerability-management
 tags:
@@ -1,7 +1,6 @@
 ---
 name: building-vulnerability-exception-tracking-system
-description: Build a vulnerability exception and risk acceptance tracking system with
-  approval workflows, compensating controls documentation, and expiration management.
+description: Build a vulnerability exception and risk acceptance tracking system covering approval workflows, compensating controls documentation, and automatic expiration for vulnerabilities that miss SLA remediation timelines. Use when standing up a governance process for risk acceptance and exception approvals to support PCI DSS, SOC 2, or NIST CSF compliance.
 domain: cybersecurity
 subdomain: vulnerability-management
 tags:
@@ -1,6 +1,6 @@
 ---
 name: coercing-authentication-with-coercer-petitpotam
-description: Trigger machine account authentication with PetitPotam (MS-EFSR) and Coercer across MS-RPRN, MS-DFSNM, and MS-FSRVP to feed NTLM relay into AD CS Web Enrollment (ESC8) and other relay targets.
+description: Trigger machine account authentication with PetitPotam (MS-EFSR) and Coercer (MS-RPRN, MS-DFSNM, MS-FSRVP, MS-EVEN) via Coercer's scan/coerce/fuzz modes, feeding the coerced NTLM auth into a relay against AD CS Web Enrollment (ESC8), LDAP (RBCD), or SMB. Use in authorized engagements to complete a coercion-relay chain against a Domain Controller, or to validate coercion detections and signing/EPA mitigations.
 domain: cybersecurity
 subdomain: red-teaming
 tags:
@@ -1,8 +1,6 @@
 ---
 name: collecting-threat-intelligence-with-misp
-description: MISP (Malware Information Sharing Platform) is an open-source threat
-  intelligence platform for gathering, sharing, storing, and correlating Indicators
-  of Compromise (IOCs) of targeted attacks, threat
+description: Deploy MISP, configure threat feeds (MISP community, freetext, TAXII, CSV), and use the PyMISP API to programmatically fetch, add, and search events and IOCs, building automated collection pipelines that aggregate indicators from community and commercial sources. Use when gathering, storing, or correlating IOCs and threat intelligence, or when scripting MISP ingestion via PyMISP.
 domain: cybersecurity
 subdomain: threat-intelligence
 tags:
@@ -1,8 +1,6 @@
 ---
 name: collecting-volatile-evidence-from-compromised-host
-description: Collect volatile forensic evidence from a compromised system following
-  order of volatility, preserving memory, network connections, processes, and system
-  state before they are lost.
+description: Collect volatile forensic evidence from a compromised host by following the order of volatility, preserving memory, network connections, running processes, and system state with documented chain of custody before they are lost. Use before isolating, shutting down, or remediating a compromised host, especially when fileless or memory-resident malware is suspected, root cause analysis is needed, or the evidence must hold up in legal proceedings.
 domain: cybersecurity
 subdomain: incident-response
 tags:
@@ -1,11 +1,6 @@
 ---
 name: conducting-cloud-incident-response
-description: 'Responds to security incidents in cloud environments (AWS, Azure, GCP) by performing identity-based containment,
-  cloud-native log analysis, resource isolation, and forensic evidence acquisition adapted for ephemeral cloud infrastructure.
-  Activates for requests involving cloud incident response, AWS security incident, Azure compromise, GCP breach, cloud forensics,
-  or cloud identity compromise.
-
-  '
+description: Respond to security incidents in AWS, Azure, and GCP via identity-based containment, cloud-native log analysis (CloudTrail, Azure Activity Logs, GCP Audit Logs), resource isolation, and forensic evidence acquisition adapted for ephemeral cloud infrastructure. Use when CSPM alerts or audit logs show compromised cloud credentials, unauthorized IAM changes, or a breach spanning cloud services.
 domain: cybersecurity
 subdomain: incident-response
 tags:
@@ -1,8 +1,6 @@
 ---
 name: conducting-domain-persistence-with-dcsync
-description: Perform DCSync attacks to replicate Active Directory credentials and
-  establish domain persistence by extracting KRBTGT, Domain Admin, and service account
-  hashes for Golden Ticket creation.
+description: Perform DCSync attacks by abusing MS-DRSR replication rights (DS-Replication-Get-Changes/-All) to impersonate a Domain Controller and extract KRBTGT, Domain Admin, and service account hashes for Golden Ticket forging, typically with Mimikatz. Use in authorized engagements after finding principals with replication rights, to establish long-term domain persistence, or to validate detections for replication abuse.
 domain: cybersecurity
 subdomain: red-teaming
 tags:
@@ -1,14 +1,6 @@
 ---
 name: conducting-external-reconnaissance-with-osint
-description: 'Conducts external reconnaissance using Open Source Intelligence (OSINT)
-  techniques to map an organization''s external attack surface without directly interacting
-  with target systems. The tester gathers information from public sources including
-  DNS records, certificate transparency logs, search engines, social media, code repositories,
-  and data breach databases to build a comprehensive target profile. Activates for
-  requests involving OSINT reconnaissance, external footprinting, attack surface mapping,
-  or passive information gathering.
-
-  '
+description: Conduct external recon using OSINT techniques to map an organization's external attack surface without touching target systems, gathering DNS records, certificate transparency logs, search results, social media, code repositories, and breach databases into a target profile. Use for the passive info-gathering phase of a pentest, external footprinting, or collecting employee/email intel for a social engineering campaign.
 domain: cybersecurity
 subdomain: penetration-testing
 tags:
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
mukul975	e612f4944c	chore: auto-update index.json and skill count	2026-08-02 17:47:41 +00:00
Mahipal	d56fc0a7f9	Fix index.json generator to parse folded YAML descriptions The generator's `^description:\s*(.+)$` regex captured the block-scalar indicator (">-") instead of the wrapped text, corrupting 43 descriptions in index.json. Parse `>`/`\|` block scalars properly and regenerate (0 broken). Also refresh the count-update comment examples 754 -> 817.	2026-08-02 10:47:14 -07:00
Mahipal	2672b8eb12	Correct stale skill counts in docs to current 817 CITATION.cff 753 -> 817; ATTACK_COVERAGE.md 753+ -> 817; mappings/README.md "skills scanned" 742 -> 817; coverage-summary.md 753 -> 805 (ATT&CK-mapped).	2026-08-02 10:47:14 -07:00
Mahipal	507d911bec	README: correct framework claims/versions, add contributors section - Replace "every skill maps to six frameworks / six compliance checkboxes" with type-dependent mapping + accurate coverage line (ATT&CK 805, CSF 804, D3FEND 139, AI RMF 97, F3 94, ATLAS 93 of 817). - Update stale versions: ATLAS v5.4/84 -> 2026.07/101(+77 sub); D3FEND v1.3/267 -> v1.4.0/270; ATT&CK 754/754 -> 805/817, 286 -> 290 techniques; Enterprise tactic table 14 -> 15 (Defense Evasion split into Stealth TA0005 + Defense Impairment TA0112, verified against ATT&CK v19.1). - Fix broken nav anchor (#five-frameworks -> #six-frameworks). - Add "Thanks to our contributors" section with GitHub avatars.	2026-08-02 10:47:14 -07:00
Mahipal	88f408ada3	Correct agentskills.io validator/schema to match the standard The standard requires only name+description; additional top-level keys are permitted metadata. Fixes: - validator no longer counts extra top-level keys as violations (reports them as informational only). - angle-bracket check now ignores YAML block-scalar indicators (`>`, `>-`, `\|`), which were false-positiving on multi-line descriptions; no skill has genuine angle-bracket content. - schema additionalProperties false -> true to match. Audit result: 817/817 compliant.	2026-08-02 09:53:50 -07:00
mukul975	fbe6b12f21	chore: auto-update index.json and skill count	2026-08-02 16:32:37 +00:00
Mahipal	9bd6051d84	Add agentskills.io compliance schema and validator - tools/agentskills-skill.schema.json: strict JSON Schema for the agentskills.io SKILL.md frontmatter standard (name+description required; optional license/compatibility/metadata/allowed-tools; no other top-level keys). - tools/validate-agentskills.py: read-only compliance validator (also checks name==directory and the no-angle-brackets rule).	2026-08-02 09:32:13 -07:00
Mahipal	2fb6a9faff	Rewrite 548 skill descriptions to the activation rubric Each rewritten description now states both what the skill does (concrete capability, named tools/artifacts) and an explicit when-to-use trigger, improving agent discovery/activation. Grounded in each skill's own body; changes confined to the `description` field only (bodies and all other frontmatter untouched). Produced by a gated audit->rewrite->recheck loop (548 -> 0 flagged) with a sampled anti-invention check (0 ungrounded). Schema: 817/817 pass. Framework-ID gate: 0 defects.	2026-08-02 09:32:13 -07:00
mukul975	04a207702e	chore: auto-update index.json and skill count	2026-08-02 13:06:31 +00:00
Mahipal	2545b2d3d5	Fix framework-ID defects across 53 skills (grounded in authoritative data) Deterministic audit against vendored MITRE/NIST oracles (ATT&CK v19.1, ATLAS 2026.07, NIST CSF 2.0, D3FEND v1.4.0) found and fixed: - 27 wrong-framework leaks on 12 AI-security skills: ATLAS AML.* IDs were under `mitre_attack` (-> `atlas_techniques`) and AI-RMF GOVERN/MEASURE IDs under `nist_csf` (-> `nist_ai_rmf`). - RS.AN-01 -> RS.AN-03 on 37 forensics/incident-analysis skills (CSF 1.1 ID retired in CSF 2.0; RS.AN-03 is the incident-analysis successor). - PR.DS-06 -> PR.DS-01 on the SLSA/Sigstore provenance skill (CSF 1.1 ID absorbed into PR.DS-01 in CSF 2.0; body prose updated too). - AML.T0104 -> AML.T0010 on 3 software-supply-chain skills (T0104 is "Publish Poisoned AI Agent Tool" -- wrong topic; T0010 "AI Supply Chain Compromise" is correct). CSF/ATLAS replacements verified against NIST CSWP.29, the official CSF 1.1->2.0 transition workbook, and mitre-atlas/atlas-data. Framework-ID gate: 0 defects. Schema: 817/817 pass.	2026-08-02 06:00:54 -07:00
mukul975	673da1f3b0	Fix validator: register hardware-firmware-security subdomain, skip .bak dirs - Add hardware-firmware-security as a canonical subdomain (folding in the firmware-analysis/firmware-security aliases). The 4 new hardware/firmware skills failed validation because the subdomain was not in the allowed set. - Skip skills/*.bak/ backup directories in --all mode; they have no SKILL.md and were producing 21 false failures. - Result: validate-skill.py --all now reports 817/817 passing, exit 0.	2026-06-26 16:37:35 +02:00
mukul975	1f5cb12ac0	chore: auto-update index.json and skill count	2026-06-26 14:06:13 +00:00
MahipalandGitHub	f3a472b105	Merge pull request #85 from nyxst4ck/nyxst4ck/auto-quote-pip-extras-20260621-091605 docs: quote pip extras install examples	2026-06-26 16:06:02 +02:00
MahipalandGitHub	4e165f9a8d	Merge pull request #87 from ioxoi/fix/validator-and-disclaimers Fix validator nested-name misparse (94 false fails), unify with CI, add authorized-use banner	2026-06-26 16:05:40 +02:00
mukul975	768ca51c8d	chore: bump plugin version to v1.3.0	2026-06-22 17:11:46 +00:00
Homan AnsariandClaude Opus 4.8	5f5edbb30b	Fix validator nested-name misparse, unify with CI, add authorized-use banner Issues found in review: 1. tools/validate-skill.py: parse_frontmatter operated on the stripped line, so an indented nested `name:` (under framework-mapping lists, e.g. `name: 'Create Fake Materials: Fake Website'`) clobbered the skill's top-level `name`. That produced 94 spurious "invalid kebab-case name" failures out of 762. Now indented (non-list) key lines are ignored, so only top-level keys define frontmatter fields. Result: 762/762 pass. 2. Two divergent validators: the CI workflow had its own weaker inline parser (no subdomain/tag/description checks) requiring a different field set than tools/validate-skill.py. CI now delegates to tools/validate-skill.py --all (single source of truth); REQUIRED_FIELDS aligned to include version/author/license. The duplicate-name and stats steps are unchanged. 3. README: added an explicit authorized-&-lawful-use disclaimer next to the existing "not affiliated with Anthropic" note, since the library ships offensive/dual-use techniques. No skill content changed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-22 18:09:19 +02:00
nyxst4ck	40869a8c1c	docs: quote pip extras install examples	2026-06-21 09:16:20 -03:00