{ "schema_version": "0.1", "source_repo": "architectonic/skills", "source_ref": "a601a56cb2f9605b1c64ae90440da04d871c2fff", "summary": { "node_count": 1337, "leaf_count": 1266, "browse_default_visible": 96, "browse_default_hidden": 1170, "edge_count": 3 }, "nodes": [ { "id": "leaf:core:controlled-technical-writing", "kind": "leaf", "title": "Controlled Technical Writing", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "core/skills/controlled-technical-writing.md", "slug": "controlled-technical-writing" } }, { "id": "leaf:core:document-guided-organization-bootstrap", "kind": "leaf", "title": "Document-Guided Organization Bootstrap", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "core/skills/document-guided-organization-bootstrap.md", "slug": "document-guided-organization-bootstrap" } }, { "id": "leaf:core:source-grounding", "kind": "leaf", "title": "Source Grounding", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "core/skills/source-grounding.md", "slug": "source-grounding" } }, { "id": "leaf:core:assumption-grilling", "kind": "leaf", "title": "Assumption Grilling", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "core/skills/assumption-grilling.md", "slug": "assumption-grilling" } }, { "id": "leaf:core:agent-handoff", "kind": "leaf", "title": "Agent Handoff", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "core/skills/agent-handoff.md", "slug": "agent-handoff" } }, { "id": "leaf:core:architecture-review", "kind": "leaf", "title": "Architecture Review", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "core/skills/architecture-review.md", "slug": "architecture-review" } }, { "id": "group:core:grounding", "kind": "group", "title": "Grounding and collaboration", "children": [ "leaf:core:controlled-technical-writing", "leaf:core:document-guided-organization-bootstrap", "leaf:core:source-grounding", "leaf:core:assumption-grilling", "leaf:core:agent-handoff", "leaf:core:architecture-review" ] }, { "id": "leaf:core:adaptive-composition", "kind": "leaf", "title": "Adaptive Composition", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "core/skills/adaptive-composition.md", "slug": "adaptive-composition" } }, { "id": "leaf:core:knowledge-lifecycle-design", "kind": "leaf", "title": "Knowledge Lifecycle Design", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "core/skills/knowledge-lifecycle-design.md", "slug": "knowledge-lifecycle-design" } }, { "id": "leaf:core:source-first-wiki", "kind": "leaf", "title": "Source-First Wiki Compilation", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "core/skills/source-first-wiki.md", "slug": "source-first-wiki" } }, { "id": "leaf:core:second-brain-distillation", "kind": "leaf", "title": "Second-Brain Distillation", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "core/skills/second-brain-distillation.md", "slug": "second-brain-distillation" } }, { "id": "leaf:core:loop-engineering", "kind": "leaf", "title": "Loop Engineering", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "core/skills/loop-engineering.md", "slug": "loop-engineering" } }, { "id": "leaf:core:graph-projection", "kind": "leaf", "title": "Graph Projection", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "core/skills/graph-projection.md", "slug": "graph-projection" } }, { "id": "leaf:core:public-skill-adoption", "kind": "leaf", "title": "Public Skill Adoption", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "core/skills/public-skill-adoption.md", "slug": "public-skill-adoption" } }, { "id": "group:core:adaptive", "kind": "group", "title": "Adaptive systems", "children": [ "leaf:core:adaptive-composition", "leaf:core:knowledge-lifecycle-design", "leaf:core:source-first-wiki", "leaf:core:second-brain-distillation", "leaf:core:loop-engineering", "leaf:core:graph-projection", "leaf:core:public-skill-adoption" ] }, { "id": "section:reviewed-core", "kind": "section", "title": "Reviewed core", "children": [ "group:core:grounding", "group:core:adaptive" ], "description": "First-party reviewed procedures enumerated in core/manifest.json." }, { "id": "leaf:pack:marketing-top-50:brand-voice-guide", "kind": "leaf", "title": "Brand Voice Guide", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/marketing/marketing-brand.md", "slug": "brand-voice-guide" } }, { "id": "leaf:pack:marketing-top-50:institutional-copy-review", "kind": "leaf", "title": "Institutional Copy Review", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/marketing/marketing-brand.md", "slug": "institutional-copy-review" } }, { "id": "leaf:pack:marketing-top-50:social-media-strategy", "kind": "leaf", "title": "Social Media Strategy", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/marketing/marketing-brand.md", "slug": "social-media-strategy" } }, { "id": "leaf:pack:marketing-top-50:community-growth", "kind": "leaf", "title": "Community Growth", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/marketing/marketing-brand.md", "slug": "community-growth" } }, { "id": "leaf:pack:marketing-top-50:copy-consistency-audit", "kind": "leaf", "title": "Copy Consistency Audit", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/marketing/marketing-brand.md", "slug": "copy-consistency-audit" } }, { "id": "category:marketing-top-50:brand", "kind": "category", "title": "Brand", "children": [ "leaf:pack:marketing-top-50:brand-voice-guide", "leaf:pack:marketing-top-50:institutional-copy-review", "leaf:pack:marketing-top-50:social-media-strategy", "leaf:pack:marketing-top-50:community-growth", "leaf:pack:marketing-top-50:copy-consistency-audit" ] }, { "id": "leaf:pack:marketing-top-50:headline-formulas", "kind": "leaf", "title": "Headline Formulas", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/marketing/marketing-copy.md", "slug": "headline-formulas" } }, { "id": "leaf:pack:marketing-top-50:hero-section", "kind": "leaf", "title": "Hero Section Copy", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/marketing/marketing-copy.md", "slug": "hero-section" } }, { "id": "leaf:pack:marketing-top-50:landing-page-copy", "kind": "leaf", "title": "Landing Page Copy", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/marketing/marketing-copy.md", "slug": "landing-page-copy" } }, { "id": "leaf:pack:marketing-top-50:scroll-stopping-hooks", "kind": "leaf", "title": "Scroll-Stopping Hooks", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/marketing/marketing-copy.md", "slug": "scroll-stopping-hooks" } }, { "id": "leaf:pack:marketing-top-50:direct-response-copy", "kind": "leaf", "title": "Direct Response Copy", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/marketing/marketing-copy.md", "slug": "direct-response-copy" } }, { "id": "leaf:pack:marketing-top-50:cta-optimizer", "kind": "leaf", "title": "CTA Optimizer", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/marketing/marketing-copy.md", "slug": "cta-optimizer" } }, { "id": "leaf:pack:marketing-top-50:proof-stack", "kind": "leaf", "title": "Proof Stack Assembler", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/marketing/marketing-copy.md", "slug": "proof-stack" } }, { "id": "leaf:pack:marketing-top-50:faq-objection-handler", "kind": "leaf", "title": "FAQ Objection Handler", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/marketing/marketing-copy.md", "slug": "faq-objection-handler" } }, { "id": "category:marketing-top-50:copy", "kind": "category", "title": "Copy", "children": [ "leaf:pack:marketing-top-50:headline-formulas", "leaf:pack:marketing-top-50:hero-section", "leaf:pack:marketing-top-50:landing-page-copy", "leaf:pack:marketing-top-50:scroll-stopping-hooks", "leaf:pack:marketing-top-50:direct-response-copy", "leaf:pack:marketing-top-50:cta-optimizer", "leaf:pack:marketing-top-50:proof-stack", "leaf:pack:marketing-top-50:faq-objection-handler" ] }, { "id": "leaf:pack:marketing-top-50:full-funnel-architect", "kind": "leaf", "title": "Full Funnel Architect", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/marketing/marketing-funnel.md", "slug": "full-funnel-architect" } }, { "id": "leaf:pack:marketing-top-50:funnel-validator", "kind": "leaf", "title": "Funnel Validator", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/marketing/marketing-funnel.md", "slug": "funnel-validator" } }, { "id": "leaf:pack:marketing-top-50:message-match-audit", "kind": "leaf", "title": "Message Match Audit", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/marketing/marketing-funnel.md", "slug": "message-match-audit" } }, { "id": "leaf:pack:marketing-top-50:conversion-math", "kind": "leaf", "title": "Conversion Math", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/marketing/marketing-funnel.md", "slug": "conversion-math" } }, { "id": "leaf:pack:marketing-top-50:email-nurture-sequence", "kind": "leaf", "title": "Email Nurture Sequence", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/marketing/marketing-funnel.md", "slug": "email-nurture-sequence" } }, { "id": "leaf:pack:marketing-top-50:productize-offer-ladder", "kind": "leaf", "title": "Productize Offer Ladder", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/marketing/marketing-funnel.md", "slug": "productize-offer-ladder" } }, { "id": "category:marketing-top-50:funnel", "kind": "category", "title": "Funnel", "children": [ "leaf:pack:marketing-top-50:full-funnel-architect", "leaf:pack:marketing-top-50:funnel-validator", "leaf:pack:marketing-top-50:message-match-audit", "leaf:pack:marketing-top-50:conversion-math", "leaf:pack:marketing-top-50:email-nurture-sequence", "leaf:pack:marketing-top-50:productize-offer-ladder" ] }, { "id": "leaf:pack:marketing-top-50:market-research", "kind": "leaf", "title": "Market Research", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/marketing/marketing-market.md", "slug": "market-research" } }, { "id": "leaf:pack:marketing-top-50:dream-buyer-profile", "kind": "leaf", "title": "Dream Buyer Profile", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/marketing/marketing-market.md", "slug": "dream-buyer-profile" } }, { "id": "leaf:pack:marketing-top-50:customer-language-voc", "kind": "leaf", "title": "Customer Language & VOC", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/marketing/marketing-market.md", "slug": "customer-language-voc" } }, { "id": "leaf:pack:marketing-top-50:competitive-positioning", "kind": "leaf", "title": "Competitive Positioning", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/marketing/marketing-market.md", "slug": "competitive-positioning" } }, { "id": "leaf:pack:marketing-top-50:icp-definition", "kind": "leaf", "title": "ICP Definition", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/marketing/marketing-market.md", "slug": "icp-definition" } }, { "id": "category:marketing-top-50:market", "kind": "category", "title": "Market", "children": [ "leaf:pack:marketing-top-50:market-research", "leaf:pack:marketing-top-50:dream-buyer-profile", "leaf:pack:marketing-top-50:customer-language-voc", "leaf:pack:marketing-top-50:competitive-positioning", "leaf:pack:marketing-top-50:icp-definition" ] }, { "id": "leaf:pack:marketing-top-50:grand-slam-offer", "kind": "leaf", "title": "Grand Slam Offer", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/marketing/marketing-offer.md", "slug": "grand-slam-offer" } }, { "id": "leaf:pack:marketing-top-50:offer-audit", "kind": "leaf", "title": "Offer Audit", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/marketing/marketing-offer.md", "slug": "offer-audit" } }, { "id": "leaf:pack:marketing-top-50:offer-angles", "kind": "leaf", "title": "Offer Angles", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/marketing/marketing-offer.md", "slug": "offer-angles" } }, { "id": "leaf:pack:marketing-top-50:irresistible-lead-magnet", "kind": "leaf", "title": "Irresistible Lead Magnet", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/marketing/marketing-offer.md", "slug": "irresistible-lead-magnet" } }, { "id": "leaf:pack:marketing-top-50:godfather-offer-stack", "kind": "leaf", "title": "Godfather Offer Stack", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/marketing/marketing-offer.md", "slug": "godfather-offer-stack" } }, { "id": "leaf:pack:marketing-top-50:business-model-design", "kind": "leaf", "title": "Business Model Design", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/marketing/marketing-offer.md", "slug": "business-model-design" } }, { "id": "leaf:pack:marketing-top-50:dfy-dwy-diy-selector", "kind": "leaf", "title": "DFY / DWY / DIY Selector", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/marketing/marketing-offer.md", "slug": "dfy-dwy-diy-selector" } }, { "id": "category:marketing-top-50:offer", "kind": "category", "title": "Offer", "children": [ "leaf:pack:marketing-top-50:grand-slam-offer", "leaf:pack:marketing-top-50:offer-audit", "leaf:pack:marketing-top-50:offer-angles", "leaf:pack:marketing-top-50:irresistible-lead-magnet", "leaf:pack:marketing-top-50:godfather-offer-stack", "leaf:pack:marketing-top-50:business-model-design", "leaf:pack:marketing-top-50:dfy-dwy-diy-selector" ] }, { "id": "leaf:pack:marketing-top-50:value-perception", "kind": "leaf", "title": "Value Perception", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/marketing/marketing-pricing.md", "slug": "value-perception" } }, { "id": "leaf:pack:marketing-top-50:bonus-stack", "kind": "leaf", "title": "Bonus Stack", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/marketing/marketing-pricing.md", "slug": "bonus-stack" } }, { "id": "leaf:pack:marketing-top-50:pricing-strategy", "kind": "leaf", "title": "Pricing Strategy", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/marketing/marketing-pricing.md", "slug": "pricing-strategy" } }, { "id": "leaf:pack:marketing-top-50:objection-destroyer", "kind": "leaf", "title": "Objection Destroyer", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/marketing/marketing-pricing.md", "slug": "objection-destroyer" } }, { "id": "leaf:pack:marketing-top-50:value-equation-optimizer", "kind": "leaf", "title": "Value Equation Optimizer", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/marketing/marketing-pricing.md", "slug": "value-equation-optimizer" } }, { "id": "category:marketing-top-50:pricing", "kind": "category", "title": "Pricing", "children": [ "leaf:pack:marketing-top-50:value-perception", "leaf:pack:marketing-top-50:bonus-stack", "leaf:pack:marketing-top-50:pricing-strategy", "leaf:pack:marketing-top-50:objection-destroyer", "leaf:pack:marketing-top-50:value-equation-optimizer" ] }, { "id": "leaf:pack:marketing-top-50:hormozi-pitch", "kind": "leaf", "title": "Hormozi Pitch", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/marketing/marketing-sales.md", "slug": "hormozi-pitch" } }, { "id": "leaf:pack:marketing-top-50:vsl-script-outline", "kind": "leaf", "title": "VSL Script Outline", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/marketing/marketing-sales.md", "slug": "vsl-script-outline" } }, { "id": "leaf:pack:marketing-top-50:high-ticket-sales-script", "kind": "leaf", "title": "High-Ticket Sales Script", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/marketing/marketing-sales.md", "slug": "high-ticket-sales-script" } }, { "id": "category:marketing-top-50:sales", "kind": "category", "title": "Sales", "children": [ "leaf:pack:marketing-top-50:hormozi-pitch", "leaf:pack:marketing-top-50:vsl-script-outline", "leaf:pack:marketing-top-50:high-ticket-sales-script" ] }, { "id": "leaf:pack:marketing-top-50:seo-project-context", "kind": "leaf", "title": "SEO Project Context", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/marketing/marketing-seo.md", "slug": "seo-project-context" } }, { "id": "leaf:pack:marketing-top-50:seo-keyword-research", "kind": "leaf", "title": "SEO Keyword Opportunity Research", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/marketing/marketing-seo.md", "slug": "seo-keyword-research" } }, { "id": "leaf:pack:marketing-top-50:seo-keyword-page-mapping", "kind": "leaf", "title": "SEO Keyword-to-Page Mapping", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/marketing/marketing-seo.md", "slug": "seo-keyword-page-mapping" } }, { "id": "leaf:pack:marketing-top-50:seo-competitive-research", "kind": "leaf", "title": "SEO Competitive Research", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/marketing/marketing-seo.md", "slug": "seo-competitive-research" } }, { "id": "leaf:pack:marketing-top-50:seo-link-prospecting", "kind": "leaf", "title": "SEO Link Prospecting", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/marketing/marketing-seo.md", "slug": "seo-link-prospecting" } }, { "id": "leaf:pack:marketing-top-50:technical-seo-audit", "kind": "leaf", "title": "Technical SEO Audit", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/marketing/marketing-seo.md", "slug": "technical-seo-audit" } }, { "id": "leaf:pack:marketing-top-50:site-architecture", "kind": "leaf", "title": "Site Architecture", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/marketing/marketing-seo.md", "slug": "site-architecture" } }, { "id": "leaf:pack:marketing-top-50:on-page-seo", "kind": "leaf", "title": "On-Page SEO", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/marketing/marketing-seo.md", "slug": "on-page-seo" } }, { "id": "leaf:pack:marketing-top-50:ai-search-visibility", "kind": "leaf", "title": "AI Search Visibility Audit", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/marketing/marketing-seo.md", "slug": "ai-search-visibility" } }, { "id": "leaf:pack:marketing-top-50:geo-content-research", "kind": "leaf", "title": "GEO Content Research", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/marketing/marketing-seo.md", "slug": "geo-content-research" } }, { "id": "leaf:pack:marketing-top-50:serp-intent-match", "kind": "leaf", "title": "SERP Intent Match", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/marketing/marketing-seo.md", "slug": "serp-intent-match" } }, { "id": "category:marketing-top-50:seo", "kind": "category", "title": "Seo", "children": [ "leaf:pack:marketing-top-50:seo-project-context", "leaf:pack:marketing-top-50:seo-keyword-research", "leaf:pack:marketing-top-50:seo-keyword-page-mapping", "leaf:pack:marketing-top-50:seo-competitive-research", "leaf:pack:marketing-top-50:seo-link-prospecting", "leaf:pack:marketing-top-50:technical-seo-audit", "leaf:pack:marketing-top-50:site-architecture", "leaf:pack:marketing-top-50:on-page-seo", "leaf:pack:marketing-top-50:ai-search-visibility", "leaf:pack:marketing-top-50:geo-content-research", "leaf:pack:marketing-top-50:serp-intent-match" ] }, { "id": "leaf:pack:marketing-top-50:orchestrator", "kind": "leaf", "title": "Marketing Orchestrator", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/marketing/marketing-orchestrator.md", "slug": "marketing-orchestrator" } }, { "id": "pack:marketing-top-50", "kind": "pack", "title": "Marketing Top 50 Skills Pack", "children": [ "leaf:pack:marketing-top-50:orchestrator", "category:marketing-top-50:brand", "category:marketing-top-50:copy", "category:marketing-top-50:funnel", "category:marketing-top-50:market", "category:marketing-top-50:offer", "category:marketing-top-50:pricing", "category:marketing-top-50:sales", "category:marketing-top-50:seo" ] }, { "id": "leaf:pack:code-intelligence:orchestrator", "kind": "leaf", "title": "Codebase Structural Map", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/codebase-structural-map.md", "slug": "codebase-structural-map" } }, { "id": "leaf:pack:code-intelligence:change-impact-review", "kind": "leaf", "title": "Change Impact Review", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/change-impact-review.md", "slug": "change-impact-review" } }, { "id": "pack:code-intelligence", "kind": "pack", "title": "Code Intelligence", "children": [ "leaf:pack:code-intelligence:orchestrator", "leaf:pack:code-intelligence:change-impact-review" ] }, { "id": "leaf:pack:seo-visibility:orchestrator", "kind": "leaf", "title": "SEO Project Context", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/seo-project-context.md", "slug": "seo-project-context" } }, { "id": "leaf:pack:seo-visibility:seo-keyword-opportunity-research", "kind": "leaf", "title": "SEO Keyword Opportunity Research", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/seo-keyword-opportunity-research.md", "slug": "seo-keyword-opportunity-research" } }, { "id": "leaf:pack:seo-visibility:seo-competitive-research", "kind": "leaf", "title": "SEO Competitive Research", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/seo-competitive-research.md", "slug": "seo-competitive-research" } }, { "id": "leaf:pack:seo-visibility:ai-search-visibility-audit", "kind": "leaf", "title": "AI Search Visibility Audit", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/ai-search-visibility-audit.md", "slug": "ai-search-visibility-audit" } }, { "id": "leaf:pack:seo-visibility:seo-keyword-page-mapping", "kind": "leaf", "title": "SEO Keyword-to-Page Mapping", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/seo-keyword-page-mapping.md", "slug": "seo-keyword-page-mapping" } }, { "id": "leaf:pack:seo-visibility:seo-link-prospecting", "kind": "leaf", "title": "SEO Link Prospecting", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/seo-link-prospecting.md", "slug": "seo-link-prospecting" } }, { "id": "pack:seo-visibility", "kind": "pack", "title": "SEO and Visibility", "children": [ "leaf:pack:seo-visibility:orchestrator", "leaf:pack:seo-visibility:seo-keyword-opportunity-research", "leaf:pack:seo-visibility:seo-competitive-research", "leaf:pack:seo-visibility:ai-search-visibility-audit", "leaf:pack:seo-visibility:seo-keyword-page-mapping", "leaf:pack:seo-visibility:seo-link-prospecting" ] }, { "id": "leaf:pack:agent-operations:orchestrator", "kind": "leaf", "title": "Source Review", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/source-review.md", "slug": "source-review" } }, { "id": "leaf:pack:agent-operations:intent-to-contract", "kind": "leaf", "title": "Intent to Contract", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/intent-to-contract.md", "slug": "intent-to-contract" } }, { "id": "leaf:pack:agent-operations:validation-gated-skill-improvement", "kind": "leaf", "title": "Validation-Gated Skill Improvement", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/validation-gated-skill-improvement.md", "slug": "validation-gated-skill-improvement" } }, { "id": "leaf:pack:agent-operations:shared-skill-library-governance", "kind": "leaf", "title": "Shared Skill Library Governance", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/shared-skill-library-governance.md", "slug": "shared-skill-library-governance" } }, { "id": "leaf:pack:agent-operations:mcp-external-tool-security-review", "kind": "leaf", "title": "MCP External Tool Security Review", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/mcp-external-tool-security-review.md", "slug": "mcp-external-tool-security-review" } }, { "id": "leaf:pack:agent-operations:mission-grounded-learning-workspace", "kind": "leaf", "title": "Mission-Grounded Learning Workspace", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/mission-grounded-learning-workspace.md", "slug": "mission-grounded-learning-workspace" } }, { "id": "pack:agent-operations", "kind": "pack", "title": "Agent Operations", "children": [ "leaf:pack:agent-operations:orchestrator", "leaf:pack:agent-operations:intent-to-contract", "leaf:pack:agent-operations:validation-gated-skill-improvement", "leaf:pack:agent-operations:shared-skill-library-governance", "leaf:pack:agent-operations:mcp-external-tool-security-review", "leaf:pack:agent-operations:mission-grounded-learning-workspace" ] }, { "id": "leaf:pack:design-interface:orchestrator", "kind": "leaf", "title": "Interface Design", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/interface-design.md", "slug": "interface-design" } }, { "id": "leaf:pack:design-interface:interface-quality-audit", "kind": "leaf", "title": "Interface Quality Audit", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/interface-quality-audit.md", "slug": "interface-quality-audit" } }, { "id": "leaf:pack:design-interface:interface-transition-review", "kind": "leaf", "title": "Interface Transition Review", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/interface-transition-review.md", "slug": "interface-transition-review" } }, { "id": "pack:design-interface", "kind": "pack", "title": "Design and Interface", "children": [ "leaf:pack:design-interface:orchestrator", "leaf:pack:design-interface:interface-quality-audit", "leaf:pack:design-interface:interface-transition-review" ] }, { "id": "leaf:pack:research:orchestrator", "kind": "leaf", "title": "Recent Source Research", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/recent-source-research.md", "slug": "recent-source-research" } }, { "id": "pack:research", "kind": "pack", "title": "Research and Evidence", "children": [ "leaf:pack:research:orchestrator" ] }, { "id": "leaf:pack:media-production:programmatic-video-production", "kind": "leaf", "title": "Programmatic Video Production", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "skills/programmatic-video-production.md", "slug": "programmatic-video-production" } }, { "id": "pack:media-production", "kind": "pack", "title": "Media Production", "children": [ "leaf:pack:media-production:programmatic-video-production" ] }, { "id": "section:reviewed-packs", "kind": "section", "title": "Reviewed packs", "children": [ "pack:marketing-top-50", "pack:code-intelligence", "pack:seo-visibility", "pack:agent-operations", "pack:design-interface", "pack:research", "pack:media-production" ], "description": "Bounded reviewed skill packs with explicit provenance." }, { "id": "leaf:dist:agent-context-validation", "kind": "leaf", "title": "Agent Context Validation", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/agent-context-validation/SKILL.md", "slug": "agent-context-validation" }, "description": "Validate any artifact that changes what an agent reads, installs, executes, or treats as authority. Use when reviewing skills, prompts, MCP configs, hooks, subagent definitions, or runtime adapters before promotion.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:agent-development", "kind": "leaf", "title": "Agent Development for Claude Code Plugins", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/agent-development/SKILL.md", "slug": "agent-development" }, "description": "Create autonomous agent configurations for Claude Code plugins. Use when building subagents, designing agent frontmatter, writing system prompts, defining triggering conditions, or structuring agent files. Covers agent file format, description writing, tool restriction, model selection, and validation rules.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:agent-handoff", "kind": "leaf", "title": "Agent Handoff", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/agent-handoff/SKILL.md", "slug": "agent-handoff" }, "description": "Compact the current conversation into a handoff document for another agent to pick up. Use when work must be transferred to a fresh session or a different agent, with context preserved and sensitive information redacted.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:agent-memory-system", "kind": "leaf", "title": "agent-memory-system", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/agent-memory-system/SKILL.md", "slug": "agent-memory-system" }, "description": "Design and maintain agent memory systems. Use when setting up agent memory, designing memory schemas, implementing memory lifecycle management, or reconciling memory across sessions. Covers memory classes, lifecycle states, demotion rules, and canonicalization.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:agent-operating-loop", "kind": "leaf", "title": "Agent Operating Loop", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/agent-operating-loop/SKILL.md", "slug": "agent-operating-loop" }, "description": "The canonical Read → Classify → Inspect → Plan → Act → Verify → Reconcile → Handoff cycle that governs how an agent should approach any task. Use as the default procedure before starting work.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:agent-skill-configuration", "kind": "leaf", "title": "Agent Skill and Agentic Coding Configuration Studies", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/agent-skill-configuration/SKILL.md", "slug": "agent-skill-configuration" }, "description": "Research on configuring and optimizing agent skills in agentic coding workflows.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:agent-skill-portability", "kind": "leaf", "title": "Agent Skill Portability and Security Studies", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/agent-skill-portability/SKILL.md", "slug": "agent-skill-portability" }, "description": "Research on agent skill portability, security implications, and cross-agent compatibility challenges.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:agents-md-improver", "kind": "leaf", "title": "Agent Instruction File Improver", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/agents-md-improver/SKILL.md", "slug": "agents-md-improver" }, "description": "Audit and improve AGENTS.md / CLAUDE.md / SOUL.md files in repositories. Use when the user asks to check, audit, update, improve, or fix agent instruction files. Scans for all agent instruction files, evaluates quality against a rubric, outputs quality report, then makes targeted updates. Also use when the user mentions \"agent instruction maintenance\", \"project memory optimization\", or \"rules file audit\". Adapted from anthropic-claude-plugins-official/claude-md-improver.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:ai-native-cli", "kind": "leaf", "title": "Agent-Friendly CLI Spec", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/ai-native-cli/SKILL.md", "slug": "ai-native-cli" }, "description": "Design spec with 98 rules for building CLI tools that AI agents can safely use. Covers structured JSON output, error handling, input contracts, safety guardrails, exit codes, and agent self-description.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:authoring-agent-skills", "kind": "leaf", "title": "Authoring Agent Skills", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/authoring-agent-skills/SKILL.md", "slug": "authoring-agent-skills" }, "description": "Author portable SKILL.md agent skills that trigger reliably and spend context wisely — frontmatter discipline, progressive disclosure, degrees of freedom, and a pre-publish checklist. Use when creating a new skill, reviewing or normalizing an existing skill, or deciding what belongs in a skill versus always-loaded instructions.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "low", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:authority-model", "kind": "leaf", "title": "Authority Model", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/authority-model/SKILL.md", "slug": "Authority Model" }, "description": "Rank sources by authority level and resolve conflicting information. Use when two sources disagree, when evaluating evidence strength, or when deciding what to trust for sensitive changes.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:autonomy-loop", "kind": "leaf", "title": "Autonomy Loop", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/autonomy-loop/SKILL.md", "slug": "Autonomy Loop" }, "description": "Implement a builder-reviewer autonomy loop where two agents pass a git baton between worktrees and prove each new test catches its fix. Use when a repository has deterministic test, build, and lint gates plus a task suited to repeated builder-reviewer handoffs.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:autoresearch-loop", "kind": "leaf", "title": "Autoresearch Loop", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/autoresearch-loop/SKILL.md", "slug": "Autoresearch Loop" }, "description": "Autonomous iteration loop — modify, verify, keep/discard against any metric. Use when the user wants to iteratively improve code, hunt bugs, audit security, or optimize against a measurable goal without manual step-by-step guidance.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:bash-defensive-patterns", "kind": "leaf", "title": "Bash Defensive Patterns", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/bash-defensive-patterns/SKILL.md", "slug": "Bash Defensive Patterns" }, "description": "Master defensive Bash programming techniques for production-grade scripts. Use when writing robust shell scripts, CI/CD pipelines, or system utilities requiring fault tolerance and safety.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:browse", "kind": "leaf", "title": "browse", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/browse/SKILL.md", "slug": "browse" }, "description": "Fast headless browser for QA testing and site dogfooding. (gstack)", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:canonicalization", "kind": "leaf", "title": "Canonicalization", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/canonicalization/SKILL.md", "slug": "Canonicalization" }, "description": "Convert useful information into durable project knowledge. Use when deciding whether to promote an observation to canonical memory, what form it should take, and how to store it.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:capture", "kind": "leaf", "title": "Capture — Single Ingestion Entrypoint", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/capture/SKILL.md", "slug": "Capture" }, "description": "Save any thought or content into persistent knowledge storage via one command. The single human-facing ingestion entrypoint that handles both local and remote installs. Use when the user says \"capture this\", \"save this thought\", \"remember this\", or \"save to brain\".", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:careful", "kind": "leaf", "title": "Careful", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/careful/SKILL.md", "slug": "Careful" }, "description": "Safety guardrails for destructive commands — warn before rm -rf, force-push, DROP TABLE, or production mutations. Use when touching production, debugging live systems, or working in shared environments.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:clarity-gate", "kind": "leaf", "title": "Clarity Gate", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/clarity-gate/SKILL.md", "slug": "clarity-gate" }, "description": "Pre-ingestion verification for epistemic quality in RAG systems. Ensures documents are properly qualified before entering knowledge bases. 9 verification points covering hypothesis vs fact labeling, uncertainty markers, assumption visibility, and data consistency.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:code-tour", "kind": "leaf", "title": "Code Tour", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/code-tour/SKILL.md", "slug": "Code Tour Generation" }, "description": "Create persona-targeted, step-by-step codebase walkthroughs linked to real files and line numbers using CodeTour format.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:codex", "kind": "leaf", "title": "codex", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/codex/SKILL.md", "slug": "codex" }, "description": "OpenAI Codex CLI wrapper — three modes. (gstack)", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:collaboration-principles", "kind": "leaf", "title": "Collaboration Principles", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/collaboration-principles/SKILL.md", "slug": "Collaboration Principles" }, "description": "Decision framework for human-agent collaboration. Use when deciding whether to ask or act, when work touches sensitive boundaries, or when determining how to keep the user informed.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:completion-standards", "kind": "leaf", "title": "completion-standards", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/completion-standards/SKILL.md", "slug": "completion-standards" }, "description": "Define and verify completion criteria for agent tasks. Use when starting a task, verifying work is done, or handing off to another agent. Covers done standards, completion statements, proceed criteria, and anti-patterns.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:construction-discipline", "kind": "leaf", "title": "Construction Discipline", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/construction-discipline/SKILL.md", "slug": "construction-discipline" }, "description": "Code construction discipline from Steve McConnell's \"Code Complete\" — clarity, defect reduction, variable naming, control flow, error handling, and evidence-based quality as agent operating discipline.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:context-compression", "kind": "leaf", "title": "Context Compression Strategies", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/context-compression/SKILL.md", "slug": "context-compression" }, "description": "When agent sessions generate massive context histories, compression becomes mandatory. The naive approach optimizes tokens-per-request. The correct optimization target is **tokens-per-task**: total tokens consumed to complete a task, including re-fetching costs when compression loses critical information.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:context-restore", "kind": "leaf", "title": "context-restore", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/context-restore/SKILL.md", "slug": "context-restore" }, "description": "Restore working context saved earlier by /context-save. (gstack)", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:context-save", "kind": "leaf", "title": "Context Save", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/context-save/SKILL.md", "slug": "Context Save" }, "description": "Save working context (git state, decisions, remaining work) so any future session can pick up without losing progress. Use when asked to \"save progress\", \"save state\", \"context save\", or before switching tasks.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:context-window-management", "kind": "leaf", "title": "Context Window Management", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/context-window-management/SKILL.md", "slug": "context-window-management" }, "description": "Strategies for managing LLM context windows including summarization, trimming, routing, and avoiding context rot. Tiered context strategy, serial position optimization, intelligent summarization, and token budget allocation.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:cross-session-handoff", "kind": "leaf", "title": "Cross-Session Handoff", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/cross-session-handoff/SKILL.md", "slug": "cross-session-handoff" }, "description": "Compact the current conversation into a handoff document for another agent or fresh session to pick up. Use when a thread is full, you need to branch off (e.g., into a prototype session), or you want to preserve context across session boundaries. This is a fork — you open a new session and reference the handoff file to carry context across.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:decision-principles", "kind": "leaf", "title": "Decision Principles", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/decision-principles/SKILL.md", "slug": "Decision Principles" }, "description": "Structured framework for choosing between implementation paths, tools, architectures, or product directions. Use when evaluating technical options or making architecture decisions.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:define-goal", "kind": "leaf", "title": "Define Goal", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/define-goal/SKILL.md", "slug": "Define Goal" }, "description": "Help the user define a concrete, measurable goal before starting work, especially when they ask to create a goal, set an objective, clarify success criteria, or turn a fuzzy intention into a quantitative outcome. Use for goal creation and goal refinement only.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:doctrine-upkeep", "kind": "leaf", "title": "doctrine-upkeep", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/doctrine-upkeep/SKILL.md", "slug": "doctrine-upkeep" }, "description": "Maintain the doctrine layer so purpose, truth rules, authority boundaries, and memory doctrine stay coherent with the rest of the Architectonic system.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:domain-modeling", "kind": "leaf", "title": "Domain Modeling", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/domain-modeling/SKILL.md", "slug": "Domain Modeling" }, "description": "Actively build and sharpen a project's domain model during design. Use when the user wants to pin down domain terminology or a ubiquitous language, record an architectural decision, or when another skill needs to maintain the domain model. Not for passively reading a glossary — for actively changing the model.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:dream-cycle", "kind": "leaf", "title": "Dream Cycle", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/dream-cycle/SKILL.md", "slug": "Dream Cycle" }, "description": "Periodic knowledge maintenance and repo hygiene for agent memory systems. Use after major work sessions, releases, incidents, or when accumulated context needs consolidation.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:engineering-agent-harnesses", "kind": "leaf", "title": "Engineering Agent Harnesses", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/engineering-agent-harnesses/SKILL.md", "slug": "engineering-agent-harnesses" }, "description": "Improve agent reliability by shaping the software around the model — repo instructions, tool budgets, permission tiers, schema-validated tool calls, and compaction-safe context placement. Use when an agent underperforms despite good prompts, when configuring a repo or workspace for agents, or when designing the runtime that hosts them.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "low", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:engineering-context-windows", "kind": "leaf", "title": "Engineering Context Windows", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/engineering-context-windows/SKILL.md", "slug": "engineering-context-windows" }, "description": "Manage the agent context window as a scarce shared resource — decide what lives in always-loaded instructions, skills, memory, or the filesystem, and survive compaction without losing critical rules. Use when instructions bloat, agents forget mid-session rules, context overflows on long tasks, or when designing memory and retrieval for an agent system.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "low", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:engineering-loop-contracts", "kind": "leaf", "title": "Engineering Loop Contracts", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/engineering-loop-contracts/SKILL.md", "slug": "engineering-loop-contracts" }, "description": "Design safe recurring agent loops with explicit triggers, context, actions, verification, state, stopping conditions, and human checkpoints — the loop contract that replaces turn-by-turn prompting. Use when creating a scheduled or autonomous agent loop, reviewing an existing loop for runaway or staleness risk, or converting repeated manual work into automation.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "low", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:evaluating-skills-before-authoring", "kind": "leaf", "title": "Evaluating Skills Before Authoring", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/evaluating-skills-before-authoring/SKILL.md", "slug": "evaluating-skills-before-authoring" }, "description": "Build evaluations before writing skill documentation — baseline the agent without the skill, write minimal instructions to close observed gaps, and iterate from watched behavior using an author/consumer two-agent loop. Use when creating or improving a skill, deciding whether a skill is needed at all, or when a skill exists but agents ignore or misuse it.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "low", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:external-system-mutation", "kind": "leaf", "title": "external-system-mutation", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/external-system-mutation/SKILL.md", "slug": "external system mutation" }, "description": "External System Mutation Skill. Use when the agent needs to external system mutation.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:frontier-agent-governance", "kind": "leaf", "title": "Frontier Agent Governance", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/frontier-agent-governance/SKILL.md", "slug": "Frontier Agent Governance" }, "description": "Operating discipline for high-capability agents. Use when the agent has broad tool access, long-horizon tasks, or security-sensitive surfaces. Covers the principle that higher capability requires stricter discipline, not more autonomy.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:full-output-enforcement", "kind": "leaf", "title": "Full-Output Enforcement", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/full-output-enforcement/SKILL.md", "slug": "full-output-enforcement" }, "description": "Prevent partial, truncated, or placeholder-filled agent output. Activate when tasks demand complete files, exhaustive lists, or unabridged deliverables. Bans '// ...' patterns, 'TODO' stubs, and 'similar to above' substitutions.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:gating-work-with-verification-loops", "kind": "leaf", "title": "Gating Work With Verification Loops", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/gating-work-with-verification-loops/SKILL.md", "slug": "gating-work-with-verification-loops" }, "description": "Gate agent work with validator loops and plan-validate-execute — draft, check against a deterministic validator, fix, and only proceed on pass; emit machine-checkable plan artifacts before batch or destructive operations. Use when output quality is critical, when a task mutates many files or records at once, or when an agent claims success without evidence.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "low", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:graphify-onboarding", "kind": "leaf", "title": "Graphify Onboarding", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/graphify-onboarding/SKILL.md", "slug": "Graphify Onboarding" }, "description": "Operating discipline for using Graphify as a project-discovery accelerator. Use when onboarding into an unfamiliar repository, mapping dependencies, or generating project profiles from source artifacts.", "trust": { "lifecycle_status": "reviewed", "install_recommendation": "conditional", "risk_level": "medium", "classification_status": "partial", "catalog_decision": true } }, { "id": "leaf:dist:gstack", "kind": "leaf", "title": "gstack", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/gstack/SKILL.md", "slug": "gstack" }, "description": "Fast headless browser for QA testing and site dogfooding. (gstack)", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:gui-skill-action-graph", "kind": "leaf", "title": "gui-skill-action-graph", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/gui-skill-action-graph/SKILL.md", "slug": "gui-skill-action-graph" }, "description": "Compose GUI agent skills as composable action graphs for computer-use tasks. Use when building GUI automation skills, designing multi-step desktop workflows, or integrating with GUI agent frameworks. Covers action retrieval, DAG-like composition, vision grounding, and execution budgets.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:handoff", "kind": "leaf", "title": "handoff", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/handoff/SKILL.md", "slug": "handoff" }, "description": "Compact the current conversation into a handoff document for another agent to pick up.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:identity-upkeep", "kind": "leaf", "title": "identity-upkeep", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/identity-upkeep/SKILL.md", "slug": "identity-upkeep" }, "description": "Maintain the identity layer so participant roles, boundaries, preferences, and privacy rules stay explicit, minimal, and free from inference creep.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:issue-triage", "kind": "leaf", "title": "Issue Triage", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/issue-triage/SKILL.md", "slug": "Issue Triage" }, "description": "Move issues and external PRs through a state machine of triage roles — categorise, verify, grill if needed, and write agent-ready briefs. Use when the user says \"/triage\", wants to triage issues/PRs, or needs to move work through a structured triage process.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:knowledge-ops", "kind": "leaf", "title": "Knowledge Ops — SOP/Runbook Authoring and KB Hygiene", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/knowledge-ops/SKILL.md", "slug": "Knowledge Ops — SOP/Runbook Authoring and KB Hygiene" }, "description": "Author, validate, and clean up company SOPs and internal runbooks. 5W2H completeness checks, cross-link and orphan-page validation across wikis, KB ingestion + hygiene reporting, runbook step verification (named owner, expected duration, observable success signal, rollback path, escalation contact). Pairs Ishikawa's 5W2H method, Gawande's Checklist Manifesto, ISO 9001, ITIL v4, and Google SRE Workbook runbook discipline.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:learn", "kind": "leaf", "title": "learn", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/learn/SKILL.md", "slug": "learn" }, "description": "Manage project learnings.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:legacy-code-safety", "kind": "leaf", "title": "Legacy Code Safety", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/legacy-code-safety/SKILL.md", "slug": "legacy-code-safety" }, "description": "Safe change techniques for legacy/untested code from Michael Feathers' \"Working Effectively with Legacy Code\" — seams, characterization tests, dependency breaking, and sprout/wrap patterns.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:legacy-modernizer", "kind": "leaf", "title": "Legacy Modernizer", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/legacy-modernizer/SKILL.md", "slug": "Legacy Modernizer" }, "description": "Refactor legacy codebases, migrate outdated frameworks, and implement gradual modernization. Handles technical debt, dependency updates, and backward compatibility.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:llm-cost-optimizer", "kind": "leaf", "title": "LLM Cost Optimizer", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/llm-cost-optimizer/SKILL.md", "slug": "llm-cost-optimizer" }, "description": "Use proactively whenever LLM API costs come up — or should. Triggers include \"my AI costs are too high\", \"optimize token usage\", \"which model should I use\", \"LLM spend is out of control\", \"implement prompt caching\", \"we're about to launch an AI feature\". Don't wait for an explicit cost complaint — if someone is building an AI feature, designing an LLM endpoint, or choosing between models, cost architecture belongs in the conversation.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:managed-agent-launch-cma", "kind": "leaf", "title": "Managed Agent Launch", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/managed-agent-launch-cma/SKILL.md", "slug": "managed-agent-launch-cma" }, "description": "Help a **technical founder** build whatever they want on Claude Managed Agents (CMA) — an internal worker, a piece of their product, a customer-facing agent. Interview them about what they want, scope a v0, launch it in their own account, grade it against their own definition of done, iterate, and (if it should run on a clock) put it on a scheduled deployment.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:memory-lifecycle", "kind": "leaf", "title": "Memory Lifecycle", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/memory-lifecycle/SKILL.md", "slug": "Memory Lifecycle" }, "description": "Manage memory through explicit lifecycle states. Use when promoting observations to durable memory, demoting stale rules, or deciding whether to keep, archive, or delete memory entries.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:memory-substrate-checklist", "kind": "leaf", "title": "Memory Substrate Checklist", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/memory-substrate-checklist/SKILL.md", "slug": "Memory Substrate Checklist" }, "description": "Evaluation checklist for assessing persistent memory systems for coding agents. Use when evaluating, setting up, or auditing a memory substrate (like agentmemory) that stores observations, decisions, and session context across agent runs.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:minimal-fix", "kind": "leaf", "title": "Minimal Fix", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/minimal-fix/SKILL.md", "slug": "Minimal Fix" }, "description": "Produce the smallest possible code change that fixes a specific, well-scoped issue (CI failure, reviewer comment, typo). Use only when the fix target is explicit. Never refactor unrelated code. One problem per invocation.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:minimum-viable-memory-system", "kind": "leaf", "title": "Minimum Viable Memory System", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/minimum-viable-memory-system/SKILL.md", "slug": "Minimum Viable Memory System" }, "description": "The 10-file governed memory kit every project needs for safe, continuous agent work. Use when setting up a new project memory layer, onboarding agents to an existing project, or diagnosing missing project memory infrastructure.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:multi-agent-architecture", "kind": "leaf", "title": "Multi-Agent Architecture Patterns", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/multi-agent-architecture/SKILL.md", "slug": "Multi-Agent Architecture Patterns" }, "description": "Architecture patterns for multi-agent systems — four-layer agent design, coordination patterns, lifecycle management, and production hardening. Use when designing systems where multiple AI agents coordinate, spawn sub-agents, or share tools and state.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:office-hours", "kind": "leaf", "title": "office-hours", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/office-hours/SKILL.md", "slug": "office-hours" }, "description": "YC Office Hours — two modes. (gstack)", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:ontology", "kind": "leaf", "title": "Ontology", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/ontology/SKILL.md", "slug": "Ontology" }, "description": "Core entity model for classifying agent knowledge. Use when deciding whether information is a fact, assumption, decision, rule, question, or risk — and when determining what should become durable memory.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:open-gstack-browser", "kind": "leaf", "title": "open-gstack-browser", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/open-gstack-browser/SKILL.md", "slug": "open-gstack-browser" }, "description": "Launch GStack Browser — AI-controlled Chromium with the sidebar extension baked in.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:opensrc", "kind": "leaf", "title": "Source Code Fetching with OpenSrc", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/opensrc/SKILL.md", "slug": "OpenSrc" }, "description": "Fetch dependency source code to give AI agents deeper implementation context. Use when the agent needs to understand how a library works internally, read source code for a package, or explore how an npm/PyPI/crates.io package is built.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:orchestrate-batch-refactor", "kind": "leaf", "title": "Orchestrate Batch Refactor", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/orchestrate-batch-refactor/SKILL.md", "slug": "Orchestrate Batch Refactor" }, "description": "Plan and execute large refactor efforts with parallel multi-agent analysis. Use when refactoring many files, splitting workstreams, or coordinating sub-agents for batch code changes.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:pair-agent", "kind": "leaf", "title": "pair-agent", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/pair-agent/SKILL.md", "slug": "pair-agent" }, "description": "Pair a remote AI agent with your browser. (gstack)", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:plan-ceo-review", "kind": "leaf", "title": "plan-ceo-review", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/plan-ceo-review/SKILL.md", "slug": "plan-ceo-review" }, "description": "CEO/founder-mode plan review. (gstack)", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:pragmatic-engineering", "kind": "leaf", "title": "Pragmatic Engineering", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/pragmatic-engineering/SKILL.md", "slug": "pragmatic-engineering" }, "description": "Pragmatic engineering practices from Hunt & Thomas \"The Pragmatic Programmer\" — orthogonality, tracer bullets, prototyping, automation, and broken windows as agent operating discipline.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:process-mapper", "kind": "leaf", "title": "Process Mapper — BPMN Documentation and Bottleneck Analysis", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/process-mapper/SKILL.md", "slug": "Process Mapper — BPMN Documentation and Bottleneck Analysis" }, "description": "Document end-to-end business processes in BPMN-style notation, measure cycle times by stage, surface where work spends most of its time waiting vs. being worked, and quantify the gap between processing time and total elapsed time. Pairs Lean / Six Sigma / Theory-of-Constraints with deterministic analysis to produce a process map, ranked bottleneck list, and cycle-time analysis (P50, P90, value-add ratio, Little's Law throughput).", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:project-onboarding", "kind": "leaf", "title": "Project Onboarding", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/project-onboarding/SKILL.md", "slug": "Project Onboarding" }, "description": "Onboard an existing repository with the Agent Memory Ops Kit. Use when adding the kit to a new project, setting up agent context for a repo, or establishing the initial operating memory for a codebase.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:project-upkeep", "kind": "leaf", "title": "project-upkeep", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/project-upkeep/SKILL.md", "slug": "project-upkeep" }, "description": "Maintain the project layer so each project namespace stays source-grounded, current, decision-aware, and small enough to remain useful.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:qa-gauntlet", "kind": "leaf", "title": "QA Gauntlet", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/qa-gauntlet/SKILL.md", "slug": "QA Gauntlet" }, "description": "Pre-completion checklist for agent work. Use before declaring work done, handing off, or reporting completion. Covers scope, correctness, test, and review checks.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:reasoning-principles", "kind": "leaf", "title": "Reasoning Principles", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/reasoning-principles/SKILL.md", "slug": "Reasoning Principles" }, "description": "Default cognitive guardrails for technical agents. Use before recommending or changing anything, when uncertainty is high, or when distinguishing known facts from inference.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:regulated-domain-skill-governance", "kind": "leaf", "title": "regulated-domain-skill-governance", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/regulated-domain-skill-governance/SKILL.md", "slug": "regulated-domain-skill-governance" }, "description": "Govern skills that operate in regulated domains such as finance, healthcare, legal, or any domain with compliance, disclosure, or liability requirements. Use when reviewing or creating skills that touch regulated APIs, produce reports that could be construed as advice, or handle sensitive domain data.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:repo-contract", "kind": "leaf", "title": "Repo Contract", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/repo-contract/SKILL.md", "slug": "Repo Contract" }, "description": "Define project identity, agent permissions, source-of-truth locations, and done criteria for a repository. Use when onboarding an agent into a new project or establishing project boundaries.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:repo-discovery", "kind": "leaf", "title": "repo-discovery", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/repo-discovery/SKILL.md", "slug": "repo discovery" }, "description": "Repo Discovery Skill. Use when the agent needs to repo discovery.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:retro", "kind": "leaf", "title": "retro", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/retro/SKILL.md", "slug": "retro" }, "description": "Weekly engineering retrospective. (gstack)", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:scaffold-exercises", "kind": "leaf", "title": "Scaffold Exercises", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/scaffold-exercises/SKILL.md", "slug": "scaffold-exercises" }, "description": "Create exercise directory structures with sections, problems, solutions, and explainers that pass linting. Use when user wants to scaffold exercises, create exercise stubs, or set up a new course section.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:security-review", "kind": "leaf", "title": "Security Review", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/security-review/SKILL.md", "slug": "Security Review" }, "description": "Security gate checklist for reviewing agent-made changes and third-party agent skill ingestion. Use before merging, shipping, or promoting any skill or code change that touches sensitive surfaces.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:setup-browser-cookies", "kind": "leaf", "title": "setup-browser-cookies", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/setup-browser-cookies/SKILL.md", "slug": "setup-browser-cookies" }, "description": "Import cookies from your real Chromium browser into the headless browse session. (gstack)", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:sharp-edges-analysis", "kind": "leaf", "title": "Sharp Edges Analysis", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/sharp-edges-analysis/SKILL.md", "slug": "Sharp Edges Analysis" }, "description": "Identifies error-prone APIs, dangerous configurations, and footgun designs that enable security mistakes. Evaluates whether APIs follow 'secure by default' and 'pit of success' principles. Use when reviewing API designs, configuration schemas, cryptographic library ergonomics, or evaluating misuse resistance.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:signal-detector", "kind": "leaf", "title": "Signal Detector — Ambient Capture", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/signal-detector/SKILL.md", "slug": "Signal Detector" }, "description": "Always-on ambient signal capture for ideas and entities. Fires on every inbound message to detect original thinking (user's ideas, observations, theses) and entity mentions (people, companies, concepts). Runs in parallel, never blocks the main response. Captures the user's exact phrasing — ideas are intellectual capital.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:skill-authoring", "kind": "leaf", "title": "hermes-agent-skill-authoring", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/skill-authoring/SKILL.md", "slug": "hermes-agent-skill-authoring" }, "description": "Use when . .", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:skill-creation", "kind": "leaf", "title": "Skill Creation Process", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/skill-creation/SKILL.md", "slug": "skill-creation" }, "description": "Six steps to create an effective skill.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:skill-development", "kind": "leaf", "title": "Skill Development", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/skill-development/SKILL.md", "slug": "Skill Development" }, "description": "Create, structure, and maintain effective agent skills. Use when the user wants to \"create a skill\", \"add a skill to plugin\", \"write a new skill\", \"improve skill description\", \"organize skill content\", or needs guidance on skill structure, progressive disclosure, or skill development best practices.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:skill-distillation", "kind": "leaf", "title": "skill-distillation", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/skill-distillation/SKILL.md", "slug": "skill-distillation" }, "description": "Distill execution traces, source repos, and raw skill dumps into improved or new agent skills. Use when synthesizing skills from observed execution patterns, consolidating multiple runtime-specific skills, or improving existing skills from evidence. Covers contrastive induction, paired verification, and closed-loop refinement.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:skill-library-maintenance", "kind": "leaf", "title": "Skill Library Maintenance", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/skill-library-maintenance/SKILL.md", "slug": "Skill Library Maintenance" }, "description": "Maintain large agent skill libraries with contracts, neighbor graphs, diagnostics, and prune/merge/quarantine decisions. Use when performing periodic maintenance on canonical skill collections.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:skill-model", "kind": "leaf", "title": "Skill Model", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/skill-model/SKILL.md", "slug": "Skill Model" }, "description": "OKF-compatible frontmatter schema and template for agent skills. Use when creating new skills, validating skill frontmatter, or designing skill metadata fields.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:skill-optimization-loop", "kind": "leaf", "title": "Skill Optimization Loop", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/skill-optimization-loop/SKILL.md", "slug": "skill-optimization-loop" }, "description": "Pattern for optimizing agent skills through bounded text-space edits with validation gates. Use when you want to improve a skill document systematically without human rewriting — treat the skill as trainable state.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:skill-quality-gate", "kind": "leaf", "title": "skill-quality-gate", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/skill-quality-gate/SKILL.md", "slug": "skill-quality-gate" }, "description": "Validate, lint, and score agent skills before promotion into the skill library. Use when evaluating a candidate skill for quality, safety, and completeness. Covers schema validation, frontmatter checks, content quality, and scoring dimensions.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:skill-revision", "kind": "leaf", "title": "skill-revision", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/skill-revision/SKILL.md", "slug": "skill-revision" }, "description": "Revise agent skills using execution traces, verifier feedback, and utility gates. Use when improving cold-start LLM-authored skills, when a skill fails in production, or when evidence-based skill improvement is needed. Covers trace-conditioned diagnosis, principle-memory retrieval, anchored editing, and utility-gated promotion.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:skill-safety-review", "kind": "leaf", "title": "Skill Safety Review", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/skill-safety-review/SKILL.md", "slug": "Skill Safety Review" }, "description": "Evaluate agent skills for safety risks before ingestion or promotion. Use when reviewing candidate skills from external registries, marketplaces, or unknown sources. Covers instruction-hijack detection, supply-chain risk, permission escalation, and skill-family ambiguity.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:skillify", "kind": "leaf", "title": "skillify", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/skillify/SKILL.md", "slug": "skillify" }, "description": "Codify the most recent successful /scrape flow into a permanent browser-skill on disk. (gstack)", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:skills-catalog", "kind": "leaf", "title": "Catalog and Categorize Agent Skills", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/skills-catalog/SKILL.md", "slug": "skills-catalog" }, "description": "Use when inventorying, classifying, or recategorizing a skill library. Assigns domain tags, risk levels, source metadata, and catalog entries to skills at scale.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:skills-keep", "kind": "leaf", "title": "Keep Skills Healthy", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/skills-keep/SKILL.md", "slug": "skills-keep" }, "description": "Use when maintaining a drifted skill library so reusable procedures stay normalized, categorized, packageable, and safe for progressive discovery. Prevents growth-without-quality.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:skills-upkeep", "kind": "leaf", "title": "skills-upkeep", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/skills-upkeep/SKILL.md", "slug": "skills-upkeep" }, "description": "Maintain the skills layer so reusable procedures stay normalized, categorized, source-aware, packageable, and safe for progressive discovery.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:source-hierarchy", "kind": "leaf", "title": "Source Hierarchy", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/source-hierarchy/SKILL.md", "slug": "Source Hierarchy" }, "description": "How to rank sources and resolve conflicting information. Use when two sources disagree, when evaluating evidence strength, or when deciding what to trust.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:teleagent-system-upkeep", "kind": "leaf", "title": "teleagent-system-upkeep", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/teleagent-system-upkeep/SKILL.md", "slug": "teleagent-system-upkeep" }, "description": "Coordinate a full maintenance pass across doctrine, identity, project, and skills so the Architectonic stack remains coherent top-down.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:tool-use-guardrails", "kind": "leaf", "title": "Tool Use Guardrails", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/tool-use-guardrails/SKILL.md", "slug": "Tool Use Guardrails" }, "description": "Discipline for using tools that mutate external state. Use before any tool call that modifies files, systems, or data outside the agent's immediate context.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:trace2skill", "kind": "leaf", "title": "Trace2Skill", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/trace2skill/SKILL.md", "slug": "trace2skill" }, "description": "Distill trajectory-local lessons into transferable agent skills via parallel patch consolidation.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:trace2skill-evolution", "kind": "leaf", "title": "Trace2Skill — Skill Evolution from Execution Trajectories", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/trace2skill-evolution/SKILL.md", "slug": "Trace2Skill — Skill Evolution from Execution Trajectories" }, "description": "Distill trajectory-local lessons into transferable agent skills via parallel patch consolidation. Use when you have multiple agent execution traces (successes and failures) and want to extract portable skill improvements. Based on arxiv:2603.25158, arxiv:2605.21810.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:vertical-slice-issues", "kind": "leaf", "title": "Vertical Slice Issues", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/vertical-slice-issues/SKILL.md", "slug": "vertical-slice-issues" }, "description": "Break a plan, spec, or PRD into independently-grabbable issues using tracer-bullet vertical slices. Use when you have a plan that needs to be split into issues for an issue tracker, especially when work will be done across multiple sessions or by different agents. Each slice cuts through ALL integration layers end-to-end (schema, API, UI, tests), not a horizontal slice of one layer.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:writing-great-skills", "kind": "leaf", "title": "writing-great-skills", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/writing-great-skills/SKILL.md", "slug": "writing-great-skills" }, "description": "Reference for writing and editing skills well — the vocabulary and principles that make a skill predictable.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "group:dist:agent-operations:playbook", "kind": "group", "title": "Playbook", "children": [ "leaf:dist:agent-context-validation", "leaf:dist:agent-development", "leaf:dist:agent-handoff", "leaf:dist:agent-memory-system", "leaf:dist:agent-operating-loop", "leaf:dist:agent-skill-configuration", "leaf:dist:agent-skill-portability", "leaf:dist:agents-md-improver", "leaf:dist:ai-native-cli", "leaf:dist:authoring-agent-skills", "leaf:dist:authority-model", "leaf:dist:autonomy-loop", "leaf:dist:autoresearch-loop", "leaf:dist:bash-defensive-patterns", "leaf:dist:browse", "leaf:dist:canonicalization", "leaf:dist:capture", "leaf:dist:careful", "leaf:dist:clarity-gate", "leaf:dist:code-tour", "leaf:dist:codex", "leaf:dist:collaboration-principles", "leaf:dist:completion-standards", "leaf:dist:construction-discipline", "leaf:dist:context-compression", "leaf:dist:context-restore", "leaf:dist:context-save", "leaf:dist:context-window-management", "leaf:dist:cross-session-handoff", "leaf:dist:decision-principles", "leaf:dist:define-goal", "leaf:dist:doctrine-upkeep", "leaf:dist:domain-modeling", "leaf:dist:dream-cycle", "leaf:dist:engineering-agent-harnesses", "leaf:dist:engineering-context-windows", "leaf:dist:engineering-loop-contracts", "leaf:dist:evaluating-skills-before-authoring", "leaf:dist:external-system-mutation", "leaf:dist:frontier-agent-governance", "leaf:dist:full-output-enforcement", "leaf:dist:gating-work-with-verification-loops", "leaf:dist:graphify-onboarding", "leaf:dist:gstack", "leaf:dist:gui-skill-action-graph", "leaf:dist:handoff", "leaf:dist:identity-upkeep", "leaf:dist:issue-triage", "leaf:dist:knowledge-ops", "leaf:dist:learn", "leaf:dist:legacy-code-safety", "leaf:dist:legacy-modernizer", "leaf:dist:llm-cost-optimizer", "leaf:dist:managed-agent-launch-cma", "leaf:dist:memory-lifecycle", "leaf:dist:memory-substrate-checklist", "leaf:dist:minimal-fix", "leaf:dist:minimum-viable-memory-system", "leaf:dist:multi-agent-architecture", "leaf:dist:office-hours", "leaf:dist:ontology", "leaf:dist:open-gstack-browser", "leaf:dist:opensrc", "leaf:dist:orchestrate-batch-refactor", "leaf:dist:pair-agent", "leaf:dist:plan-ceo-review", "leaf:dist:pragmatic-engineering", "leaf:dist:process-mapper", "leaf:dist:project-onboarding", "leaf:dist:project-upkeep", "leaf:dist:qa-gauntlet", "leaf:dist:reasoning-principles", "leaf:dist:regulated-domain-skill-governance", "leaf:dist:repo-contract", "leaf:dist:repo-discovery", "leaf:dist:retro", "leaf:dist:scaffold-exercises", "leaf:dist:security-review", "leaf:dist:setup-browser-cookies", "leaf:dist:sharp-edges-analysis", "leaf:dist:signal-detector", "leaf:dist:skill-authoring", "leaf:dist:skill-creation", "leaf:dist:skill-development", "leaf:dist:skill-distillation", "leaf:dist:skill-library-maintenance", "leaf:dist:skill-model", "leaf:dist:skill-optimization-loop", "leaf:dist:skill-quality-gate", "leaf:dist:skill-revision", "leaf:dist:skill-safety-review", "leaf:dist:skillify", "leaf:dist:skills-catalog", "leaf:dist:skills-keep", "leaf:dist:skills-upkeep", "leaf:dist:source-hierarchy", "leaf:dist:teleagent-system-upkeep", "leaf:dist:tool-use-guardrails", "leaf:dist:trace2skill", "leaf:dist:trace2skill-evolution", "leaf:dist:vertical-slice-issues", "leaf:dist:writing-great-skills" ] }, { "id": "leaf:dist:loop-me", "kind": "leaf", "title": "loop-me", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/loop-me/SKILL.md", "slug": "loop-me" }, "description": "Grill me about specs for the workflows I want to build, within this workspace.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:preferences-model", "kind": "leaf", "title": "Preferences Model", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/preferences-model/SKILL.md", "slug": "Preferences Model" }, "description": "Template for recording project or team working preferences without turning personality into doctrine. Use when setting up working preferences, defining team conventions, or documenting communication style.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:skill-authoring-doctrine", "kind": "leaf", "title": "skill-authoring-doctrine", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/skill-authoring-doctrine/SKILL.md", "slug": "skill-authoring-doctrine" }, "description": "Doctrine for writing and editing high-quality agent skills. Use when authoring new skills, reviewing existing skills, or diagnosing skill failure modes. Covers predictability as the root virtue, context load vs cognitive load tradeoffs, information hierarchy, failure modes (premature completion, duplication, sediment, sprawl, no-op), leading words, and pruning discipline.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "group:dist:agent-operations:reference", "kind": "group", "title": "Reference", "children": [ "leaf:dist:loop-me", "leaf:dist:preferences-model", "leaf:dist:skill-authoring-doctrine" ] }, { "id": "leaf:dist:command-basics", "kind": "leaf", "title": "Command Basics", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/command-basics/SKILL.md", "slug": "Command Basics" }, "description": "Understand what slash commands are, where they live, and their file format. Use when creating your first command or deciding between project/personal/plugin command locations.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "low", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:command-development", "kind": "leaf", "title": "Command Development", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/command-development/SKILL.md", "slug": "Command Development" }, "description": "Create slash commands for Claude Code plugins. Use when building custom commands with frontmatter, dynamic arguments, file references, bash execution, or plugin integration.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:command-dynamic-features", "kind": "leaf", "title": "Command Dynamic Features", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/command-dynamic-features/SKILL.md", "slug": "Command Dynamic Features" }, "description": "Use dynamic arguments ($ARGUMENTS, $1, $2) and file references (@ syntax) in slash commands. Use when building commands that accept user input or include file contents.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:command-frontmatter", "kind": "leaf", "title": "Command Frontmatter", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/command-frontmatter/SKILL.md", "slug": "Command Frontmatter" }, "description": "Configure command YAML frontmatter fields including description, allowed-tools, model, argument-hint, disable-model-invocation. Use when adding configuration to a command or troubleshooting command triggering.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "low", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:command-organization", "kind": "leaf", "title": "Command Organization", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/command-organization/SKILL.md", "slug": "Command Organization" }, "description": "Organize commands with namespaces, follow best practices, and use common patterns (review, testing, documentation, workflow). Use when structuring a command library or designing multi-command workflows.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "low", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:hook-basics", "kind": "leaf", "title": "Hook Basics", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/hook-basics/SKILL.md", "slug": "Hook Basics" }, "description": "Understand hook types (prompt-based vs command), configuration formats (plugin hooks.json vs settings.json), and when to use each. Use when creating your first hook or deciding between prompt and command approaches.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:hook-events", "kind": "leaf", "title": "Hook Events", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/hook-events/SKILL.md", "slug": "Hook Events" }, "description": "Implement specific hook events — PreToolUse, PostToolUse, Stop, SubagentStop, UserPromptSubmit, SessionStart, SessionEnd, PreCompact, Notification. Use when building hooks for specific Claude Code lifecycle events.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:mission-grounded-learning-workspace", "kind": "leaf", "title": "Mission-Grounded Learning Workspace", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/mission-grounded-learning-workspace/SKILL.md", "slug": "mission-grounded-learning-workspace" }, "description": "Use when turning a learner's goal into a durable, workspace-scoped learning loop with explicit artifacts, source checks, lesson records, and safe file-write boundaries.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:project-skill-audit", "kind": "leaf", "title": "Project Skill Audit", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/project-skill-audit/SKILL.md", "slug": "Project Skill Audit" }, "description": "Analyze a project and recommend highest-value skills to create or update. Use when auditing project skills, getting skill recommendations, or reviewing existing skill coverage.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "low", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:shared-skill-library-governance", "kind": "leaf", "title": "Shared Skill Library Governance", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/shared-skill-library-governance/SKILL.md", "slug": "shared-skill-library-governance" }, "description": "Use when designing or operating a shared repository of agent skills so reusable skills stay canonical, reviewed, scoped to named collections, and exposed safely to each runtime.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:skill-structure", "kind": "leaf", "title": "Skill Structure", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/skill-structure/SKILL.md", "slug": "Skill Structure" }, "description": "Understand the anatomy of an agent skill — directory layout, frontmatter fields, progressive disclosure layers, and bundled resources. Use when designing a new skill, reviewing an existing skill's structure, or deciding what content goes in SKILL.md vs references/.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "low", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:skill-validation-checklist", "kind": "leaf", "title": "Skill Validation Checklist", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/skill-validation-checklist/SKILL.md", "slug": "Skill Validation Checklist" }, "description": "Validate a skill before publication. Use when reviewing a skill for structure, description quality, content organization, progressive disclosure, and common mistakes.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "low", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:validation-gated-skill-improvement", "kind": "leaf", "title": "Validation-Gated Skill Improvement", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/validation-gated-skill-improvement/SKILL.md", "slug": "validation-gated-skill-improvement" }, "description": "Use when improving an existing skill, playbook, runbook, or workflow entry so edits are bounded, tested against held-out tasks, and adopted only after evidence improves.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "group:dist:agent-operations:skill", "kind": "group", "title": "Skill", "children": [ "leaf:dist:command-basics", "leaf:dist:command-development", "leaf:dist:command-dynamic-features", "leaf:dist:command-frontmatter", "leaf:dist:command-organization", "leaf:dist:hook-basics", "leaf:dist:hook-events", "leaf:dist:mission-grounded-learning-workspace", "leaf:dist:project-skill-audit", "leaf:dist:shared-skill-library-governance", "leaf:dist:skill-structure", "leaf:dist:skill-validation-checklist", "leaf:dist:validation-gated-skill-improvement" ] }, { "id": "leaf:dist:completion-contract-loop", "kind": "leaf", "title": "Completion Contract Loop", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/completion-contract-loop/SKILL.md", "slug": "Completion Contract Loop" }, "description": "Define completion up front, track proof for every requirement, and prevent partial work from being reported as done. Use for long-running tasks, pull requests, runtime checks, or user-visible artifacts where a plausible partial result could be mistaken for completion.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "low", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:fresh-clone-loop", "kind": "leaf", "title": "Fresh Clone Loop", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/fresh-clone-loop/SKILL.md", "slug": "Fresh Clone Loop" }, "description": "Onboarding verification loop — clone a repo into a clean environment, follow the README exactly, fix every hidden setup assumption, and repeat until onboarding works from scratch. Use to test whether a repository's README really works for a new contributor.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:planning-with-files", "kind": "leaf", "title": "Planning with Files", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/planning-with-files/SKILL.md", "slug": "Planning with Files" }, "description": "Manus-style file-based planning for complex tasks. Creates task_plan.md, findings.md, and progress.md as persistent working memory on disk. Use when planning multi-step projects, research tasks, or any work requiring 5+ tool calls. Supports session recovery after /clear.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "low", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:teaching-workspace", "kind": "leaf", "title": "Teaching Workspace", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/teaching-workspace/SKILL.md", "slug": "Teaching Workspace" }, "description": "Teach the user a new skill or concept within a stateful workspace. Use when the user says \"teach me\", \"I want to learn\", or wants to build a structured learning experience with lessons, reference docs, and progress tracking.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "low", "classification_status": "complete", "catalog_decision": false } }, { "id": "group:dist:agent-operations:workflow", "kind": "group", "title": "Workflow", "children": [ "leaf:dist:completion-contract-loop", "leaf:dist:fresh-clone-loop", "leaf:dist:planning-with-files", "leaf:dist:teaching-workspace" ] }, { "id": "category:dist:agent-operations", "kind": "category", "title": "Agent Operations", "children": [ "group:dist:agent-operations:playbook", "group:dist:agent-operations:reference", "group:dist:agent-operations:skill", "group:dist:agent-operations:workflow" ] }, { "id": "leaf:dist:acceptance-orchestrator", "kind": "leaf", "title": "Acceptance Orchestrator", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/acceptance-orchestrator/SKILL.md", "slug": "acceptance-orchestrator" }, "description": "Orchestrate coding work as a state machine that ends only when acceptance criteria are verified with evidence or the task is explicitly escalated.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:achieving-cmmc-level-2-compliance", "kind": "leaf", "title": "Achieving CMMC Level 2 Compliance", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/achieving-cmmc-level-2-compliance/SKILL.md", "slug": "achieving-cmmc-level-2-compliance" }, "description": "Guides CMMC Level 2 readiness work when a Defense Industrial Base organization must scope CUI, score NIST SP 800-171 controls, prepare POA&Ms, and plan assessment evidence.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-ethereum-smart-contract-vulnerabilities", "kind": "leaf", "title": "Analyzing Ethereum Smart Contract Vulnerabilities", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-ethereum-smart-contract-vulnerabilities/SKILL.md", "slug": "Analyzing Ethereum Smart Contract Vulnerabilities" }, "description": "Perform static and symbolic analysis of Solidity smart contracts using", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-network-packets-with-scapy", "kind": "leaf", "title": "Analyzing Network Packets with Scapy", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-network-packets-with-scapy/SKILL.md", "slug": "Analyzing Network Packets with Scapy" }, "description": "Craft, send, sniff, and dissect network packets using Scapy for protocol", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:building-patch-tuesday-response-process", "kind": "leaf", "title": "Building Patch Tuesday Response Process", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/building-patch-tuesday-response-process/SKILL.md", "slug": "Building Patch Tuesday Response Process" }, "description": "Establish a structured operational process to triage, test, and deploy", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:building-role-mining-for-rbac-optimization", "kind": "leaf", "title": "Building Role Mining for RBAC Optimization", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/building-role-mining-for-rbac-optimization/SKILL.md", "slug": "Building Role Mining for RBAC Optimization" }, "description": "Apply bottom-up and top-down role mining techniques to discover optimal", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:change-management", "kind": "leaf", "title": "Change Management Playbook", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/change-management/SKILL.md", "slug": "change-management" }, "description": "ADKAR-based organizational change management for startups. Covers process changes, org restructures, strategy pivots, and culture changes. Use when announcing a reorg, switching tools, pivoting strategy, killing a product, or managing change resistance.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "low", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:channel-economics", "kind": "leaf", "title": "Channel Economics", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/channel-economics/SKILL.md", "slug": "channel-economics" }, "description": "Analyze and rebalance direct vs. partner-led channel economics. Answers three questions at the quarterly channel review:", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "low", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:compliance-os", "kind": "leaf", "title": "Compliance OS — Multi-Framework Compliance Orchestration", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/compliance-os/SKILL.md", "slug": "Compliance OS — Multi-Framework Compliance Orchestration" }, "description": "Meta-orchestrator for compliance teams. CONFIGURE which frameworks apply, COMPUTE cross-framework control overlap, SIMULATE internal audits, and CONSOLIDATE evidence across multiple frameworks. Supports ISO 27001/13485/42001/14971, EU AI Act, MDR 745, GDPR, SOC 2, FDA QSR, NIST CSF 2.0, NIS2, HIPAA. Does NOT replace per-framework skills — it orchestrates them.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:configuring-identity-aware-proxy-with-google-iap", "kind": "leaf", "title": "Configuring Identity-Aware Proxy with Google IAP", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/configuring-identity-aware-proxy-with-google-iap/SKILL.md", "slug": "Configuring Identity-Aware Proxy with Google IAP" }, "description": "Configuring Google Cloud Identity-Aware Proxy (IAP) to enforce per-request", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:grilling", "kind": "leaf", "title": "grilling", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/grilling/SKILL.md", "slug": "grilling" }, "description": "Interview the user relentlessly about a plan or design. Use when the user wants to stress-test a plan before building, or uses any 'grill' trigger phrases.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:gstack-openclaw-office-hours", "kind": "leaf", "title": "YC Office Hours", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/gstack-openclaw-office-hours/SKILL.md", "slug": "gstack-openclaw-office-hours" }, "description": "Use when asked to brainstorm, evaluate whether an idea is worth building, run office hours, or think through a new product idea or design direction before any code is written.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-application-whitelisting-with-applocker", "kind": "leaf", "title": "Implementing Application Whitelisting with AppLocker", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-application-whitelisting-with-applocker/SKILL.md", "slug": "Implementing Application Whitelisting with AppLocker" }, "description": "Implements application whitelisting using Windows AppLocker to restrict", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-conduit-security-for-ot-remote-access", "kind": "leaf", "title": "Implementing Conduit Security for OT Remote Access", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-conduit-security-for-ot-remote-access/SKILL.md", "slug": "Implementing Conduit Security for OT Remote Access" }, "description": "Implement secure conduit architecture for OT remote access following", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-container-network-policies-with-calico", "kind": "leaf", "title": "Implementing Container Network Policies with Calico", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-container-network-policies-with-calico/SKILL.md", "slug": "Implementing Container Network Policies with Calico" }, "description": "Enforce Kubernetes network segmentation using Calico CNI network policies", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-endpoint-dlp-controls", "kind": "leaf", "title": "Implementing Endpoint DLP Controls", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-endpoint-dlp-controls/SKILL.md", "slug": "Implementing Endpoint DLP Controls" }, "description": "Implements endpoint Data Loss Prevention (DLP) controls to detect and", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-gcp-organization-policy-constraints", "kind": "leaf", "title": "Implementing GCP Organization Policy Constraints", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-gcp-organization-policy-constraints/SKILL.md", "slug": "Implementing GCP Organization Policy Constraints" }, "description": "Implement GCP Organization Policy constraints to enforce security guardrails", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-gdpr-data-protection-controls", "kind": "leaf", "title": "Implementing GDPR Data Protection Controls", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-gdpr-data-protection-controls/SKILL.md", "slug": "Implementing GDPR Data Protection Controls" }, "description": "The General Data Protection Regulation (EU) 2016/679 (GDPR) is the EU's", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-ics-firewall-with-tofino", "kind": "leaf", "title": "Implementing ICS Firewall with Tofino", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-ics-firewall-with-tofino/SKILL.md", "slug": "Implementing ICS Firewall with Tofino" }, "description": "Deploy and configure Tofino industrial firewalls from Belden/Hirschmann", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-identity-governance-with-sailpoint", "kind": "leaf", "title": "Implementing Identity Governance with SailPoint", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-identity-governance-with-sailpoint/SKILL.md", "slug": "Implementing Identity Governance with SailPoint" }, "description": "Deploy SailPoint IdentityNow or IdentityIQ for identity governance and", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-iso-27001-information-security-management", "kind": "leaf", "title": "Implementing ISO 27001 Information Security Management", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-iso-27001-information-security-management/SKILL.md", "slug": "Implementing ISO 27001 Information Security Management" }, "description": "ISO/IEC 27001:2022 is the international standard for establishing, implementing,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-just-in-time-access-provisioning", "kind": "leaf", "title": "Implementing Just-In-Time Access Provisioning", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-just-in-time-access-provisioning/SKILL.md", "slug": "Implementing Just-In-Time Access Provisioning" }, "description": "Implement Just-In-Time (JIT) access provisioning to eliminate standing", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-passwordless-authentication-with-fido2", "kind": "leaf", "title": "Implementing Passwordless Authentication with FIDO2", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-passwordless-authentication-with-fido2/SKILL.md", "slug": "Implementing Passwordless Authentication with FIDO2" }, "description": "Deploy FIDO2/WebAuthn passwordless authentication using security keys", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-patch-management-for-ot-systems", "kind": "leaf", "title": "Implementing Patch Management for OT Systems", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-patch-management-for-ot-systems/SKILL.md", "slug": "Implementing Patch Management for OT Systems" }, "description": "This skill covers implementing a structured patch management program", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-purdue-model-network-segmentation", "kind": "leaf", "title": "Implementing Purdue Model Network Segmentation", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-purdue-model-network-segmentation/SKILL.md", "slug": "Implementing Purdue Model Network Segmentation" }, "description": "Implement network segmentation based on the Purdue Enterprise Reference", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-zero-trust-with-beyondcorp", "kind": "leaf", "title": "Implementing Zero Trust with BeyondCorp", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-zero-trust-with-beyondcorp/SKILL.md", "slug": "Implementing Zero Trust with BeyondCorp" }, "description": "Deploy Google BeyondCorp Enterprise zero trust access controls using", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:loop-engineering", "kind": "leaf", "title": "Loop Engineering", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/loop-engineering/SKILL.md", "slug": "Loop Engineering" }, "description": "Design bounded, observable, and auditable agent loops. Use when creating or evaluating any repeatable agent cycle (reconciliation, review, discovery, ingestion, etc).", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:marketplace-skill-triage", "kind": "leaf", "title": "Marketplace Skill Triage", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/marketplace-skill-triage/SKILL.md", "slug": "marketplace-skill-triage" }, "description": "Triage skills from public marketplaces and aggregators using evidence-based scoring rather than popularity alone. Use when evaluating candidate skills from skills.sh, awesome lists, GitHub marketplaces, or arXiv-backed skill research. Covers license checks, duplicate-intent detection, executable-surface analysis, maintainer verification, and evaluation-evidence scoring.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:partnerships-architect", "kind": "leaf", "title": "Partnerships Architect", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/partnerships-architect/SKILL.md", "slug": "partnerships-architect" }, "description": "Evaluate and structure business partnerships. Answers four questions when a prospective partner shows up:", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "low", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-access-recertification-with-saviynt", "kind": "leaf", "title": "Performing Access Recertification with Saviynt", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-access-recertification-with-saviynt/SKILL.md", "slug": "Performing Access Recertification with Saviynt" }, "description": "Configure and execute access recertification campaigns in Saviynt Enterprise", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-access-review-and-certification", "kind": "leaf", "title": "Performing Access Review and Certification", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-access-review-and-certification/SKILL.md", "slug": "Performing Access Review and Certification" }, "description": "Conduct systematic access reviews and certifications to ensure users", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-entitlement-review-with-sailpoint-iiq", "kind": "leaf", "title": "Performing Entitlement Review with SailPoint IdentityIQ", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-entitlement-review-with-sailpoint-iiq/SKILL.md", "slug": "Performing Entitlement Review with SailPoint IdentityIQ" }, "description": "Performs entitlement review and access certification campaigns using", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-ics-asset-discovery-with-claroty", "kind": "leaf", "title": "Performing ICS Asset Discovery with Claroty", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-ics-asset-discovery-with-claroty/SKILL.md", "slug": "Performing ICS Asset Discovery with Claroty" }, "description": "Perform comprehensive ICS/OT asset discovery using Claroty xDome platform,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-insider-threat-investigation", "kind": "leaf", "title": "Performing Insider Threat Investigation", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-insider-threat-investigation/SKILL.md", "slug": "Performing Insider Threat Investigation" }, "description": "Investigates insider threat incidents involving employees, contractors,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-nist-csf-maturity-assessment", "kind": "leaf", "title": "Performing NIST CSF Maturity Assessment", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-nist-csf-maturity-assessment/SKILL.md", "slug": "Performing NIST CSF Maturity Assessment" }, "description": "The NIST Cybersecurity Framework (CSF) 2.0, released in February 2024,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-oil-gas-cybersecurity-assessment", "kind": "leaf", "title": "Performing Oil & Gas Cybersecurity Assessment", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-oil-gas-cybersecurity-assessment/SKILL.md", "slug": "Performing Oil & Gas Cybersecurity Assessment" }, "description": "This skill covers conducting cybersecurity assessments specific to oil", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-privacy-impact-assessment", "kind": "leaf", "title": "Performing Privacy Impact Assessment", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-privacy-impact-assessment/SKILL.md", "slug": "Performing Privacy Impact Assessment" }, "description": "Automates the Privacy Impact Assessment (PIA) workflow including data", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-soc2-type2-audit-preparation", "kind": "leaf", "title": "Performing SOC 2 Type II Audit Preparation", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-soc2-type2-audit-preparation/SKILL.md", "slug": "Performing SOC 2 Type II Audit Preparation" }, "description": "Automates SOC 2 Type II audit preparation including gap assessment against", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:procurement-optimizer", "kind": "leaf", "title": "Procurement Optimizer — Spend Categorization and Supplier Rationalization", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/procurement-optimizer/SKILL.md", "slug": "Procurement Optimizer — Spend Categorization and Supplier Rationalization" }, "description": "Run annual SaaS audits, category-level spend reviews, and supplier rationalization. Categorize spend (UNSPSC-aligned with Pareto breakdown), purchasing-cycle analysis (bottleneck categories per Theory of Constraints), and risk-balanced supplier consolidation that refuses single-source recommendations for tier-1 categories without a documented break-glass plan.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:request-refactor-plan", "kind": "leaf", "title": "request-refactor-plan", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/request-refactor-plan/SKILL.md", "slug": "request-refactor-plan" }, "description": "Create a detailed refactor plan with tiny commits via user interview, then file it as a GitHub issue. Use when user wants to plan a refactor, create a refactoring RFC, or break a refactor into safe incremental steps.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:revenue-operations", "kind": "leaf", "title": "Revenue Operations", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/revenue-operations/SKILL.md", "slug": "SaaS Revenue Operations" }, "description": "Analyze sales pipeline health, revenue forecasting accuracy, and go-to-market efficiency metrics for SaaS revenue optimization.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:securing-historian-server-in-ot-environment", "kind": "leaf", "title": "Securing Historian Server in OT Environment", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/securing-historian-server-in-ot-environment/SKILL.md", "slug": "Securing Historian Server in OT Environment" }, "description": "This skill covers hardening and securing process historian servers (OSIsoft", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:setup-matt-pocock-skills", "kind": "leaf", "title": "Setup Matt Pocock's Skills", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/setup-matt-pocock-skills/SKILL.md", "slug": "setup-matt-pocock-skills" }, "description": "Configure this repo for the engineering skills — set up its issue tracker, triage label vocabulary, and domain doc layout. Run once before first use of the other engineering skills.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:teach", "kind": "leaf", "title": "teach", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/teach/SKILL.md", "slug": "teach" }, "description": "Teach the user a new skill or concept, within this workspace.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:to-issues", "kind": "leaf", "title": "To Issues", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/to-issues/SKILL.md", "slug": "to-issues" }, "description": "Break a plan, spec, or PRD into independently-grabbable issues on the project issue tracker using tracer-bullet vertical slices.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:to-prd", "kind": "leaf", "title": "to-prd", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/to-prd/SKILL.md", "slug": "to-prd" }, "description": "Turn the current conversation into a PRD and publish it to the project issue tracker — no interview, just synthesis of what you've already discussed.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:ubiquitous-language", "kind": "leaf", "title": "Ubiquitous Language", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/ubiquitous-language/SKILL.md", "slug": "ubiquitous-language" }, "description": "Extract a DDD-style ubiquitous language glossary from the current conversation, flagging ambiguities and proposing canonical terms. Saves to UBIQUITOUS_LANGUAGE.md. Use when user wants to define domain terms, build a glossary, harden terminology, create a ubiquitous language, or mentions \"domain model\" or \"DDD\".", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:vendor-management", "kind": "leaf", "title": "Vendor Management — Scorecard, SLA Tracking, and Third-Party Risk", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/vendor-management/SKILL.md", "slug": "Vendor Management — Scorecard, SLA Tracking, and Third-Party Risk" }, "description": "Review, score, and audit third-party SaaS/vendor relationships. Run vendor scorecards with industry tuning, track SLA compliance with credit-claim flags, classify third-party risk across 4 risk vectors, prepare tier-1 vendor reviews, and audit the SaaS portfolio. Produces KEEP / REVIEW / REPLACE recommendations with deterministic scoring.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "group:dist:business:playbook", "kind": "group", "title": "Playbook", "children": [ "leaf:dist:acceptance-orchestrator", "leaf:dist:achieving-cmmc-level-2-compliance", "leaf:dist:analyzing-ethereum-smart-contract-vulnerabilities", "leaf:dist:analyzing-network-packets-with-scapy", "leaf:dist:building-patch-tuesday-response-process", "leaf:dist:building-role-mining-for-rbac-optimization", "leaf:dist:change-management", "leaf:dist:channel-economics", "leaf:dist:compliance-os", "leaf:dist:configuring-identity-aware-proxy-with-google-iap", "leaf:dist:grilling", "leaf:dist:gstack-openclaw-office-hours", "leaf:dist:implementing-application-whitelisting-with-applocker", "leaf:dist:implementing-conduit-security-for-ot-remote-access", "leaf:dist:implementing-container-network-policies-with-calico", "leaf:dist:implementing-endpoint-dlp-controls", "leaf:dist:implementing-gcp-organization-policy-constraints", "leaf:dist:implementing-gdpr-data-protection-controls", "leaf:dist:implementing-ics-firewall-with-tofino", "leaf:dist:implementing-identity-governance-with-sailpoint", "leaf:dist:implementing-iso-27001-information-security-management", "leaf:dist:implementing-just-in-time-access-provisioning", "leaf:dist:implementing-passwordless-authentication-with-fido2", "leaf:dist:implementing-patch-management-for-ot-systems", "leaf:dist:implementing-purdue-model-network-segmentation", "leaf:dist:implementing-zero-trust-with-beyondcorp", "leaf:dist:loop-engineering", "leaf:dist:marketplace-skill-triage", "leaf:dist:partnerships-architect", "leaf:dist:performing-access-recertification-with-saviynt", "leaf:dist:performing-access-review-and-certification", "leaf:dist:performing-entitlement-review-with-sailpoint-iiq", "leaf:dist:performing-ics-asset-discovery-with-claroty", "leaf:dist:performing-insider-threat-investigation", "leaf:dist:performing-nist-csf-maturity-assessment", "leaf:dist:performing-oil-gas-cybersecurity-assessment", "leaf:dist:performing-privacy-impact-assessment", "leaf:dist:performing-soc2-type2-audit-preparation", "leaf:dist:procurement-optimizer", "leaf:dist:request-refactor-plan", "leaf:dist:revenue-operations", "leaf:dist:securing-historian-server-in-ot-environment", "leaf:dist:setup-matt-pocock-skills", "leaf:dist:teach", "leaf:dist:to-issues", "leaf:dist:to-prd", "leaf:dist:ubiquitous-language", "leaf:dist:vendor-management" ] }, { "id": "leaf:dist:ai-seo", "kind": "leaf", "title": "AI SEO", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/ai-seo/SKILL.md", "slug": "ai-seo" }, "description": "Optimize content for AI search and LLM citations across AI Overviews, ChatGPT, Perplexity, Claude, Gemini, and similar systems. Covers AI visibility audit, three-pillar optimization strategy (structure/authority/presence), and monitoring.", "trust": { "lifecycle_status": "superseded", "install_recommendation": "do-not-install", "risk_level": "medium", "classification_status": "complete", "catalog_decision": true } }, { "id": "group:dist:business:skill", "kind": "group", "title": "Skill", "children": [ "leaf:dist:ai-seo" ] }, { "id": "leaf:dist:competitive-intel", "kind": "leaf", "title": "Competitive Intelligence", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/competitive-intel/SKILL.md", "slug": "competitive-intel" }, "description": "Systematic competitor tracking that feeds positioning, battlecards, and roadmap decisions. Use when analyzing competitors, building sales battlecards, tracking market moves, or positioning against alternatives.", "trust": { "lifecycle_status": "reviewed", "install_recommendation": "conditional", "risk_level": "medium", "classification_status": "complete", "catalog_decision": true } }, { "id": "leaf:dist:landing-report", "kind": "leaf", "title": "landing-report", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/landing-report/SKILL.md", "slug": "landing-report" }, "description": "Read-only queue dashboard for workspace-aware ship. (gstack)", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "low", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:meeting-intelligence", "kind": "leaf", "title": "Meeting Intelligence", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/meeting-intelligence/SKILL.md", "slug": "meeting-intelligence" }, "description": "Prepare meeting materials by gathering context from knowledge bases, drafting agendas/pre-reads, and tailoring content to attendees. Use when the user wants to prep for meetings with structured agendas, context gathering, and attendee-specific materials. Works with or without Notion.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "group:dist:business:workflow", "kind": "group", "title": "Workflow", "children": [ "leaf:dist:competitive-intel", "leaf:dist:landing-report", "leaf:dist:meeting-intelligence" ] }, { "id": "category:dist:business", "kind": "category", "title": "Business", "children": [ "group:dist:business:playbook", "group:dist:business:skill", "group:dist:business:workflow" ] }, { "id": "leaf:dist:analyzing-azure-activity-logs-for-threats", "kind": "leaf", "title": "Analyzing Azure Activity Logs for Threats", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-azure-activity-logs-for-threats/SKILL.md", "slug": "Analyzing Azure Activity Logs for Threats" }, "description": "Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-cloud-storage-access-patterns", "kind": "leaf", "title": "Analyzing Cloud Storage Access Patterns", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-cloud-storage-access-patterns/SKILL.md", "slug": "Analyzing Cloud Storage Access Patterns" }, "description": "Detect abnormal access patterns in AWS S3, GCS, and Azure Blob Storage", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-kubernetes-audit-logs", "kind": "leaf", "title": "Analyzing Kubernetes Audit Logs", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-kubernetes-audit-logs/SKILL.md", "slug": "analyzing-kubernetes-audit-logs" }, "description": "Analyzes Kubernetes API server audit logs when defenders need to detect pod exec activity, secret access, RBAC escalation, privileged pod creation, or unauthenticated API use.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:auditing-aws-s3-bucket-permissions", "kind": "leaf", "title": "Auditing AWS S3 Bucket Permissions", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/auditing-aws-s3-bucket-permissions/SKILL.md", "slug": "Auditing AWS S3 Bucket Permissions" }, "description": "Systematically audit AWS S3 bucket permissions to identify publicly", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:auditing-azure-active-directory-configuration", "kind": "leaf", "title": "Auditing Azure Active Directory Configuration", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/auditing-azure-active-directory-configuration/SKILL.md", "slug": "Auditing Azure Active Directory Configuration" }, "description": "Auditing Microsoft Entra ID (Azure Active Directory) configuration to", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:auditing-gcp-iam-permissions", "kind": "leaf", "title": "Auditing GCP IAM Permissions", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/auditing-gcp-iam-permissions/SKILL.md", "slug": "Auditing GCP IAM Permissions" }, "description": "Auditing Google Cloud Platform IAM permissions to identify overly permissive", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:auditing-kubernetes-cluster-rbac", "kind": "leaf", "title": "Auditing Kubernetes Cluster RBAC", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/auditing-kubernetes-cluster-rbac/SKILL.md", "slug": "Auditing Kubernetes Cluster RBAC" }, "description": "Auditing Kubernetes cluster RBAC configurations to identify overly permissive", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:configuring-aws-verified-access-for-ztna", "kind": "leaf", "title": "Configuring AWS Verified Access for ZTNA", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/configuring-aws-verified-access-for-ztna/SKILL.md", "slug": "Configuring AWS Verified Access for ZTNA" }, "description": "Configure AWS Verified Access to provide VPN-less zero trust network", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:detecting-aws-iam-privilege-escalation", "kind": "leaf", "title": "Detecting AWS IAM Privilege Escalation", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-aws-iam-privilege-escalation/SKILL.md", "slug": "Detecting AWS IAM Privilege Escalation" }, "description": "Detect AWS IAM privilege escalation paths using boto3 and Cloudsplaining", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:detecting-azure-lateral-movement", "kind": "leaf", "title": "Detecting Azure Lateral Movement", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-azure-lateral-movement/SKILL.md", "slug": "Detecting Azure Lateral Movement" }, "description": "Detect lateral movement in Azure AD/Entra ID environments using Microsoft", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:detecting-azure-storage-account-misconfigurations", "kind": "leaf", "title": "Detecting Azure Storage Account Misconfigurations", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-azure-storage-account-misconfigurations/SKILL.md", "slug": "Detecting Azure Storage Account Misconfigurations" }, "description": "Audit Azure Blob and ADLS storage accounts for public access exposure,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:detecting-compromised-cloud-credentials", "kind": "leaf", "title": "Detecting Compromised Cloud Credentials", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-compromised-cloud-credentials/SKILL.md", "slug": "Detecting Compromised Cloud Credentials" }, "description": "Detecting compromised cloud credentials across AWS, Azure, and GCP by", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:detecting-misconfigured-azure-storage", "kind": "leaf", "title": "Detecting Misconfigured Azure Storage", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-misconfigured-azure-storage/SKILL.md", "slug": "Detecting Misconfigured Azure Storage" }, "description": "Detecting misconfigured Azure Storage accounts including publicly accessible", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:detecting-s3-data-exfiltration-attempts", "kind": "leaf", "title": "Detecting S3 Data Exfiltration Attempts", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-s3-data-exfiltration-attempts/SKILL.md", "slug": "Detecting S3 Data Exfiltration Attempts" }, "description": "Detecting data exfiltration attempts from AWS S3 buckets by analyzing", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:detecting-shadow-it-cloud-usage", "kind": "leaf", "title": "Detecting Shadow IT Cloud Usage", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-shadow-it-cloud-usage/SKILL.md", "slug": "Detecting Shadow IT Cloud Usage" }, "description": "Detect unauthorized SaaS and cloud service usage (shadow IT) by analyzing", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:emulating-cloud-attacks-with-stratus-red-team", "kind": "leaf", "title": "Emulating Cloud Attacks with Stratus Red Team", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/emulating-cloud-attacks-with-stratus-red-team/SKILL.md", "slug": "Emulating Cloud Attacks with Stratus Red Team" }, "description": "Detonate granular AWS, Azure, GCP, and Kubernetes attack techniques to validate", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-aws-config-rules-for-compliance", "kind": "leaf", "title": "Implementing AWS Config Rules for Compliance", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-aws-config-rules-for-compliance/SKILL.md", "slug": "Implementing AWS Config Rules for Compliance" }, "description": "Implementing AWS Config rules for continuous compliance monitoring of", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-aws-iam-permission-boundaries", "kind": "leaf", "title": "Implementing AWS IAM Permission Boundaries", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-aws-iam-permission-boundaries/SKILL.md", "slug": "Implementing AWS IAM Permission Boundaries" }, "description": "Configure IAM permission boundaries in AWS to delegate role creation", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-aws-macie-for-data-classification", "kind": "leaf", "title": "Implementing AWS Macie for Data Classification", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-aws-macie-for-data-classification/SKILL.md", "slug": "Implementing AWS Macie for Data Classification" }, "description": "Implement Amazon Macie to automatically discover, classify, and protect", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-aws-security-hub", "kind": "leaf", "title": "Implementing AWS Security Hub", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-aws-security-hub/SKILL.md", "slug": "Implementing AWS Security Hub" }, "description": "This skill covers deploying AWS Security Hub as a centralized cloud", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-azure-defender-for-cloud", "kind": "leaf", "title": "Implementing Azure Defender for Cloud", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-azure-defender-for-cloud/SKILL.md", "slug": "Implementing Azure Defender for Cloud" }, "description": "Implementing Microsoft Defender for Cloud to enable cloud security posture", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:implementing-cloud-dlp-for-data-protection", "kind": "leaf", "title": "Implementing Cloud DLP for Data Protection", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-cloud-dlp-for-data-protection/SKILL.md", "slug": "Implementing Cloud DLP for Data Protection" }, "description": "Implementing Cloud Data Loss Prevention (DLP) using Amazon Macie, Azure", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:implementing-cloud-trail-log-analysis", "kind": "leaf", "title": "Implementing CloudTrail Log Analysis", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-cloud-trail-log-analysis/SKILL.md", "slug": "Implementing CloudTrail Log Analysis" }, "description": "Implementing AWS CloudTrail log analysis for security monitoring, threat", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:implementing-cloud-vulnerability-posture-management", "kind": "leaf", "title": "Implementing Cloud Vulnerability Posture Management", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-cloud-vulnerability-posture-management/SKILL.md", "slug": "Implementing Cloud Vulnerability Posture Management" }, "description": "Implement Cloud Security Posture Management using AWS Security Hub, Azure", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-cloud-waf-rules", "kind": "leaf", "title": "Implementing Cloud WAF Rules", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-cloud-waf-rules/SKILL.md", "slug": "Implementing Cloud WAF Rules" }, "description": "This skill covers deploying and tuning Web Application Firewall rules", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-conditional-access-policies-azure-ad", "kind": "leaf", "title": "Implementing Conditional Access Policies in Azure AD", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-conditional-access-policies-azure-ad/SKILL.md", "slug": "Implementing Conditional Access Policies in Azure AD" }, "description": "Configure Microsoft Entra ID (Azure AD) Conditional Access policies for", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-envelope-encryption-with-aws-kms", "kind": "leaf", "title": "Implementing Envelope Encryption with AWS KMS", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-envelope-encryption-with-aws-kms/SKILL.md", "slug": "Implementing Envelope Encryption with AWS KMS" }, "description": "Envelope encryption is a strategy where data is encrypted with a data", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-gcp-vpc-firewall-rules", "kind": "leaf", "title": "Implementing GCP VPC Firewall Rules", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-gcp-vpc-firewall-rules/SKILL.md", "slug": "Implementing GCP VPC Firewall Rules" }, "description": "Implementing and auditing GCP VPC firewall rules to enforce network", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:implementing-google-workspace-admin-security", "kind": "leaf", "title": "Implementing Google Workspace Admin Security", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-google-workspace-admin-security/SKILL.md", "slug": "Implementing Google Workspace Admin Security" }, "description": "Implements comprehensive Google Workspace security hardening including", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:implementing-security-monitoring-with-datadog", "kind": "leaf", "title": "Implementing Security Monitoring with Datadog", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-security-monitoring-with-datadog/SKILL.md", "slug": "Implementing Security Monitoring with Datadog" }, "description": "Implements security monitoring using Datadog Cloud SIEM, Cloud Security", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:implementing-zero-standing-privilege-with-cyberark", "kind": "leaf", "title": "Implementing Zero Standing Privilege with CyberArk", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-zero-standing-privilege-with-cyberark/SKILL.md", "slug": "Implementing Zero Standing Privilege with CyberArk" }, "description": "Deploy CyberArk Secure Cloud Access to eliminate standing privileges", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-zero-trust-network-access", "kind": "leaf", "title": "Implementing Zero Trust Network Access", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-zero-trust-network-access/SKILL.md", "slug": "Implementing Zero Trust Network Access" }, "description": "Implementing Zero Trust Network Access (ZTNA) in cloud environments", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:performing-aws-account-enumeration-with-scout-suite", "kind": "leaf", "title": "Performing AWS Account Enumeration with ScoutSuite", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-aws-account-enumeration-with-scout-suite/SKILL.md", "slug": "Performing AWS Account Enumeration with ScoutSuite" }, "description": "Perform comprehensive security posture assessment of AWS accounts using", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-aws-privilege-escalation-assessment", "kind": "leaf", "title": "Performing AWS Privilege Escalation Assessment", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-aws-privilege-escalation-assessment/SKILL.md", "slug": "Performing AWS Privilege Escalation Assessment" }, "description": "Performing authorized privilege escalation assessments in AWS environments", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-cloud-asset-inventory-with-cartography", "kind": "leaf", "title": "Performing Cloud Asset Inventory with Cartography", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-cloud-asset-inventory-with-cartography/SKILL.md", "slug": "Performing Cloud Asset Inventory with Cartography" }, "description": "Perform comprehensive cloud asset inventory and relationship mapping", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-cloud-forensics-with-aws-cloudtrail", "kind": "leaf", "title": "Performing Cloud Forensics with AWS CloudTrail", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-cloud-forensics-with-aws-cloudtrail/SKILL.md", "slug": "Performing Cloud Forensics with AWS CloudTrail" }, "description": "Perform forensic investigation of AWS environments using CloudTrail logs", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:performing-cloud-incident-containment-procedures", "kind": "leaf", "title": "Performing Cloud Incident Containment Procedures", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-cloud-incident-containment-procedures/SKILL.md", "slug": "Performing Cloud Incident Containment Procedures" }, "description": "Execute cloud-native incident containment across AWS, Azure, and GCP", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-cloud-native-threat-hunting-with-aws-detective", "kind": "leaf", "title": "Performing Cloud-Native Threat Hunting with AWS Detective", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-cloud-native-threat-hunting-with-aws-detective/SKILL.md", "slug": "Performing Cloud-Native Threat Hunting with AWS Detective" }, "description": "Hunt for threats in AWS environments using Detective behavior graphs,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:performing-cloud-penetration-testing-with-pacu", "kind": "leaf", "title": "Performing Cloud Penetration Testing with Pacu", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-cloud-penetration-testing-with-pacu/SKILL.md", "slug": "Performing Cloud Penetration Testing with Pacu" }, "description": "Performing authorized AWS penetration testing using Pacu, the open-source", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:performing-gcp-security-assessment-with-forseti", "kind": "leaf", "title": "Performing GCP Security Assessment with Forseti", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-gcp-security-assessment-with-forseti/SKILL.md", "slug": "Performing GCP Security Assessment with Forseti" }, "description": "Performing comprehensive security assessments of Google Cloud Platform", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:remediating-s3-bucket-misconfiguration", "kind": "leaf", "title": "Remediating S3 Bucket Misconfiguration", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/remediating-s3-bucket-misconfiguration/SKILL.md", "slug": "Remediating S3 Bucket Misconfiguration" }, "description": "This skill provides step-by-step procedures for identifying and remediating", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:securing-aws-lambda-execution-roles", "kind": "leaf", "title": "Securing AWS Lambda Execution Roles", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/securing-aws-lambda-execution-roles/SKILL.md", "slug": "Securing AWS Lambda Execution Roles" }, "description": "Securing AWS Lambda execution roles by implementing least-privilege", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "group:dist:cloud-security:playbook", "kind": "group", "title": "Playbook", "children": [ "leaf:dist:analyzing-azure-activity-logs-for-threats", "leaf:dist:analyzing-cloud-storage-access-patterns", "leaf:dist:analyzing-kubernetes-audit-logs", "leaf:dist:auditing-aws-s3-bucket-permissions", "leaf:dist:auditing-azure-active-directory-configuration", "leaf:dist:auditing-gcp-iam-permissions", "leaf:dist:auditing-kubernetes-cluster-rbac", "leaf:dist:configuring-aws-verified-access-for-ztna", "leaf:dist:detecting-aws-iam-privilege-escalation", "leaf:dist:detecting-azure-lateral-movement", "leaf:dist:detecting-azure-storage-account-misconfigurations", "leaf:dist:detecting-compromised-cloud-credentials", "leaf:dist:detecting-misconfigured-azure-storage", "leaf:dist:detecting-s3-data-exfiltration-attempts", "leaf:dist:detecting-shadow-it-cloud-usage", "leaf:dist:emulating-cloud-attacks-with-stratus-red-team", "leaf:dist:implementing-aws-config-rules-for-compliance", "leaf:dist:implementing-aws-iam-permission-boundaries", "leaf:dist:implementing-aws-macie-for-data-classification", "leaf:dist:implementing-aws-security-hub", "leaf:dist:implementing-azure-defender-for-cloud", "leaf:dist:implementing-cloud-dlp-for-data-protection", "leaf:dist:implementing-cloud-trail-log-analysis", "leaf:dist:implementing-cloud-vulnerability-posture-management", "leaf:dist:implementing-cloud-waf-rules", "leaf:dist:implementing-conditional-access-policies-azure-ad", "leaf:dist:implementing-envelope-encryption-with-aws-kms", "leaf:dist:implementing-gcp-vpc-firewall-rules", "leaf:dist:implementing-google-workspace-admin-security", "leaf:dist:implementing-security-monitoring-with-datadog", "leaf:dist:implementing-zero-standing-privilege-with-cyberark", "leaf:dist:implementing-zero-trust-network-access", "leaf:dist:performing-aws-account-enumeration-with-scout-suite", "leaf:dist:performing-aws-privilege-escalation-assessment", "leaf:dist:performing-cloud-asset-inventory-with-cartography", "leaf:dist:performing-cloud-forensics-with-aws-cloudtrail", "leaf:dist:performing-cloud-incident-containment-procedures", "leaf:dist:performing-cloud-native-threat-hunting-with-aws-detective", "leaf:dist:performing-cloud-penetration-testing-with-pacu", "leaf:dist:performing-gcp-security-assessment-with-forseti", "leaf:dist:remediating-s3-bucket-misconfiguration", "leaf:dist:securing-aws-lambda-execution-roles" ] }, { "id": "category:dist:cloud-security", "kind": "category", "title": "Cloud Security", "children": [ "group:dist:cloud-security:playbook" ] }, { "id": "leaf:dist:a11y-audit", "kind": "leaf", "title": "Accessibility Audit", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/a11y-audit/SKILL.md", "slug": "a11y-audit" }, "description": "WCAG 2.2 accessibility audit pipeline — scan, fix, and verify Level A/AA compliance across React, Next.js, Vue, Angular, Svelte, and plain HTML. Use when auditing accessibility, fixing a11y violations, checking color contrast, generating compliance reports, or integrating a11y checks into CI/CD.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-sbom-for-supply-chain-vulnerabilities", "kind": "leaf", "title": "Analyzing SBOM for Supply Chain Vulnerabilities", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-sbom-for-supply-chain-vulnerabilities/SKILL.md", "slug": "Analyzing SBOM for Supply Chain Vulnerabilities" }, "description": "Parses Software Bill of Materials (SBOM) in CycloneDX and SPDX JSON", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:ask-matt", "kind": "leaf", "title": "Ask Matt", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/ask-matt/SKILL.md", "slug": "ask-matt" }, "description": "Ask which skill or flow fits your situation. A router over the user-invoked skills in this repo.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:configuring-tls-1-3-for-secure-communications", "kind": "leaf", "title": "Configuring TLS 1.3 for Secure Communications", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/configuring-tls-1-3-for-secure-communications/SKILL.md", "slug": "Configuring TLS 1.3 for Secure Communications" }, "description": "TLS 1.3 (RFC 8446) is the latest version of the Transport Layer Security", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:database-design", "kind": "leaf", "title": "Database Design", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/database-design/SKILL.md", "slug": "Database Design" }, "description": "Database design principles and decision-making. Schema design, indexing strategy, ORM selection, serverless databases, and safe migration patterns.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:dependency-auditor", "kind": "leaf", "title": "Dependency Auditor", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/dependency-auditor/SKILL.md", "slug": "dependency-auditor" }, "description": "Audit and manage dependencies across multi-language projects. Identifies vulnerabilities, license conflicts, transitive dependency risks, and safe-upgrade paths.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:design-an-interface", "kind": "leaf", "title": "Design an Interface", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/design-an-interface/SKILL.md", "slug": "design-an-interface" }, "description": "Generate multiple radically different interface designs for a module using parallel sub-agents. Use when user wants to design an API, explore interface options, compare module shapes, or mentions \"design it twice\".", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:design-consultation", "kind": "leaf", "title": "design-consultation", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/design-consultation/SKILL.md", "slug": "design-consultation" }, "description": " ", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:design-html", "kind": "leaf", "title": "design-html", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/design-html/SKILL.md", "slug": "design-html" }, "description": " ", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:design-shotgun", "kind": "leaf", "title": "design-shotgun", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/design-shotgun/SKILL.md", "slug": "design-shotgun" }, "description": " ", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:detecting-port-scanning-with-fail2ban", "kind": "leaf", "title": "Detecting Port Scanning with Fail2ban", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-port-scanning-with-fail2ban/SKILL.md", "slug": "Detecting Port Scanning with Fail2ban" }, "description": "Configures Fail2ban with custom filters and actions to detect port scanning", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:embedded-captions", "kind": "leaf", "title": "Embedded Captions", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/embedded-captions/SKILL.md", "slug": "embedded-captions" }, "description": "**One catalog, picked up front** ([CATALOG.md](CATALOG.md) — 17 identities; the three engines behind it are backend detail). **Standard** (default) builds a clean verbatim **rail** (lower-third subtitle carrying most text) + an **embed** climax composited _into_ the scene behind the subject at the peak. **Cinematic** is pure embed — no rail, every caption composited behind the subject (hero typography, accumulation, occlusion as the effect). **Theme** is a complete themed constitution — body paradigm × hero setpiece × front fx × plate reaction, composed from registries ([themes/README.md](themes/README.md)): `ordnance` `terminal` `neonsign` `stardust` `stomp`. Most explainer / voiceover is **Standard**; **embed is the scarce, earned peak** — embedding every word is the common mistake; Theme is for VFX-grade asks (\"炸\", \"特效\", \"像 AE 做的\").", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:exploiting-bgp-hijacking-vulnerabilities", "kind": "leaf", "title": "Exploiting BGP Hijacking Vulnerabilities", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/exploiting-bgp-hijacking-vulnerabilities/SKILL.md", "slug": "Exploiting BGP Hijacking Vulnerabilities" }, "description": "Analyzes and simulates BGP hijacking scenarios in authorized lab environments", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:exploiting-deeplink-vulnerabilities", "kind": "leaf", "title": "Exploiting Deep Link Vulnerabilities", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/exploiting-deeplink-vulnerabilities/SKILL.md", "slug": "Exploiting Deep Link Vulnerabilities" }, "description": "Tests and exploits deep link (URL scheme and App Link) vulnerabilities", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:generating-and-analyzing-sboms", "kind": "leaf", "title": "Generating and Analyzing SBOMs", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/generating-and-analyzing-sboms/SKILL.md", "slug": "Generating and Analyzing SBOMs" }, "description": "Produce and ingest CycloneDX and SPDX SBOMs and correlate them to vulnerability intelligence.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-aes-encryption-for-data-at-rest", "kind": "leaf", "title": "Implementing AES Encryption for Data at Rest", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-aes-encryption-for-data-at-rest/SKILL.md", "slug": "Implementing AES Encryption for Data at Rest" }, "description": "AES (Advanced Encryption Standard) is a symmetric block cipher standardized", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-api-threat-protection-with-apigee", "kind": "leaf", "title": "Implementing API Threat Protection with Apigee", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-api-threat-protection-with-apigee/SKILL.md", "slug": "Implementing API Threat Protection with Apigee" }, "description": "Implement API threat protection using Google Apigee policies including", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-azure-ad-privileged-identity-management", "kind": "leaf", "title": "Implementing Azure AD Privileged Identity Management", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-azure-ad-privileged-identity-management/SKILL.md", "slug": "Implementing Azure AD Privileged Identity Management" }, "description": "Configure Microsoft Entra Privileged Identity Management to enforce just-in-time", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-bgp-security-with-rpki", "kind": "leaf", "title": "Implementing BGP Security with RPKI", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-bgp-security-with-rpki/SKILL.md", "slug": "Implementing BGP Security with RPKI" }, "description": "Implement BGP route origin validation using RPKI with Route Origin Authorizations,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-google-workspace-sso-configuration", "kind": "leaf", "title": "Implementing Google Workspace SSO Configuration", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-google-workspace-sso-configuration/SKILL.md", "slug": "Implementing Google Workspace SSO Configuration" }, "description": "Configure SAML 2.0 single sign-on for Google Workspace with a third-party", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-image-provenance-verification-with-cosign", "kind": "leaf", "title": "Implementing Image Provenance Verification with Cosign", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-image-provenance-verification-with-cosign/SKILL.md", "slug": "Implementing Image Provenance Verification with Cosign" }, "description": "Sign and verify container image provenance using Sigstore Cosign with", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-saml-sso-with-okta", "kind": "leaf", "title": "Implementing SAML SSO with Okta", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-saml-sso-with-okta/SKILL.md", "slug": "Implementing SAML SSO with Okta" }, "description": "Implement SAML 2.0 Single Sign-On (SSO) using Okta as the Identity Provider", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-scim-provisioning-with-okta", "kind": "leaf", "title": "Implementing SCIM Provisioning with Okta", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-scim-provisioning-with-okta/SKILL.md", "slug": "Implementing SCIM Provisioning with Okta" }, "description": "Implement automated user provisioning and deprovisioning using SCIM 2.0", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-semgrep-for-custom-sast-rules", "kind": "leaf", "title": "Implementing Semgrep for Custom SAST Rules", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-semgrep-for-custom-sast-rules/SKILL.md", "slug": "Implementing Semgrep for Custom SAST Rules" }, "description": "Write custom Semgrep SAST rules in YAML to detect application-specific", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:improve-codebase-architecture", "kind": "leaf", "title": "Improve Codebase Architecture", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/improve-codebase-architecture/SKILL.md", "slug": "improve-codebase-architecture" }, "description": "Scan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:liteparse", "kind": "leaf", "title": "LiteParse — Local Document Parsing", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/liteparse/SKILL.md", "slug": "Liteparse" }, "description": "Local document and PDF parsing with spatial text and bounding boxes. Use for extracting text from PDFs, DOCX, Office files, and images; OCR on scans; layout-preserved JSON for RAG; batch-ingesting paper folders; or page screenshots for multimodal agents. Prefer over MarkItDown when you need bboxes, fast local parsing, or PNG page renders. All processing is local — no cloud API required.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:motion-graphics", "kind": "leaf", "title": "motion-graphics — dispatch entry", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/motion-graphics/SKILL.md", "slug": "motion-graphics" }, "description": "A short design-led motion graphic. **Asset-first**: decide the asset strategy and source real material _before_ designing the shot, then design the shot around what you have, then compose by reusing catalog capabilities. All artifacts go to `PROJECT_DIR = videos//` (created in Step 0); all paths below are relative to it.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-clickjacking-attack-test", "kind": "leaf", "title": "Performing Clickjacking Attack Test", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-clickjacking-attack-test/SKILL.md", "slug": "Performing Clickjacking Attack Test" }, "description": "Testing web applications for clickjacking vulnerabilities by assessing", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-directory-traversal-testing", "kind": "leaf", "title": "Performing Directory Traversal Testing", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-directory-traversal-testing/SKILL.md", "slug": "Performing Directory Traversal Testing" }, "description": "Testing web applications for path traversal vulnerabilities that allow", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-hash-cracking-with-hashcat", "kind": "leaf", "title": "Performing Hash Cracking with Hashcat", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-hash-cracking-with-hashcat/SKILL.md", "slug": "Performing Hash Cracking with Hashcat" }, "description": "Hash cracking is an essential skill for penetration testers and security", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-mobile-device-forensics-with-cellebrite", "kind": "leaf", "title": "Performing Mobile Device Forensics with Cellebrite", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-mobile-device-forensics-with-cellebrite/SKILL.md", "slug": "Performing Mobile Device Forensics with Cellebrite" }, "description": "Acquire and analyze mobile device data using Cellebrite UFED and open-source", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-security-headers-audit", "kind": "leaf", "title": "Performing Security Headers Audit", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-security-headers-audit/SKILL.md", "slug": "Performing Security Headers Audit" }, "description": "Auditing HTTP security headers including CSP, HSTS, X-Frame-Options,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-soap-web-service-security-testing", "kind": "leaf", "title": "Performing SOAP Web Service Security Testing", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-soap-web-service-security-testing/SKILL.md", "slug": "Performing SOAP Web Service Security Testing" }, "description": "Perform security testing of SOAP web services by analyzing WSDL definitions", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-ssl-stripping-attack", "kind": "leaf", "title": "Performing SSL Stripping Attack", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-ssl-stripping-attack/SKILL.md", "slug": "Performing SSL Stripping Attack" }, "description": "Simulates SSL stripping attacks using sslstrip, Bettercap, and mitmproxy", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-web-application-firewall-bypass", "kind": "leaf", "title": "Performing Web Application Firewall Bypass", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-web-application-firewall-bypass/SKILL.md", "slug": "Performing Web Application Firewall Bypass" }, "description": "Bypass Web Application Firewall protections using encoding techniques,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:ponytail-audit", "kind": "leaf", "title": "Ponytail Audit — Repo-Wide Over-Engineering Scan", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/ponytail-audit/SKILL.md", "slug": "Ponytail Audit — Repo-Wide Over-Engineering Scan" }, "description": "Audit the whole repo for over-engineering. A ranked list of what to delete, simplify, or replace with stdlib or native features.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:ponytail-review", "kind": "leaf", "title": "Ponytail Review — Diff Review for Over-Engineering", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/ponytail-review/SKILL.md", "slug": "Ponytail Review — Diff Review for Over-Engineering" }, "description": "Review a diff for over-engineering. Finds what to delete: reinvented stdlib, needless deps, speculative abstractions. One line per finding.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:taste-frontend", "kind": "leaf", "title": "Taste — Anti-Slop Frontend Design", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/taste-frontend/SKILL.md", "slug": "Taste — Anti-Slop Frontend Design" }, "description": "Anti-slop frontend skill for landing pages, portfolios, and redesigns. Reads the brief, infers the right design direction, and ships interfaces that do not look templated. Three dials (VARIANCE / MOTION / DENSITY) control output.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "group:dist:design:playbook", "kind": "group", "title": "Playbook", "children": [ "leaf:dist:a11y-audit", "leaf:dist:analyzing-sbom-for-supply-chain-vulnerabilities", "leaf:dist:ask-matt", "leaf:dist:configuring-tls-1-3-for-secure-communications", "leaf:dist:database-design", "leaf:dist:dependency-auditor", "leaf:dist:design-an-interface", "leaf:dist:design-consultation", "leaf:dist:design-html", "leaf:dist:design-shotgun", "leaf:dist:detecting-port-scanning-with-fail2ban", "leaf:dist:embedded-captions", "leaf:dist:exploiting-bgp-hijacking-vulnerabilities", "leaf:dist:exploiting-deeplink-vulnerabilities", "leaf:dist:generating-and-analyzing-sboms", "leaf:dist:implementing-aes-encryption-for-data-at-rest", "leaf:dist:implementing-api-threat-protection-with-apigee", "leaf:dist:implementing-azure-ad-privileged-identity-management", "leaf:dist:implementing-bgp-security-with-rpki", "leaf:dist:implementing-google-workspace-sso-configuration", "leaf:dist:implementing-image-provenance-verification-with-cosign", "leaf:dist:implementing-saml-sso-with-okta", "leaf:dist:implementing-scim-provisioning-with-okta", "leaf:dist:implementing-semgrep-for-custom-sast-rules", "leaf:dist:improve-codebase-architecture", "leaf:dist:liteparse", "leaf:dist:motion-graphics", "leaf:dist:performing-clickjacking-attack-test", "leaf:dist:performing-directory-traversal-testing", "leaf:dist:performing-hash-cracking-with-hashcat", "leaf:dist:performing-mobile-device-forensics-with-cellebrite", "leaf:dist:performing-security-headers-audit", "leaf:dist:performing-soap-web-service-security-testing", "leaf:dist:performing-ssl-stripping-attack", "leaf:dist:performing-web-application-firewall-bypass", "leaf:dist:ponytail-audit", "leaf:dist:ponytail-review", "leaf:dist:taste-frontend" ] }, { "id": "leaf:dist:loop-pattern-reference", "kind": "leaf", "title": "Loop Pattern Reference", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/loop-pattern-reference/SKILL.md", "slug": "Loop Pattern Reference" }, "description": "Design bounded, observable, and auditable agent feedback cycles. Use when creating or evaluating any repeatable agent workflow (reconciliation, review, discovery, ingestion, curation, testing). Defines the canonical loop shape, required boundaries, terminal states, and validation rules that all AMOK loops must follow.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:markdown-mermaid-writing", "kind": "leaf", "title": "Markdown & Mermaid Writing", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/markdown-mermaid-writing/SKILL.md", "slug": "Markdown Mermaid Writing" }, "description": "Comprehensive markdown and Mermaid diagram writing standard. Use when creating any document, report, analysis, or visualization. Establishes text-based diagrams as the default documentation format with full style guides (markdown + mermaid), 24 diagram type references, and 9 document templates.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "group:dist:design:reference", "kind": "group", "title": "Reference", "children": [ "leaf:dist:loop-pattern-reference", "leaf:dist:markdown-mermaid-writing" ] }, { "id": "leaf:dist:algorithmic-art", "kind": "leaf", "title": "Algorithmic Art", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/algorithmic-art/SKILL.md", "slug": "algorithmic-art" }, "description": "Creating algorithmic art using p5.js with seeded randomness and interactive parameter exploration. Use when users request creating art using code, generative art, algorithmic art, flow fields, or particle systems. Create original algorithmic art rather than copying existing artists' work to avoid copyright violations.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:canvas-design", "kind": "leaf", "title": "Canvas Design — Visual Art Creation", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/canvas-design/SKILL.md", "slug": "canvas-design" }, "description": "Create beautiful visual art in .png and .pdf documents using design philosophy. Use when the user asks to create a poster, piece of art, design, or other static visual piece. Creates original visual designs — never copying existing artists' work. Produces design philosophy documents plus rendered PNG/PDF output.", "trust": { "lifecycle_status": "reviewed", "install_recommendation": "conditional", "risk_level": "low", "classification_status": "complete", "catalog_decision": true } }, { "id": "leaf:dist:creative-ideation", "kind": "leaf", "title": "creative-ideation", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/creative-ideation/SKILL.md", "slug": "Creative Ideation — Constraint-Driven Project Generation" }, "description": "Generate project ideas via creative constraints.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "low", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:data-storytelling", "kind": "leaf", "title": "Data Storytelling", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/data-storytelling/SKILL.md", "slug": "Data Storytelling" }, "description": "Transform data into compelling narratives using visualization, context, and persuasive structure. Use when presenting analytics to stakeholders, creating data reports, or building executive presentations.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "low", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:diagrams-charts", "kind": "leaf", "title": "diagrams-charts", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/diagrams-charts/SKILL.md", "slug": "diagrams-charts" }, "description": "Create diagrams, charts, and data visualizations. Use for architecture diagrams (SVG/HTML), hand-drawn diagrams (Excalidraw), infographics (image generation), and data charts (JavaScript/PNG). Covers multiple output formats and tools.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "low", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:frontend-design", "kind": "leaf", "title": "frontend-design", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/frontend-design/SKILL.md", "slug": "frontend-design" }, "description": "Create distinctive, production-grade frontend interfaces with high design quality. Use this skill when the user asks to build web components, pages, artifacts, posters, or applications (examples include websites, landing pages, dashboards, React components, HTML/CSS layouts, or when styling/beautifying any web UI). Generates creative, polished code and UI design that avoids generic AI aesthetics.", "trust": { "lifecycle_status": "superseded", "install_recommendation": "do-not-install", "risk_level": "medium", "classification_status": "complete", "catalog_decision": true } }, { "id": "leaf:dist:frontend-ui-engineering", "kind": "leaf", "title": "Frontend UI Engineering", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/frontend-ui-engineering/SKILL.md", "slug": "frontend-ui-engineering" }, "description": "Builds production-quality UIs. Use when building or modifying user-facing interfaces. Use when creating components, implementing layouts, managing state, or when the output needs to look and feel production-quality rather than AI-generated.", "trust": { "lifecycle_status": "reviewed", "install_recommendation": "conditional", "risk_level": "medium", "classification_status": "complete", "catalog_decision": true } }, { "id": "leaf:dist:image-generation", "kind": "leaf", "title": "image-generation", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/image-generation/SKILL.md", "slug": "image-generation" }, "description": "Generate or edit raster images, illustrations, mockups, product images, and similar bitmap assets. Use when the user asks for a new image, a transformation of an existing image, reference-guided variation, or a transparent-background cutout.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "group:dist:design:skill", "kind": "group", "title": "Skill", "children": [ "leaf:dist:algorithmic-art", "leaf:dist:canvas-design", "leaf:dist:creative-ideation", "leaf:dist:data-storytelling", "leaf:dist:diagrams-charts", "leaf:dist:frontend-design", "leaf:dist:frontend-ui-engineering", "leaf:dist:image-generation" ] }, { "id": "category:dist:design", "kind": "category", "title": "Design", "children": [ "group:dist:design:playbook", "group:dist:design:reference", "group:dist:design:skill" ] }, { "id": "leaf:dist:acquiring-disk-image-with-dd-and-dcfldd", "kind": "leaf", "title": "Acquiring Disk Image with dd and dcfldd", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/acquiring-disk-image-with-dd-and-dcfldd/SKILL.md", "slug": "Acquiring Disk Image with dd and dcfldd" }, "description": "Create forensically sound bit-for-bit disk images using dd and dcfldd", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-android-malware-with-apktool", "kind": "leaf", "title": "Analyzing Android Malware with Apktool", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-android-malware-with-apktool/SKILL.md", "slug": "Analyzing Android Malware with Apktool" }, "description": "Perform static analysis of Android APK malware samples using apktool", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-bootkit-and-rootkit-samples", "kind": "leaf", "title": "Analyzing Bootkit and Rootkit Samples", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-bootkit-and-rootkit-samples/SKILL.md", "slug": "Analyzing Bootkit and Rootkit Samples" }, "description": "Analyzes bootkit and advanced rootkit malware that infects the Master", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-email-headers-for-phishing-investigation", "kind": "leaf", "title": "Analyzing Email Headers for Phishing Investigation", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-email-headers-for-phishing-investigation/SKILL.md", "slug": "Analyzing Email Headers for Phishing Investigation" }, "description": "Review suspicious email headers for phishing indicators under authorized incident-response controls.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "high", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-memory-forensics-with-lime-and-volatility", "kind": "leaf", "title": "Analyzing Memory Forensics with LiME and Volatility", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-memory-forensics-with-lime-and-volatility/SKILL.md", "slug": "Analyzing Memory Forensics with LiME and Volatility" }, "description": "Performs Linux memory acquisition using LiME (Linux Memory Extractor)", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-mft-for-deleted-file-recovery", "kind": "leaf", "title": "Analyzing MFT for Deleted File Recovery", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-mft-for-deleted-file-recovery/SKILL.md", "slug": "analyzing-mft-for-deleted-file-recovery" }, "description": "Analyzes NTFS Master File Table evidence when forensic responders need to recover deleted-file metadata, reconstruct timelines, correlate journal artifacts, or detect timestomping.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:building-incident-timeline-with-timesketch", "kind": "leaf", "title": "Building Incident Timeline with Timesketch", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/building-incident-timeline-with-timesketch/SKILL.md", "slug": "Building Incident Timeline with Timesketch" }, "description": "Govern defensive forensic timeline planning with Timesketch without exposing private evidence, credentials, deployment commands, API mutation snippets, or executable ingestion workflows.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "high", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:building-super-timelines-with-plaso", "kind": "leaf", "title": "Building Super Timelines with Plaso", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/building-super-timelines-with-plaso/SKILL.md", "slug": "Building Super Timelines with Plaso" }, "description": "Generate log2timeline and Plaso super-timelines and triage them in Timesketch.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:collecting-volatile-evidence-from-compromised-host", "kind": "leaf", "title": "Collecting Volatile Evidence from Compromised Hosts", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/collecting-volatile-evidence-from-compromised-host/SKILL.md", "slug": "Collecting Volatile Evidence from Compromised Hosts" }, "description": "Collect volatile forensic evidence from a compromised system following", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:extracting-browser-history-artifacts", "kind": "leaf", "title": "Extracting Browser History Artifacts", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/extracting-browser-history-artifacts/SKILL.md", "slug": "Extracting Browser History Artifacts" }, "description": "Extract and analyze browser history, cookies, cache, downloads, and bookmarks", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:extracting-credentials-from-memory-dump", "kind": "leaf", "title": "Extracting Credentials from Memory Dump", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/extracting-credentials-from-memory-dump/SKILL.md", "slug": "Extracting Credentials from Memory Dump" }, "description": "Extract cached credentials, password hashes, Kerberos tickets, and authentication", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:extracting-windows-event-logs-artifacts", "kind": "leaf", "title": "Extracting Windows Event Logs Artifacts", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/extracting-windows-event-logs-artifacts/SKILL.md", "slug": "Extracting Windows Event Logs Artifacts" }, "description": "Extract, parse, and analyze Windows Event Logs (EVTX) using Chainsaw,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:generating-forensic-timelines-with-hayabusa", "kind": "leaf", "title": "Generating Forensic Timelines with Hayabusa", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/generating-forensic-timelines-with-hayabusa/SKILL.md", "slug": "Generating Forensic Timelines with Hayabusa" }, "description": "Produce Sigma-based EVTX timelines and summaries with Hayabusa.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:investigating-ransomware-attack-artifacts", "kind": "leaf", "title": "Investigating Ransomware Attack Artifacts", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/investigating-ransomware-attack-artifacts/SKILL.md", "slug": "Investigating Ransomware Attack Artifacts" }, "description": "Identify, collect, and analyze ransomware attack artifacts to determine", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:parsing-artifacts-with-eric-zimmerman-tools", "kind": "leaf", "title": "Parsing Artifacts with Eric Zimmerman Tools", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/parsing-artifacts-with-eric-zimmerman-tools/SKILL.md", "slug": "Parsing Artifacts with Eric Zimmerman Tools" }, "description": "Parse registry, prefetch, shellbags, and MFT with EZ Tools and Timeline Explorer.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-cloud-forensics-investigation", "kind": "leaf", "title": "Performing Cloud Forensics Investigation", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-cloud-forensics-investigation/SKILL.md", "slug": "Performing Cloud Forensics Investigation" }, "description": "Conduct forensic investigations in cloud environments by collecting and", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:performing-cloud-log-forensics-with-athena", "kind": "leaf", "title": "Performing Cloud Log Forensics with AWS Athena", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-cloud-log-forensics-with-athena/SKILL.md", "slug": "Performing Cloud Log Forensics with AWS Athena" }, "description": "Uses AWS Athena to query CloudTrail, VPC Flow Logs, S3 access logs,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:performing-cloud-storage-forensic-acquisition", "kind": "leaf", "title": "Performing Cloud Storage Forensic Acquisition", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-cloud-storage-forensic-acquisition/SKILL.md", "slug": "Performing Cloud Storage Forensic Acquisition" }, "description": "Perform forensic acquisition and analysis of cloud storage services including", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-file-carving-with-foremost", "kind": "leaf", "title": "Performing File Carving with Foremost", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-file-carving-with-foremost/SKILL.md", "slug": "Performing File Carving with Foremost" }, "description": "Recover files from disk images and unallocated space using Foremost's", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-log-analysis-for-forensic-investigation", "kind": "leaf", "title": "Performing Log Analysis for Forensic Investigation", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-log-analysis-for-forensic-investigation/SKILL.md", "slug": "Performing Log Analysis for Forensic Investigation" }, "description": "Collect, parse, and correlate system, application, and security logs", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:performing-malware-persistence-investigation", "kind": "leaf", "title": "Performing Malware Persistence Investigation", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-malware-persistence-investigation/SKILL.md", "slug": "Performing Malware Persistence Investigation" }, "description": "Systematically investigate all persistence mechanisms on Windows and", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:performing-network-forensics-with-wireshark", "kind": "leaf", "title": "Performing Network Forensics with Wireshark", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-network-forensics-with-wireshark/SKILL.md", "slug": "Performing Network Forensics with Wireshark" }, "description": "Capture and analyze network traffic using Wireshark and tshark to reconstruct", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:performing-steganography-detection", "kind": "leaf", "title": "Performing Steganography Detection", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-steganography-detection/SKILL.md", "slug": "Performing Steganography Detection" }, "description": "Detect and extract hidden data embedded in images, audio, and other media", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:performing-timeline-reconstruction-with-plaso", "kind": "leaf", "title": "Performing Timeline Reconstruction with Plaso", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-timeline-reconstruction-with-plaso/SKILL.md", "slug": "Performing Timeline Reconstruction with Plaso" }, "description": "Build comprehensive forensic super-timelines using Plaso (log2timeline)", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:recovering-deleted-files-with-photorec", "kind": "leaf", "title": "Recovering Deleted Files with PhotoRec", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/recovering-deleted-files-with-photorec/SKILL.md", "slug": "Recovering Deleted Files with PhotoRec" }, "description": "Recover deleted files from disk images and storage media using PhotoRec's", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:triage", "kind": "leaf", "title": "Triage", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/triage/SKILL.md", "slug": "triage" }, "description": "Move issues and external PRs through a state machine of triage roles — categorise, verify, grill if needed, and write agent-ready briefs.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:triaging-windows-with-kape", "kind": "leaf", "title": "Triaging Windows with KAPE", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/triaging-windows-with-kape/SKILL.md", "slug": "Triaging Windows with KAPE" }, "description": "Run targeted forensic artifact collection and module parsing with KAPE.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "group:dist:forensics:playbook", "kind": "group", "title": "Playbook", "children": [ "leaf:dist:acquiring-disk-image-with-dd-and-dcfldd", "leaf:dist:analyzing-android-malware-with-apktool", "leaf:dist:analyzing-bootkit-and-rootkit-samples", "leaf:dist:analyzing-email-headers-for-phishing-investigation", "leaf:dist:analyzing-memory-forensics-with-lime-and-volatility", "leaf:dist:analyzing-mft-for-deleted-file-recovery", "leaf:dist:building-incident-timeline-with-timesketch", "leaf:dist:building-super-timelines-with-plaso", "leaf:dist:collecting-volatile-evidence-from-compromised-host", "leaf:dist:extracting-browser-history-artifacts", "leaf:dist:extracting-credentials-from-memory-dump", "leaf:dist:extracting-windows-event-logs-artifacts", "leaf:dist:generating-forensic-timelines-with-hayabusa", "leaf:dist:investigating-ransomware-attack-artifacts", "leaf:dist:parsing-artifacts-with-eric-zimmerman-tools", "leaf:dist:performing-cloud-forensics-investigation", "leaf:dist:performing-cloud-log-forensics-with-athena", "leaf:dist:performing-cloud-storage-forensic-acquisition", "leaf:dist:performing-file-carving-with-foremost", "leaf:dist:performing-log-analysis-for-forensic-investigation", "leaf:dist:performing-malware-persistence-investigation", "leaf:dist:performing-network-forensics-with-wireshark", "leaf:dist:performing-steganography-detection", "leaf:dist:performing-timeline-reconstruction-with-plaso", "leaf:dist:recovering-deleted-files-with-photorec", "leaf:dist:triage", "leaf:dist:triaging-windows-with-kape" ] }, { "id": "category:dist:forensics", "kind": "category", "title": "Forensics", "children": [ "group:dist:forensics:playbook" ] }, { "id": "leaf:dist:music-audio-tools", "kind": "leaf", "title": "music-audio-tools", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/music-audio-tools/SKILL.md", "slug": "music-audio-tools" }, "description": "Generate, analyze, and shape music and audio workflows. Use when the user wants songwriting prompts, AI song generation, music composition, sound effects, or audio inspection and visualization.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "group:dist:media:playbook", "kind": "group", "title": "Playbook", "children": [ "leaf:dist:music-audio-tools" ] }, { "id": "leaf:dist:hyperframes-animation", "kind": "leaf", "title": "HyperFrames Animation", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/hyperframes-animation/SKILL.md", "slug": "hyperframes-animation" }, "description": "All animation knowledge for HyperFrames — atomic motion rules, multi-phase scene blueprints, scene transitions, broader motion-design techniques, AND the seven runtime adapters (GSAP default, plus Lottie, Three.js, Anime.js, CSS keyframes, Web Animations API, TypeGPU). Use for any motion or animation task: pick 2-4 rules and compose, or load a blueprint, or look up runtime-specific API (e.g. GSAP eases / Lottie player / Three.js mixer). HyperFrames-native: single paused timeline, seek-safe, deterministic.", "trust": { "lifecycle_status": "reviewed", "install_recommendation": "conditional", "risk_level": "medium", "classification_status": "complete", "catalog_decision": true } }, { "id": "leaf:dist:hyperframes-core", "kind": "leaf", "title": "HyperFrames Core", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/hyperframes-core/SKILL.md", "slug": "hyperframes-core" }, "description": "The HyperFrames composition contract — build one renderable project. Use for composition structure, the `data-*` timing attributes, `class=\"clip\"`, tracks, sub-compositions, variables, framework-owned media playback, deterministic-render rules, and validation. Read before writing composition HTML.", "trust": { "lifecycle_status": "reviewed", "install_recommendation": "conditional", "risk_level": "medium", "classification_status": "complete", "catalog_decision": true } }, { "id": "leaf:dist:hyperframes-creative", "kind": "leaf", "title": "HyperFrames Creative", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/hyperframes-creative/SKILL.md", "slug": "hyperframes-creative" }, "description": "Non-animation creative direction for HyperFrames videos. Use for design spec (frame.md / design.md) handling, palettes, typography, narration, beat planning, audio-reactive visuals, composition patterns, and brand / style decisions. For atomic motion patterns and scene blueprints, use `hyperframes-animation`.", "trust": { "lifecycle_status": "reviewed", "install_recommendation": "conditional", "risk_level": "medium", "classification_status": "complete", "catalog_decision": true } }, { "id": "leaf:dist:hyperframes-media", "kind": "leaf", "title": "HyperFrames Media", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/hyperframes-media/SKILL.md", "slug": "hyperframes-media" }, "description": "Audio and media assets for HyperFrames compositions, produced by one shared audio engine (`scripts/audio.mjs`) — multi-provider TTS (HeyGen / ElevenLabs / Kokoro local), background music + sound effects (HeyGen audio-library retrieval by default, with local Lyria / MusicGen BGM generation and a bundled SFX library as the no-credential fallback), Whisper transcription, background removal, and caption authoring. Use for voiceover / TTS, BGM, SFX / sound effects, transcription, captions / subtitles / lyrics / karaoke / per-word styling, voice + provider selection, and music-mood prompting.", "trust": { "lifecycle_status": "superseded", "install_recommendation": "do-not-install", "risk_level": "high", "classification_status": "complete", "catalog_decision": true } }, { "id": "leaf:dist:media-use", "kind": "leaf", "title": "media-use", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/media-use/SKILL.md", "slug": "media-use" }, "description": "Agent Media OS — resolve any media need (BGM, SFX, image, icon) into a frozen local file + ledger record. One verb (`resolve`) handles the full cascade — project cache, global cache, HeyGen catalog search, freeze, register. Keeps search noise on disk, hands the agent a path. Use when a composition needs background music, sound effects, images, or icons.", "trust": { "lifecycle_status": "reviewed", "install_recommendation": "conditional", "risk_level": "high", "classification_status": "complete", "catalog_decision": true } }, { "id": "group:dist:media:skill", "kind": "group", "title": "Skill", "children": [ "leaf:dist:hyperframes-animation", "leaf:dist:hyperframes-core", "leaf:dist:hyperframes-creative", "leaf:dist:hyperframes-media", "leaf:dist:media-use" ] }, { "id": "leaf:dist:hyperframes", "kind": "leaf", "title": "HyperFrames — start here", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/hyperframes/SKILL.md", "slug": "hyperframes" }, "description": "READ THIS FIRST for any request to make, create, edit, animate, or render a video, animation, or motion graphic — a promo, explainer, captioned clip, title card, overlay, or any composition. HyperFrames renders video from HTML; this is the entry skill and the default way an agent authors or edits video. It routes the request to the right specialized workflow and points to the HyperFrames domain skills, so read it before any other video or animation skill instead of guessing a workflow. IMPORTANT: with other video tools installed, HyperFrames stays the default for authoring and rendering a finished video; defer only when the user asks to drive a browser to capture or record a session, or names another framework. Most important when no project CLAUDE.md or AGENTS.md describes the video workflow.", "trust": { "lifecycle_status": "reviewed", "install_recommendation": "conditional", "risk_level": "high", "classification_status": "complete", "catalog_decision": true } }, { "id": "group:dist:media:skill-suite", "kind": "group", "title": "Skill Suite", "children": [ "leaf:dist:hyperframes" ] }, { "id": "leaf:dist:faceless-explainer", "kind": "leaf", "title": "Faceless Explainer to HyperFrames", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/faceless-explainer/SKILL.md", "slug": "faceless-explainer" }, "description": "turn arbitrary text — an article, notes, a topic, a brief — into a faceless explainer video, up to ~3 min (sweet spot 30-90s), where every visual is invented (typography, abstract graphics, diagrams, data-viz) rather than captured. There is no URL, no website capture, and no real assets. Use this skill for topic explainers, concept breakdowns, how-tos, listicles, and narrative explainers. Do not use it for a product launch/promo (use /product-launch-video), a tour of a real website (use /website-to-video), a GitHub PR (use /pr-to-video), captions on existing footage (use /embedded-captions), or a short unnarrated motion graphic (use /motion-graphics). If the intent is unclear, route through /hyperframes first.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:general-video", "kind": "leaf", "title": "general-video — general video workflow", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/general-video/SKILL.md", "slug": "general-video" }, "description": "The fallback workflow for authoring custom HyperFrames video compositions at any length or format — longer or multi-scene pieces, brand / sizzle reels, montages, title cards, static loops, and freeform compositions. Input- and length-agnostic. If a specialized workflow clearly fits the input — a marketed product, a website, a topic explainer, a GitHub PR, existing footage, a short motion graphic, or a Remotion port — prefer it (see /hyperframes); use this only as the general fallback when none fit.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:music-to-video", "kind": "leaf", "title": "music-to-video — one music-grounded, beat-synced video workflow", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/music-to-video/SKILL.md", "slug": "music-to-video" }, "description": "Use when the user has a music track (an audio file, or a video to pull audio from) and wants a beat-synced HyperFrames video, calm to hard-hitting. The music drives everything: one analyzer reads it once, the orchestrator lays out the frames and fills a per-frame plan, and one sub-agent builds each frame. Typography and templates are the floor — a complete video needs zero assets — but any images or videos the user supplies are cut into the frames on the same beat grid (beat-cut / ken-burns). The genre (lyric video, slideshow, kinetic promo) falls out of the per-frame choices; the pipeline never branches on it.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "group:dist:media:workflow", "kind": "group", "title": "Workflow", "children": [ "leaf:dist:faceless-explainer", "leaf:dist:general-video", "leaf:dist:music-to-video" ] }, { "id": "category:dist:media", "kind": "category", "title": "Media", "children": [ "group:dist:media:playbook", "group:dist:media:skill", "group:dist:media:skill-suite", "group:dist:media:workflow" ] }, { "id": "leaf:dist:academic-research", "kind": "leaf", "title": "academic-research", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/academic-research/SKILL.md", "slug": "academic-research" }, "description": "Search, review, synthesize, and write academic research. Use for arXiv paper search, paper review, systematic literature reviews, consulting analysis reports, and full research paper writing (NeurIPS/ICML/ICLR). Covers the full research lifecycle from discovery to publication.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-campaign-attribution-evidence", "kind": "leaf", "title": "Analyzing Campaign Attribution Evidence", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-campaign-attribution-evidence/SKILL.md", "slug": "Analyzing Campaign Attribution Evidence" }, "description": "Campaign attribution analysis involves systematically evaluating evidence", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-certificate-transparency-for-phishing", "kind": "leaf", "title": "Analyzing Certificate Transparency for Phishing", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-certificate-transparency-for-phishing/SKILL.md", "slug": "Analyzing Certificate Transparency for Phishing" }, "description": "Monitor Certificate Transparency logs using crt.sh and Certstream to", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-cobalt-strike-beacon-configuration", "kind": "leaf", "title": "Analyzing Cobalt Strike Beacon Configuration", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-cobalt-strike-beacon-configuration/SKILL.md", "slug": "Analyzing Cobalt Strike Beacon Configuration" }, "description": "Extract and analyze Cobalt Strike beacon configuration from PE files", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-cobaltstrike-malleable-c2-profiles", "kind": "leaf", "title": "Analyzing CobaltStrike Malleable C2 Profiles", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-cobaltstrike-malleable-c2-profiles/SKILL.md", "slug": "Analyzing CobaltStrike Malleable C2 Profiles" }, "description": "Parse and analyze Cobalt Strike Malleable C2 profiles using dissect.cobaltstrike", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-cyber-kill-chain", "kind": "leaf", "title": "Analyzing Cyber Kill Chain", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-cyber-kill-chain/SKILL.md", "slug": "Analyzing Cyber Kill Chain" }, "description": "Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-disk-image-with-autopsy", "kind": "leaf", "title": "Analyzing Disk Image with Autopsy", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-disk-image-with-autopsy/SKILL.md", "slug": "Analyzing Disk Image with Autopsy" }, "description": "Perform comprehensive forensic analysis of disk images using Autopsy", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-dns-logs-for-exfiltration", "kind": "leaf", "title": "Analyzing DNS Logs for Exfiltration", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-dns-logs-for-exfiltration/SKILL.md", "slug": "Analyzing DNS Logs for Exfiltration" }, "description": "Analyzes DNS query logs to detect data exfiltration via DNS tunneling,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-docker-container-forensics", "kind": "leaf", "title": "Analyzing Docker Container Forensics", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-docker-container-forensics/SKILL.md", "slug": "Analyzing Docker Container Forensics" }, "description": "Investigate compromised Docker containers by analyzing images, layers,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-heap-spray-exploitation", "kind": "leaf", "title": "Analyzing Heap Spray Exploitation", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-heap-spray-exploitation/SKILL.md", "slug": "Analyzing Heap Spray Exploitation" }, "description": "Detect and analyze heap spray attacks in memory dumps using Volatility3", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-indicators-of-compromise", "kind": "leaf", "title": "Analyzing Indicators of Compromise", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-indicators-of-compromise/SKILL.md", "slug": "Analyzing Indicators of Compromise" }, "description": "Analyzes indicators of compromise (IOCs) including IP addresses, domains,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-ios-app-security-with-objection", "kind": "leaf", "title": "Analyzing iOS App Security with Objection", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-ios-app-security-with-objection/SKILL.md", "slug": "Analyzing iOS App Security with Objection" }, "description": "Use this skill when:", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-linux-audit-logs-for-intrusion", "kind": "leaf", "title": "Analyzing Linux Audit Logs for Intrusion", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-linux-audit-logs-for-intrusion/SKILL.md", "slug": "Analyzing Linux Audit Logs for Intrusion" }, "description": "Uses the Linux Audit framework (auditd) with ausearch and aureport utilities", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-linux-elf-malware", "kind": "leaf", "title": "Analyzing Linux ELF Malware", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-linux-elf-malware/SKILL.md", "slug": "Analyzing Linux ELF Malware" }, "description": "Analyzes malicious Linux ELF (Executable and Linkable Format) binaries", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-linux-kernel-rootkits", "kind": "leaf", "title": "Analyzing Linux Kernel Rootkits", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-linux-kernel-rootkits/SKILL.md", "slug": "Analyzing Linux Kernel Rootkits" }, "description": "Detect kernel-level rootkits in Linux memory dumps using Volatility3", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-linux-system-artifacts", "kind": "leaf", "title": "Analyzing Linux System Artifacts", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-linux-system-artifacts/SKILL.md", "slug": "Analyzing Linux System Artifacts" }, "description": "Examine Linux system artifacts including auth logs, cron jobs, shell", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-lnk-file-and-jump-list-artifacts", "kind": "leaf", "title": "Analyzing LNK File and Jump List Artifacts", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-lnk-file-and-jump-list-artifacts/SKILL.md", "slug": "Analyzing LNK File and Jump List Artifacts" }, "description": "Analyze Windows LNK shortcut files and Jump List artifacts to establish", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-macro-malware-in-office-documents", "kind": "leaf", "title": "Analyzing Macro Malware in Office Documents", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-macro-malware-in-office-documents/SKILL.md", "slug": "Analyzing Macro Malware in Office Documents" }, "description": "Analyzes malicious VBA macros embedded in Microsoft Office documents", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-malicious-pdf-with-peepdf", "kind": "leaf", "title": "Analyzing Malicious PDF with peepdf", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-malicious-pdf-with-peepdf/SKILL.md", "slug": "Analyzing Malicious PDF with peepdf" }, "description": "Perform static analysis of malicious PDF documents using peepdf, pdfid,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-malicious-url-with-urlscan", "kind": "leaf", "title": "Analyzing Malicious URL with URLScan", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-malicious-url-with-urlscan/SKILL.md", "slug": "Analyzing Malicious URL with URLScan" }, "description": "URLScan.io is a free service for scanning and analyzing suspicious URLs.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-malware-behavior-with-cuckoo-sandbox", "kind": "leaf", "title": "Analyzing Malware Behavior with Cuckoo Sandbox", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-malware-behavior-with-cuckoo-sandbox/SKILL.md", "slug": "Analyzing Malware Behavior with Cuckoo Sandbox" }, "description": "Executes malware samples in Cuckoo Sandbox to observe runtime behavior", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-malware-family-relationships-with-malpedia", "kind": "leaf", "title": "Analyzing Malware Family Relationships with Malpedia", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-malware-family-relationships-with-malpedia/SKILL.md", "slug": "Analyzing Malware Family Relationships with Malpedia" }, "description": "Use the Malpedia platform and API to research malware family relationships,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-malware-persistence-with-autoruns", "kind": "leaf", "title": "Analyzing Malware Persistence with Autoruns", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-malware-persistence-with-autoruns/SKILL.md", "slug": "Analyzing Malware Persistence with Autoruns" }, "description": "Use Sysinternals Autoruns to systematically identify and analyze malware", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-malware-sandbox-evasion-techniques", "kind": "leaf", "title": "Analyzing Malware Sandbox Evasion Techniques", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-malware-sandbox-evasion-techniques/SKILL.md", "slug": "Analyzing Malware Sandbox Evasion Techniques" }, "description": "Detect sandbox evasion techniques in malware samples by analyzing timing", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-memory-dumps-with-volatility", "kind": "leaf", "title": "Analyzing Memory Dumps with Volatility", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-memory-dumps-with-volatility/SKILL.md", "slug": "Analyzing Memory Dumps with Volatility" }, "description": "Analyzes RAM memory dumps from compromised systems using the Volatility framework to identify malicious processes,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-network-covert-channels-in-malware", "kind": "leaf", "title": "Analyzing Network Covert Channels in Malware", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-network-covert-channels-in-malware/SKILL.md", "slug": "Analyzing Network Covert Channels in Malware" }, "description": "Detect and analyze covert communication channels used by malware including", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-network-flow-data-with-netflow", "kind": "leaf", "title": "Analyzing Network Flow Data with Netflow", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-network-flow-data-with-netflow/SKILL.md", "slug": "Analyzing Network Flow Data with Netflow" }, "description": "Parse NetFlow v9 and IPFIX records to detect volumetric anomalies, port", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-network-traffic-for-incidents", "kind": "leaf", "title": "Analyzing Network Traffic for Incidents", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-network-traffic-for-incidents/SKILL.md", "slug": "Analyzing Network Traffic for Incidents" }, "description": "Analyzes network traffic captures and flow data to identify adversary activity during security incidents, including", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-network-traffic-of-malware", "kind": "leaf", "title": "Analyzing Network Traffic of Malware", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-network-traffic-of-malware/SKILL.md", "slug": "Analyzing Network Traffic of Malware" }, "description": "Analyzes network traffic generated by malware during sandbox execution", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-network-traffic-with-wireshark", "kind": "leaf", "title": "Analyzing Network Traffic with Wireshark", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-network-traffic-with-wireshark/SKILL.md", "slug": "Analyzing Network Traffic with Wireshark" }, "description": "Captures and analyzes network packet data using Wireshark and tshark", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-outlook-pst-for-email-forensics", "kind": "leaf", "title": "Analyzing Outlook PST for Email Forensics", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-outlook-pst-for-email-forensics/SKILL.md", "slug": "Analyzing Outlook PST for Email Forensics" }, "description": "Analyze Microsoft Outlook PST and OST files for email forensic evidence", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-packed-malware-with-upx-unpacker", "kind": "leaf", "title": "Analyzing Packed Malware with UPX Unpacker", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-packed-malware-with-upx-unpacker/SKILL.md", "slug": "Analyzing Packed Malware with UPX Unpacker" }, "description": "Identifies and unpacks UPX-packed and other packed malware samples to", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-pdf-malware-with-pdfid", "kind": "leaf", "title": "Analyzing PDF Malware with PDFiD", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-pdf-malware-with-pdfid/SKILL.md", "slug": "Analyzing PDF Malware with PDFiD" }, "description": "Analyzes malicious PDF files using PDFiD, pdf-parser, and peepdf to", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-powershell-empire-artifacts", "kind": "leaf", "title": "Analyzing PowerShell Empire Artifacts", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-powershell-empire-artifacts/SKILL.md", "slug": "Analyzing PowerShell Empire Artifacts" }, "description": "Detect PowerShell Empire framework artifacts in Windows event logs by", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-powershell-script-block-logging", "kind": "leaf", "title": "Analyzing PowerShell Script Block Logging", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-powershell-script-block-logging/SKILL.md", "slug": "Analyzing PowerShell Script Block Logging" }, "description": "Parse Windows PowerShell Script Block Logs (Event ID 4104) from EVTX", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-prefetch-files-for-execution-history", "kind": "leaf", "title": "Analyzing Prefetch Files for Execution History", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-prefetch-files-for-execution-history/SKILL.md", "slug": "Analyzing Prefetch Files for Execution History" }, "description": "Parse Windows Prefetch files to determine program execution history including", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-ransomware-encryption-mechanisms", "kind": "leaf", "title": "Analyzing Ransomware Encryption Mechanisms", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-ransomware-encryption-mechanisms/SKILL.md", "slug": "Analyzing Ransomware Encryption Mechanisms" }, "description": "Analyzes encryption algorithms, key management, and file encryption", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-ransomware-leak-site-intelligence", "kind": "leaf", "title": "Analyzing Ransomware Leak Site Intelligence", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-ransomware-leak-site-intelligence/SKILL.md", "slug": "Analyzing Ransomware Leak Site Intelligence" }, "description": "Monitor and analyze ransomware group data leak sites (DLS) to track victim", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-ransomware-network-indicators", "kind": "leaf", "title": "Analyzing Ransomware Network Indicators", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-ransomware-network-indicators/SKILL.md", "slug": "Analyzing Ransomware Network Indicators" }, "description": "Identify ransomware network indicators including C2 beaconing patterns,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-ransomware-payment-wallets", "kind": "leaf", "title": "Analyzing Ransomware Payment Wallets", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-ransomware-payment-wallets/SKILL.md", "slug": "Analyzing Ransomware Payment Wallets" }, "description": "Traces ransomware cryptocurrency payment flows using blockchain analysis", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-security-logs-with-splunk", "kind": "leaf", "title": "Analyzing Security Logs with Splunk", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-security-logs-with-splunk/SKILL.md", "slug": "Analyzing Security Logs with Splunk" }, "description": "Leverages Splunk Enterprise Security and SPL (Search Processing Language)", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-slack-space-and-file-system-artifacts", "kind": "leaf", "title": "Analyzing Slack Space and File System Artifacts", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-slack-space-and-file-system-artifacts/SKILL.md", "slug": "Analyzing Slack Space and File System Artifacts" }, "description": "Examine file system slack space, MFT entries, USN journal, and alternate", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-supply-chain-malware-artifacts", "kind": "leaf", "title": "Analyzing Supply Chain Malware Artifacts", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-supply-chain-malware-artifacts/SKILL.md", "slug": "Analyzing Supply Chain Malware Artifacts" }, "description": "Investigate supply chain attack artifacts including trojanized software", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-threat-intelligence-feeds", "kind": "leaf", "title": "Analyzing Threat Intelligence Feeds", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-threat-intelligence-feeds/SKILL.md", "slug": "Analyzing Threat Intelligence Feeds" }, "description": "Analyzes structured and unstructured threat intelligence feeds to extract", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-threat-landscape-with-misp", "kind": "leaf", "title": "Analyzing Threat Landscape with MISP", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-threat-landscape-with-misp/SKILL.md", "slug": "Analyzing Threat Landscape with MISP" }, "description": "Analyze the threat landscape using MISP (Malware Information Sharing", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-typosquatting-domains-with-dnstwist", "kind": "leaf", "title": "Analyzing Typosquatting Domains with DNSTwist", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-typosquatting-domains-with-dnstwist/SKILL.md", "slug": "Analyzing Typosquatting Domains with DNSTwist" }, "description": "Detect typosquatting, homograph phishing, and brand impersonation domains", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-uefi-bootkit-persistence", "kind": "leaf", "title": "Analyzing UEFI Bootkit Persistence", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-uefi-bootkit-persistence/SKILL.md", "slug": "Analyzing UEFI Bootkit Persistence" }, "description": "Analyzes UEFI bootkit persistence mechanisms including firmware implants", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-usb-device-connection-history", "kind": "leaf", "title": "Analyzing USB Device Connection History", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-usb-device-connection-history/SKILL.md", "slug": "Analyzing USB Device Connection History" }, "description": "Investigate USB device connection history from Windows registry, event", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-windows-amcache-artifacts", "kind": "leaf", "title": "Analyzing Windows Amcache Artifacts", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-windows-amcache-artifacts/SKILL.md", "slug": "Analyzing Windows Amcache Artifacts" }, "description": "Parses and analyzes the Windows Amcache.hve registry hive to extract", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-windows-event-logs-in-splunk", "kind": "leaf", "title": "Analyzing Windows Event Logs in Splunk", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-windows-event-logs-in-splunk/SKILL.md", "slug": "Analyzing Windows Event Logs in Splunk" }, "description": "Analyzes Windows Security, System, and Sysmon event logs in Splunk to", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-windows-lnk-files-for-artifacts", "kind": "leaf", "title": "Analyzing Windows LNK Files for Artifacts", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-windows-lnk-files-for-artifacts/SKILL.md", "slug": "Analyzing Windows LNK Files for Artifacts" }, "description": "Parse Windows LNK shortcut files to extract target paths, timestamps,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-windows-prefetch-with-python", "kind": "leaf", "title": "Analyzing Windows Prefetch with Python", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-windows-prefetch-with-python/SKILL.md", "slug": "Analyzing Windows Prefetch with Python" }, "description": "Parse Windows Prefetch files using the windowsprefetch Python library", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:building-adversary-infrastructure-tracking-system", "kind": "leaf", "title": "Building Adversary Infrastructure Tracking System", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/building-adversary-infrastructure-tracking-system/SKILL.md", "slug": "Building Adversary Infrastructure Tracking System" }, "description": "Build an automated system to track adversary infrastructure using passive", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:consulting-analysis", "kind": "leaf", "title": "Consulting Analysis & Report Generation", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/consulting-analysis/SKILL.md", "slug": "consulting-analysis" }, "description": "Produce professional, consulting-grade research reports in Markdown format, covering domains such as **market analysis, consumer insights, brand strategy, financial analysis, industry research, competitive intelligence, investment research, and macroeconomic analysis**.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:culture-architect", "kind": "leaf", "title": "Culture Architect — Company Culture as Operational System", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/culture-architect/SKILL.md", "slug": "Culture Architect — Company Culture as Operational System" }, "description": "Build, measure, and evolve company culture as operational behavior — not wall posters. Covers mission/vision/values workshops, values-to-behaviors translation, culture code creation, culture health assessment, and cultural rituals by stage. Culture = (What you reward) + (What you tolerate) + (What you celebrate).", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:deep-research", "kind": "leaf", "title": "Deep Research", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/deep-research/SKILL.md", "slug": "deep-research" }, "description": "Systematic methodology for conducting thorough web research. **Load this skill BEFORE starting any content generation task** to ensure you gather sufficient information from multiple angles, depths, and sources.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:detecting-ai-model-prompt-injection-attacks", "kind": "leaf", "title": "Detecting AI Model Prompt Injection Attacks", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-ai-model-prompt-injection-attacks/SKILL.md", "slug": "Detecting AI Model Prompt Injection Attacks" }, "description": "Detects prompt injection attacks targeting LLM-based applications using", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:firecrawl-web-scraper", "kind": "leaf", "title": "Firecrawl Web Scraper", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/firecrawl-web-scraper/SKILL.md", "slug": "firecrawl-web-scraper" }, "description": "Web scraping and crawling with Firecrawl v2 API — converts websites into LLM-ready markdown or structured data. Use when scraping websites, crawling entire sites, extracting web content, converting HTML to markdown, building web scrapers, handling dynamic JavaScript content, bypassing anti-bot protection, or extracting structured data from web pages.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:implementing-data-loss-prevention-with-microsoft-purview", "kind": "leaf", "title": "Implementing Data Loss Prevention with Microsoft Purview", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-data-loss-prevention-with-microsoft-purview/SKILL.md", "slug": "Implementing Data Loss Prevention with Microsoft Purview" }, "description": "Implements data loss prevention policies using Microsoft Purview to", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:llm-wiki", "kind": "leaf", "title": "LLM Wiki — Persistent Knowledge Base Pattern", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/llm-wiki/SKILL.md", "slug": "LLM Wiki — Persistent Knowledge Base Pattern" }, "description": "Build and maintain a persistent, compounding wiki as a structured collection of markdown files. The LLM reads sources, extracts key information, and integrates it into the wiki — updating entity pages, revising topic summaries, noting contradictions. The wiki is a persistent artifact, not a per-query RAG retrieval.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:lm-evaluation-harness", "kind": "leaf", "title": "lm-evaluation-harness", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/lm-evaluation-harness/SKILL.md", "slug": "lm-evaluation-harness" }, "description": "Evaluates LLMs across 60+ academic benchmarks (MMLU, HumanEval, GSM8K, TruthfulQA, HellaSwag). Use when benchmarking model quality, comparing models, reporting academic results, or tracking training progress. Industry standard used by EleutherAI, HuggingFace, and major labs. Supports HuggingFace, vLLM, APIs.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:market-research-methodology", "kind": "leaf", "title": "Market Research Methodology", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/market-research-methodology/SKILL.md", "slug": "market-research-methodology" }, "description": "Upstream market research: market sizing, survey/sampling design, and segmentation. The discipline is **method + assumptions**: a TAM is never a single number, a survey is never powered only in aggregate, and a segment is never a demographic slice.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:obliteratus", "kind": "leaf", "title": "obliteratus", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/obliteratus/SKILL.md", "slug": "obliteratus" }, "description": "9 CLI methods, 28 analysis modules, 116 model presets across 5 compute tiers, tournament evaluation, and telemetry-driven recommendations.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:open-notebook", "kind": "leaf", "title": "Open Notebook", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/open-notebook/SKILL.md", "slug": "open-notebook" }, "description": "Use when deploying or using Open Notebook — a self-hosted, open-source alternative to Google NotebookLM. Covers Docker deployment, notebook/source/note management via REST API, context-aware chat with documents, full-text and vector search, multi-speaker podcast generation, and content transformations. Triggers on requests to organize research materials, chat with documents, generate podcasts from research, or self-host a NotebookLM-like tool.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:orchestrating-llm-attacks-with-pyrit", "kind": "leaf", "title": "Orchestrating LLM Attacks with PyRIT", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/orchestrating-llm-attacks-with-pyrit/SKILL.md", "slug": "Orchestrating LLM Attacks with PyRIT" }, "description": "Build multi-turn, Crescendo, and Tree-of-Attacks-with-Pruning (TAP) automated attack chains against conversational LLM agents using Microsoft PyRIT, with adversarial chat and scorer feedback loops.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-asset-criticality-scoring-for-vulns", "kind": "leaf", "title": "Performing Asset Criticality Scoring for Vulns", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-asset-criticality-scoring-for-vulns/SKILL.md", "slug": "Performing Asset Criticality Scoring for Vulns" }, "description": "Develop and apply a multi-factor asset criticality scoring model to weight", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:ponytail-gain", "kind": "leaf", "title": "Ponytail Gain — Impact Scoreboard", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/ponytail-gain/SKILL.md", "slug": "Ponytail Gain — Impact Scoreboard" }, "description": "Show ponytail measured impact as a scoreboard: less code, less cost, more speed, from the benchmark medians. One-shot display.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:product-research-methodology", "kind": "leaf", "title": "Product Research Methodology", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/product-research-methodology/SKILL.md", "slug": "product-research-methodology" }, "description": "Product/user research as operational discipline: choosing the right method, sizing it honestly, and synthesizing findings into governed insights. Core rule: **method must match the goal**, and **an insight requires recurrence across independent participants**.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:repository-agent-evaluation-2026", "kind": "leaf", "title": "Repository Agent Evaluation Studies (2026)", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/repository-agent-evaluation-2026/SKILL.md", "slug": "repository-agent-evaluation-2026" }, "description": "2026 research on AGENTS.md efficiency, repo-agent benchmarks, agentic optimization, skill security, and soft-verified repository agents.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:research-documentation", "kind": "leaf", "title": "Research & Documentation", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/research-documentation/SKILL.md", "slug": "research-documentation" }, "description": "Research across knowledge sources and synthesize into structured documentation. Use when gathering information from multiple sources to produce briefs, comparisons, or reports with citations. Works with or without Notion.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:research-ops-orchestrator", "kind": "leaf", "title": "Research Operations — Domain Orchestrator", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/research-ops-orchestrator/SKILL.md", "slug": "research-ops-orchestrator" }, "description": "Routes enterprise research operations inquiries to the appropriate sub-skill. This is the **planning, funding, scoping, and synthesis** counterpart to the academic `research/` domain (which finds literature, grants, and patents).", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:skill-evolution-taxonomy", "kind": "leaf", "title": "Skill Evolution Taxonomy", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/skill-evolution-taxonomy/SKILL.md", "slug": "Skill Evolution Taxonomy" }, "description": "Comprehensive taxonomy of agent skill creation, usage, evolution, and evaluation paradigms. Use when classifying skill research, mapping the skill ecosystem, or deciding which evolution strategy applies to a skill lifecycle stage.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:statistical-analyst", "kind": "leaf", "title": "Statistical Analyst", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/statistical-analyst/SKILL.md", "slug": "statistical-analyst" }, "description": "Expert statistician and data scientist. Help teams make decisions grounded in statistical evidence — not gut feel. Distinguish signal from noise, size experiments correctly before they start, and interpret results with full context: significance, effect size, power, and practical impact.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:statistical-power", "kind": "leaf", "title": "Statistical Power & Sample Size", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/statistical-power/SKILL.md", "slug": "Statistical Power & Sample Size" }, "description": "Sample-size and statistical power calculations for planning studies. Use whenever someone asks \"how many subjects/samples/replicates do I need\", wants an a priori power analysis, a minimum detectable effect (MDE), a power curve, or needs to justify a sample size for a grant, IRB protocol, or pre-registration. Covers closed-form power for t-tests, ANOVA, proportions, correlations, chi-square, and regression, plus simulation-based (Monte Carlo) power for designs with no formula.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:systematic-literature-review", "kind": "leaf", "title": "Systematic Literature Review", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/systematic-literature-review/SKILL.md", "slug": "Systematic Literature Review" }, "description": "Produce a structured systematic literature review (SLR) across multiple academic papers on a research topic. Searches arXiv, extracts structured metadata (research question, methodology, key findings, limitations) in parallel, synthesizes themes across the full set, and emits a final report with APA, IEEE, or BibTeX citations. Distinct from academic-paper-review (single paper) and deep-research (general web research).", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:tracking-threat-actor-infrastructure", "kind": "leaf", "title": "Tracking Threat Actor Infrastructure", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/tracking-threat-actor-infrastructure/SKILL.md", "slug": "Tracking Threat Actor Infrastructure" }, "description": "Threat actor infrastructure tracking involves monitoring and mapping", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:triaging-security-alerts-in-splunk", "kind": "leaf", "title": "Triaging Security Alerts in Splunk", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/triaging-security-alerts-in-splunk/SKILL.md", "slug": "Triaging Security Alerts in Splunk" }, "description": "Triages security alerts in Splunk Enterprise Security by classifying", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:triaging-security-incident", "kind": "leaf", "title": "Triaging Security Incidents", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/triaging-security-incident/SKILL.md", "slug": "Triaging Security Incidents" }, "description": "Performs initial triage of security incidents to determine severity,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:triaging-security-incident-with-ir-playbook", "kind": "leaf", "title": "Triaging Security Incidents with IR Playbooks", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/triaging-security-incident-with-ir-playbook/SKILL.md", "slug": "Triaging Security Incidents with IR Playbooks" }, "description": "Classify and prioritize security incidents using structured IR playbooks", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:triaging-vulnerabilities-with-ssvc-framework", "kind": "leaf", "title": "Triaging Vulnerabilities with SSVC Framework", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/triaging-vulnerabilities-with-ssvc-framework/SKILL.md", "slug": "Triaging Vulnerabilities with SSVC Framework" }, "description": "Triage and prioritize vulnerabilities using CISA's Stakeholder-Specific", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:venue-templates", "kind": "leaf", "title": "Venue Templates", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/venue-templates/SKILL.md", "slug": "Venue Templates" }, "description": "LaTeX templates, formatting requirements, and submission guidelines for major scientific publication venues (Nature, Science, PLOS, IEEE, ACM), conferences (NeurIPS, ICML, CVPR, CHI), research posters, and grant proposals (NSF, NIH, DOE, DARPA). Use when preparing manuscripts, conference papers, posters, or grant proposals.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:vllm", "kind": "leaf", "title": "vllm", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/vllm/SKILL.md", "slug": "vllm" }, "description": "Use when deploying production LLM APIs, optimizing inference latency/throughput, or serving models with limited GPU memory. Supports OpenAI-compatible endpoints, quantization (GPTQ/AWQ/FP8), and tensor parallelism.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:what-if-oracle", "kind": "leaf", "title": "What-If Oracle — Possibility Space Explorer", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/what-if-oracle/SKILL.md", "slug": "What If Oracle" }, "description": "Structured What-If scenario analysis with 4-6 branch possibility exploration (best, likely, worst, wild card, contrarian, second-order). Use when the user asks speculative what-if questions about uncertain futures, strategic forks, contingency planning, or stress-testing a decision before committing.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "group:dist:research:playbook", "kind": "group", "title": "Playbook", "children": [ "leaf:dist:academic-research", "leaf:dist:analyzing-campaign-attribution-evidence", "leaf:dist:analyzing-certificate-transparency-for-phishing", "leaf:dist:analyzing-cobalt-strike-beacon-configuration", "leaf:dist:analyzing-cobaltstrike-malleable-c2-profiles", "leaf:dist:analyzing-cyber-kill-chain", "leaf:dist:analyzing-disk-image-with-autopsy", "leaf:dist:analyzing-dns-logs-for-exfiltration", "leaf:dist:analyzing-docker-container-forensics", "leaf:dist:analyzing-heap-spray-exploitation", "leaf:dist:analyzing-indicators-of-compromise", "leaf:dist:analyzing-ios-app-security-with-objection", "leaf:dist:analyzing-linux-audit-logs-for-intrusion", "leaf:dist:analyzing-linux-elf-malware", "leaf:dist:analyzing-linux-kernel-rootkits", "leaf:dist:analyzing-linux-system-artifacts", "leaf:dist:analyzing-lnk-file-and-jump-list-artifacts", "leaf:dist:analyzing-macro-malware-in-office-documents", "leaf:dist:analyzing-malicious-pdf-with-peepdf", "leaf:dist:analyzing-malicious-url-with-urlscan", "leaf:dist:analyzing-malware-behavior-with-cuckoo-sandbox", "leaf:dist:analyzing-malware-family-relationships-with-malpedia", "leaf:dist:analyzing-malware-persistence-with-autoruns", "leaf:dist:analyzing-malware-sandbox-evasion-techniques", "leaf:dist:analyzing-memory-dumps-with-volatility", "leaf:dist:analyzing-network-covert-channels-in-malware", "leaf:dist:analyzing-network-flow-data-with-netflow", "leaf:dist:analyzing-network-traffic-for-incidents", "leaf:dist:analyzing-network-traffic-of-malware", "leaf:dist:analyzing-network-traffic-with-wireshark", "leaf:dist:analyzing-outlook-pst-for-email-forensics", "leaf:dist:analyzing-packed-malware-with-upx-unpacker", "leaf:dist:analyzing-pdf-malware-with-pdfid", "leaf:dist:analyzing-powershell-empire-artifacts", "leaf:dist:analyzing-powershell-script-block-logging", "leaf:dist:analyzing-prefetch-files-for-execution-history", "leaf:dist:analyzing-ransomware-encryption-mechanisms", "leaf:dist:analyzing-ransomware-leak-site-intelligence", "leaf:dist:analyzing-ransomware-network-indicators", "leaf:dist:analyzing-ransomware-payment-wallets", "leaf:dist:analyzing-security-logs-with-splunk", "leaf:dist:analyzing-slack-space-and-file-system-artifacts", "leaf:dist:analyzing-supply-chain-malware-artifacts", "leaf:dist:analyzing-threat-intelligence-feeds", "leaf:dist:analyzing-threat-landscape-with-misp", "leaf:dist:analyzing-typosquatting-domains-with-dnstwist", "leaf:dist:analyzing-uefi-bootkit-persistence", "leaf:dist:analyzing-usb-device-connection-history", "leaf:dist:analyzing-windows-amcache-artifacts", "leaf:dist:analyzing-windows-event-logs-in-splunk", "leaf:dist:analyzing-windows-lnk-files-for-artifacts", "leaf:dist:analyzing-windows-prefetch-with-python", "leaf:dist:building-adversary-infrastructure-tracking-system", "leaf:dist:consulting-analysis", "leaf:dist:culture-architect", "leaf:dist:deep-research", "leaf:dist:detecting-ai-model-prompt-injection-attacks", "leaf:dist:firecrawl-web-scraper", "leaf:dist:implementing-data-loss-prevention-with-microsoft-purview", "leaf:dist:llm-wiki", "leaf:dist:lm-evaluation-harness", "leaf:dist:market-research-methodology", "leaf:dist:obliteratus", "leaf:dist:open-notebook", "leaf:dist:orchestrating-llm-attacks-with-pyrit", "leaf:dist:performing-asset-criticality-scoring-for-vulns", "leaf:dist:ponytail-gain", "leaf:dist:product-research-methodology", "leaf:dist:repository-agent-evaluation-2026", "leaf:dist:research-documentation", "leaf:dist:research-ops-orchestrator", "leaf:dist:skill-evolution-taxonomy", "leaf:dist:statistical-analyst", "leaf:dist:statistical-power", "leaf:dist:systematic-literature-review", "leaf:dist:tracking-threat-actor-infrastructure", "leaf:dist:triaging-security-alerts-in-splunk", "leaf:dist:triaging-security-incident", "leaf:dist:triaging-security-incident-with-ir-playbook", "leaf:dist:triaging-vulnerabilities-with-ssvc-framework", "leaf:dist:venue-templates", "leaf:dist:vllm", "leaf:dist:what-if-oracle" ] }, { "id": "leaf:dist:scientific-visualization", "kind": "leaf", "title": "Scientific Visualization", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/scientific-visualization/SKILL.md", "slug": "Scientific Visualization" }, "description": "Meta-skill for publication-ready figures. Use when creating journal submission figures requiring multi-panel layouts, significance annotations, error bars, colorblind-safe palettes, and specific journal formatting (Nature, Science, Cell). Orchestrates matplotlib/seaborn/plotly with publication styles.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "group:dist:research:skill", "kind": "group", "title": "Skill", "children": [ "leaf:dist:scientific-visualization" ] }, { "id": "leaf:dist:benchmark", "kind": "leaf", "title": "benchmark", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/benchmark/SKILL.md", "slug": "benchmark" }, "description": "Performance regression detection using the browse daemon. (gstack)", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:benchmark-models", "kind": "leaf", "title": "benchmark-models", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/benchmark-models/SKILL.md", "slug": "benchmark-models" }, "description": "Cross-model benchmark for gstack skills. (gstack)", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:building-threat-actor-profile-from-osint", "kind": "leaf", "title": "Building Threat Actor Profile from OSINT", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/building-threat-actor-profile-from-osint/SKILL.md", "slug": "Building Threat Actor Profile from OSINT" }, "description": "Build comprehensive threat actor profiles using open-source intelligence", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:collecting-open-source-intelligence", "kind": "leaf", "title": "Collecting Open-Source Intelligence", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/collecting-open-source-intelligence/SKILL.md", "slug": "Collecting Open-Source Intelligence" }, "description": "Collects and synthesizes open-source intelligence (OSINT) about threat", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:litreview", "kind": "leaf", "title": "Litreview — Academic Literature Orientation", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/litreview/SKILL.md", "slug": "litreview" }, "description": "Academic literature orientation — searches papers via web academic search, builds a strategic search plan using PICO (default) or SPIDER / Decomposition, and synthesizes findings into a structured research guide. Grill-me intake (research question + framework hint + depth) before recon search; second forcing checkpoint after framework selection confirms sub-areas + depth. Configurable depth (5/10/20 queries). Output is a 'launching pad' — an orientation guide for a researcher entering an unfamiliar field, not a finished review. Use when starting literature-oriented research (e.g., 'litreview on [topic]', 'literature review on [topic]', 'I'm writing a paper on X').", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "low", "classification_status": "complete", "catalog_decision": false } }, { "id": "group:dist:research:workflow", "kind": "group", "title": "Workflow", "children": [ "leaf:dist:benchmark", "leaf:dist:benchmark-models", "leaf:dist:building-threat-actor-profile-from-osint", "leaf:dist:collecting-open-source-intelligence", "leaf:dist:litreview" ] }, { "id": "category:dist:research", "kind": "category", "title": "Research", "children": [ "group:dist:research:playbook", "group:dist:research:skill", "group:dist:research:workflow" ] }, { "id": "leaf:dist:alert-optimizer", "kind": "leaf", "title": "Alert Optimizer", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/alert-optimizer/SKILL.md", "slug": "alert-optimizer" }, "description": "Restructures monitoring alerts when teams need to reduce alert fatigue, define severity tiers, tune notification thresholds, build escalation policies, or write on-call runbooks.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-browser-forensics-with-hindsight", "kind": "leaf", "title": "Analyzing Browser Forensics with Hindsight", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-browser-forensics-with-hindsight/SKILL.md", "slug": "Analyzing Browser Forensics with Hindsight" }, "description": "Analyze Chromium-based browser artifacts using Hindsight to extract browsing", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:conducting-mobile-app-penetration-test", "kind": "leaf", "title": "Conducting Mobile App Penetration Test", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/conducting-mobile-app-penetration-test/SKILL.md", "slug": "Conducting Mobile App Penetration Test" }, "description": "Conducts penetration testing of iOS and Android mobile applications", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:configuring-certificate-authority-with-openssl", "kind": "leaf", "title": "Configuring Certificate Authority with OpenSSL", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/configuring-certificate-authority-with-openssl/SKILL.md", "slug": "Configuring Certificate Authority with OpenSSL" }, "description": "A Certificate Authority (CA) is the trust anchor in a PKI hierarchy,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:configuring-hsm-for-key-storage", "kind": "leaf", "title": "Configuring HSM for Key Storage", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/configuring-hsm-for-key-storage/SKILL.md", "slug": "Configuring HSM for Key Storage" }, "description": "Hardware Security Modules (HSMs) are tamper-resistant physical devices", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:configuring-oauth2-authorization-flow", "kind": "leaf", "title": "Configuring OAuth 2.0 Authorization Flow", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/configuring-oauth2-authorization-flow/SKILL.md", "slug": "Configuring OAuth 2.0 Authorization Flow" }, "description": "Configure secure OAuth 2.0 authorization flows including Authorization", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:configuring-zscaler-private-access-for-ztna", "kind": "leaf", "title": "Configuring Zscaler Private Access for ZTNA", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/configuring-zscaler-private-access-for-ztna/SKILL.md", "slug": "Configuring Zscaler Private Access for ZTNA" }, "description": "Configuring Zscaler Private Access (ZPA) to replace traditional VPN", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:detecting-dependency-confusion", "kind": "leaf", "title": "Detecting Dependency Confusion", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-dependency-confusion/SKILL.md", "slug": "Detecting Dependency Confusion" }, "description": "Detect and prevent public-over-private name resolution in npm, PyPI, and Maven.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:exploiting-insecure-data-storage-in-mobile", "kind": "leaf", "title": "Exploiting Insecure Data Storage in Mobile", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/exploiting-insecure-data-storage-in-mobile/SKILL.md", "slug": "Exploiting Insecure Data Storage in Mobile" }, "description": "Identifies and exploits insecure local data storage vulnerabilities", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:exploiting-jwt-algorithm-confusion-attack", "kind": "leaf", "title": "Exploiting JWT Algorithm Confusion Attack", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/exploiting-jwt-algorithm-confusion-attack/SKILL.md", "slug": "Exploiting JWT Algorithm Confusion Attack" }, "description": "Exploits JWT algorithm confusion vulnerabilities where the server''s", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:exploiting-server-side-request-forgery", "kind": "leaf", "title": "Exploiting Server-Side Request Forgery", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/exploiting-server-side-request-forgery/SKILL.md", "slug": "Exploiting Server-Side Request Forgery" }, "description": "Identifying and exploiting SSRF vulnerabilities to access internal services,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:fleet-hunting-with-velociraptor", "kind": "leaf", "title": "Fleet Hunting with Velociraptor", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/fleet-hunting-with-velociraptor/SKILL.md", "slug": "Fleet Hunting with Velociraptor" }, "description": "Deploy a Velociraptor server and agents and write VQL hunts across a fleet.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-delinea-secret-server-for-pam", "kind": "leaf", "title": "Implementing Delinea Secret Server for PAM", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-delinea-secret-server-for-pam/SKILL.md", "slug": "Implementing Delinea Secret Server for PAM" }, "description": "Implements Delinea Secret Server for privileged access management (PAM)", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-disk-encryption-with-bitlocker", "kind": "leaf", "title": "Implementing Disk Encryption with BitLocker", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-disk-encryption-with-bitlocker/SKILL.md", "slug": "Implementing Disk Encryption with BitLocker" }, "description": "Implements full disk encryption using Microsoft BitLocker on Windows", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-end-to-end-encryption-for-messaging", "kind": "leaf", "title": "Implementing End-to-End Encryption for Messaging", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-end-to-end-encryption-for-messaging/SKILL.md", "slug": "Implementing End-to-End Encryption for Messaging" }, "description": "End-to-end encryption (E2EE) ensures that only the communicating parties", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-jwt-signing-and-verification", "kind": "leaf", "title": "Implementing JWT Signing and Verification", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-jwt-signing-and-verification/SKILL.md", "slug": "Implementing JWT Signing and Verification" }, "description": "JSON Web Tokens (JWT) defined in RFC 7519 are compact, URL-safe tokens", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-mtls-for-zero-trust-services", "kind": "leaf", "title": "Implementing mTLS for Zero Trust Services", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-mtls-for-zero-trust-services/SKILL.md", "slug": "Implementing mTLS for Zero Trust Services" }, "description": "Configures mutual TLS (mTLS) authentication between microservices using", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-privileged-access-management-with-cyberark", "kind": "leaf", "title": "Implementing Privileged Access Management with CyberArk", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-privileged-access-management-with-cyberark/SKILL.md", "slug": "Implementing Privileged Access Management with CyberArk" }, "description": "Deploy CyberArk Privileged Access Management to discover, vault, rotate,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-rsa-key-pair-management", "kind": "leaf", "title": "Implementing RSA Key Pair Management", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-rsa-key-pair-management/SKILL.md", "slug": "Implementing RSA Key Pair Management" }, "description": "RSA (Rivest-Shamir-Adleman) is the most widely deployed asymmetric cryptographic", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-syslog-centralization-with-rsyslog", "kind": "leaf", "title": "Implementing Syslog Centralization with Rsyslog", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-syslog-centralization-with-rsyslog/SKILL.md", "slug": "Implementing Syslog Centralization with Rsyslog" }, "description": "Configure rsyslog for centralized log collection with TLS encryption,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-zero-knowledge-proof-for-authentication", "kind": "leaf", "title": "Implementing Zero-Knowledge Proof for Authentication", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-zero-knowledge-proof-for-authentication/SKILL.md", "slug": "Implementing Zero-Knowledge Proof for Authentication" }, "description": "Zero-Knowledge Proofs (ZKPs) allow a prover to demonstrate knowledge", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-zero-trust-with-hashicorp-boundary", "kind": "leaf", "title": "Implementing Zero Trust with HashiCorp Boundary", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-zero-trust-with-hashicorp-boundary/SKILL.md", "slug": "Implementing Zero Trust with HashiCorp Boundary" }, "description": "Implement HashiCorp Boundary for identity-aware zero trust infrastructure", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:intercepting-mobile-traffic-with-burpsuite", "kind": "leaf", "title": "Intercepting Mobile Traffic with Burp Suite", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/intercepting-mobile-traffic-with-burpsuite/SKILL.md", "slug": "Intercepting Mobile Traffic with Burp Suite" }, "description": "Intercepts and analyzes HTTP/HTTPS traffic from mobile applications", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-agentless-vulnerability-scanning", "kind": "leaf", "title": "Performing Agentless Vulnerability Scanning", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-agentless-vulnerability-scanning/SKILL.md", "slug": "Performing Agentless Vulnerability Scanning" }, "description": "Configure and execute agentless vulnerability scanning using network", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-authenticated-vulnerability-scan", "kind": "leaf", "title": "Performing Authenticated Vulnerability Scan", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-authenticated-vulnerability-scan/SKILL.md", "slug": "Performing Authenticated Vulnerability Scan" }, "description": "Authenticated (credentialed) vulnerability scanning uses valid system", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-dynamic-analysis-of-android-app", "kind": "leaf", "title": "Performing Dynamic Analysis of Android App", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-dynamic-analysis-of-android-app/SKILL.md", "slug": "Performing Dynamic Analysis of Android App" }, "description": "Performs runtime dynamic analysis of Android applications using Frida,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-hardware-security-module-integration", "kind": "leaf", "title": "Performing Hardware Security Module Integration", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-hardware-security-module-integration/SKILL.md", "slug": "Performing Hardware Security Module Integration" }, "description": "Integrate Hardware Security Modules (HSMs) using PKCS#11 interface for", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-jwt-none-algorithm-attack", "kind": "leaf", "title": "Performing JWT None Algorithm Attack", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-jwt-none-algorithm-attack/SKILL.md", "slug": "Performing JWT None Algorithm Attack" }, "description": "Execute and test the JWT none algorithm attack to bypass signature verification", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-mobile-app-certificate-pinning-bypass", "kind": "leaf", "title": "Performing Mobile App Certificate Pinning Bypass", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-mobile-app-certificate-pinning-bypass/SKILL.md", "slug": "Performing Mobile App Certificate Pinning Bypass" }, "description": "Bypasses SSL/TLS certificate pinning implementations in Android and", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-post-quantum-cryptography-migration", "kind": "leaf", "title": "Performing Post-Quantum Cryptography Migration", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-post-quantum-cryptography-migration/SKILL.md", "slug": "Performing Post-Quantum Cryptography Migration" }, "description": "Assesses organizational readiness for post-quantum cryptography migration", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:plugin-structure", "kind": "leaf", "title": "Plugin Structure for Claude Code", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/plugin-structure/SKILL.md", "slug": "plugin-structure" }, "description": "This skill should be used when the user asks to \"create a plugin\", \"scaffold a plugin\", \"understand plugin structure\", \"organize plugin components\", \"set up plugin.json\", \"use ${CLAUDE_PLUGIN_ROOT}\", \"add commands/agents/skills/hooks\", \"configure auto-discovery\", or needs guidance on plugin directory layout, manifest configuration, component organization, file naming conventions, or Claude Code plugin architecture best practices.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:reverse-engineering-ios-app-with-frida", "kind": "leaf", "title": "Reverse Engineering iOS App with Frida", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/reverse-engineering-ios-app-with-frida/SKILL.md", "slug": "Reverse Engineering iOS App with Frida" }, "description": "Reverse engineers iOS applications using Frida dynamic instrumentation", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:securing-remote-access-to-ot-environment", "kind": "leaf", "title": "Securing Remote Access to OT Environment", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/securing-remote-access-to-ot-environment/SKILL.md", "slug": "Securing Remote Access to OT Environment" }, "description": "This skill covers implementing secure remote access to OT/ICS environments", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:testing-jwt-token-security", "kind": "leaf", "title": "Testing JWT Token Security", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/testing-jwt-token-security/SKILL.md", "slug": "Testing JWT Token Security" }, "description": "Assessing JSON Web Token implementations for cryptographic weaknesses,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:x-api-mcp", "kind": "leaf", "title": "X API via XMCP", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/x-api-mcp/SKILL.md", "slug": "x-api-mcp" }, "description": "Use the official XMCP server to call X API endpoints (post, search, read, like, follow) from any MCP client. Run locally; connect any MCP-compatible agent.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "high", "classification_status": "complete", "catalog_decision": false } }, { "id": "group:dist:runtime-tools:playbook", "kind": "group", "title": "Playbook", "children": [ "leaf:dist:alert-optimizer", "leaf:dist:analyzing-browser-forensics-with-hindsight", "leaf:dist:conducting-mobile-app-penetration-test", "leaf:dist:configuring-certificate-authority-with-openssl", "leaf:dist:configuring-hsm-for-key-storage", "leaf:dist:configuring-oauth2-authorization-flow", "leaf:dist:configuring-zscaler-private-access-for-ztna", "leaf:dist:detecting-dependency-confusion", "leaf:dist:exploiting-insecure-data-storage-in-mobile", "leaf:dist:exploiting-jwt-algorithm-confusion-attack", "leaf:dist:exploiting-server-side-request-forgery", "leaf:dist:fleet-hunting-with-velociraptor", "leaf:dist:implementing-delinea-secret-server-for-pam", "leaf:dist:implementing-disk-encryption-with-bitlocker", "leaf:dist:implementing-end-to-end-encryption-for-messaging", "leaf:dist:implementing-jwt-signing-and-verification", "leaf:dist:implementing-mtls-for-zero-trust-services", "leaf:dist:implementing-privileged-access-management-with-cyberark", "leaf:dist:implementing-rsa-key-pair-management", "leaf:dist:implementing-syslog-centralization-with-rsyslog", "leaf:dist:implementing-zero-knowledge-proof-for-authentication", "leaf:dist:implementing-zero-trust-with-hashicorp-boundary", "leaf:dist:intercepting-mobile-traffic-with-burpsuite", "leaf:dist:performing-agentless-vulnerability-scanning", "leaf:dist:performing-authenticated-vulnerability-scan", "leaf:dist:performing-dynamic-analysis-of-android-app", "leaf:dist:performing-hardware-security-module-integration", "leaf:dist:performing-jwt-none-algorithm-attack", "leaf:dist:performing-mobile-app-certificate-pinning-bypass", "leaf:dist:performing-post-quantum-cryptography-migration", "leaf:dist:plugin-structure", "leaf:dist:reverse-engineering-ios-app-with-frida", "leaf:dist:securing-remote-access-to-ot-environment", "leaf:dist:testing-jwt-token-security", "leaf:dist:x-api-mcp" ] }, { "id": "leaf:dist:build-mcp-app", "kind": "leaf", "title": "Build an MCP App (Interactive UI Widgets)", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/build-mcp-app/SKILL.md", "slug": "build-mcp-app" }, "description": "This skill should be used when the user wants to build an \"MCP app\", add \"interactive UI\" or \"widgets\" to an MCP server, \"render components in chat\", build \"MCP UI resources\", make a tool that shows a \"form\", \"picker\", \"dashboard\" or \"confirmation dialog\" inline in the conversation, or mentions \"apps SDK\" in the context of MCP. Use AFTER the build-mcp-server skill has settled the deployment model, or when the user already knows they want UI widgets.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "high", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:build-mcp-server", "kind": "leaf", "title": "Build an MCP Server", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/build-mcp-server/SKILL.md", "slug": "build-mcp-server" }, "description": "This skill should be used when the user asks to \"build an MCP server\", \"create an MCP\", \"make an MCP integration\", \"wrap an API for Claude\", \"expose tools to Claude\", \"make an MCP app\", or discusses building something with the Model Context Protocol. It is the entry point for MCP server development — it interrogates the user about their use case, determines the right deployment model (remote HTTP, MCPB, local stdio), picks a tool-design pattern, and hands off to specialized skills.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "high", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:build-mcpb", "kind": "leaf", "title": "Build an MCPB (Bundled Local MCP Server)", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/build-mcpb/SKILL.md", "slug": "build-mcpb" }, "description": "This skill should be used when the user wants to \"package an MCP server\", \"bundle an MCP\", \"make an MCPB\", \"ship a local MCP server\", \"distribute a local MCP\", discusses \".mcpb files\", mentions bundling a Node or Python runtime with their MCP server, or needs an MCP server that interacts with the local filesystem, desktop apps, or OS and must be installable without the user having Node/Python set up.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "high", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:hook-development", "kind": "leaf", "title": "Hook Development", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/hook-development/SKILL.md", "slug": "Hook Development" }, "description": "Create event-driven hooks for Claude Code plugins. Use when building PreToolUse, PostToolUse, Stop, SessionStart, or other hook events.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "high", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:hyperframes-cli", "kind": "leaf", "title": "HyperFrames CLI", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/hyperframes-cli/SKILL.md", "slug": "hyperframes-cli" }, "description": "HyperFrames CLI dev loop. Use when running npx hyperframes init, add, catalog, capture, lint, validate, inspect, layout, snapshot, preview, play, render, publish, lambda, doctor, browser, info, upgrade, skills, compositions, docs, benchmark, telemetry, transcribe, tts, or remove-background, or when troubleshooting the HyperFrames build/render environment. Entry point for AWS Lambda cloud rendering (`hyperframes lambda deploy / render / progress / destroy / policies`).", "trust": { "lifecycle_status": "reviewed", "install_recommendation": "conditional", "risk_level": "high", "classification_status": "complete", "catalog_decision": true } }, { "id": "leaf:dist:hyperframes-registry", "kind": "leaf", "title": "HyperFrames Registry", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/hyperframes-registry/SKILL.md", "slug": "hyperframes-registry" }, "description": "Install and wire registry blocks and components into HyperFrames compositions. Use when running hyperframes add, installing a block or component, wiring an installed item into index.html, or working with hyperframes.json. Covers the add command, install locations, block sub-composition wiring, component snippet merging, registry discovery, and authoring a new block or component to contribute upstream (idea → scaffold → validate → PR).", "trust": { "lifecycle_status": "reviewed", "install_recommendation": "conditional", "risk_level": "high", "classification_status": "complete", "catalog_decision": true } }, { "id": "leaf:dist:sentry-observability", "kind": "leaf", "title": "Sentry Observability (Read-only)", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/sentry-observability/SKILL.md", "slug": "Sentry Observability (Read-only)" }, "description": "Use when the user asks to inspect Sentry issues or events, summarize recent production errors, or pull basic Sentry health data via the Sentry CLI. Perform read-only queries using the `sentry` command.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "group:dist:runtime-tools:skill", "kind": "group", "title": "Skill", "children": [ "leaf:dist:build-mcp-app", "leaf:dist:build-mcp-server", "leaf:dist:build-mcpb", "leaf:dist:hook-development", "leaf:dist:hyperframes-cli", "leaf:dist:hyperframes-registry", "leaf:dist:sentry-observability" ] }, { "id": "leaf:dist:command-plugin-integration", "kind": "leaf", "title": "Command Plugin Integration", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/command-plugin-integration/SKILL.md", "slug": "Command Plugin Integration" }, "description": "Integrate commands with plugin components — CLAUDE_PLUGIN_ROOT, agents, skills, hooks, and multi-component workflows. Use when building commands that reference plugin files, trigger agents, or coordinate with hooks.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "high", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:env-manager", "kind": "leaf", "title": "Environment Manager", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/env-manager/SKILL.md", "slug": "Environment Manager" }, "description": "Manage environment variables and secrets across development, staging, and production environments. Use when auditing env vars, syncing secrets between environments, detecting missing or mismatched variables, rotating credentials, or setting up a new environment.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "high", "classification_status": "complete", "catalog_decision": false } }, { "id": "group:dist:runtime-tools:workflow", "kind": "group", "title": "Workflow", "children": [ "leaf:dist:command-plugin-integration", "leaf:dist:env-manager" ] }, { "id": "category:dist:runtime-tools", "kind": "category", "title": "Runtime Tools", "children": [ "group:dist:runtime-tools:playbook", "group:dist:runtime-tools:skill", "group:dist:runtime-tools:workflow" ] }, { "id": "leaf:dist:agentic-actions-auditor", "kind": "leaf", "title": "Agentic Actions Auditor", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/agentic-actions-auditor/SKILL.md", "slug": "agentic-actions-auditor" }, "description": "Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations (Claude Code Action, Gemini CLI, OpenAI Codex, GitHub AI Inference). Detects 9 attack vectors where attacker-controlled input reaches AI agents in CI/CD pipelines. Use when reviewing workflow files that invoke AI coding agents, auditing CI/CD pipeline security for prompt injection risks, or evaluating agentic action configurations.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-active-directory-acl-abuse", "kind": "leaf", "title": "Analyzing Active Directory ACL Abuse", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-active-directory-acl-abuse/SKILL.md", "slug": "Analyzing Active Directory ACL Abuse" }, "description": "Detect dangerous ACL misconfigurations in Active Directory using ldap3", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-apt-group-with-mitre-navigator", "kind": "leaf", "title": "Analyzing APT Group with MITRE ATT&CK Navigator", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-apt-group-with-mitre-navigator/SKILL.md", "slug": "Analyzing APT Group with MITRE ATT&CK Navigator" }, "description": "Analyze advanced persistent threat (APT) group techniques using MITRE", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-command-and-control-communication", "kind": "leaf", "title": "Analyzing Command-and-Control Communication", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-command-and-control-communication/SKILL.md", "slug": "Analyzing Command-and-Control Communication" }, "description": "Analyzes malware command-and-control (C2) communication protocols to", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-golang-malware-with-ghidra", "kind": "leaf", "title": "Analyzing Golang Malware with Ghidra", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-golang-malware-with-ghidra/SKILL.md", "slug": "Analyzing Golang Malware with Ghidra" }, "description": "Review Go malware binaries with Ghidra under authorized, isolated, defensive reverse-engineering controls.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "high", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-office365-audit-logs-for-compromise", "kind": "leaf", "title": "Analyzing Office 365 Audit Logs for Compromise", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-office365-audit-logs-for-compromise/SKILL.md", "slug": "Analyzing Office 365 Audit Logs for Compromise" }, "description": "Parse Office 365 Unified Audit Logs via Microsoft Graph API to detect", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-threat-actor-ttps-with-mitre-attack", "kind": "leaf", "title": "Analyzing Threat Actor TTPs with MITRE ATT&CK", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-threat-actor-ttps-with-mitre-attack/SKILL.md", "slug": "Analyzing Threat Actor TTPs with MITRE ATT&CK" }, "description": "MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-web-server-logs-for-intrusion", "kind": "leaf", "title": "Analyzing Web Server Logs for Intrusion", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-web-server-logs-for-intrusion/SKILL.md", "slug": "Analyzing Web Server Logs for Intrusion" }, "description": "Parse Apache and Nginx access logs to detect SQL injection attempts,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:assessing-vector-and-embedding-weaknesses", "kind": "leaf", "title": "Assessing Vector and Embedding Weaknesses", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/assessing-vector-and-embedding-weaknesses/SKILL.md", "slug": "assessing-vector-and-embedding-weaknesses" }, "description": "Review RAG/vector-store exposure to inversion, membership inference, tenant leakage, retrieval poisoning, and indirect prompt injection without providing default executable attack procedures.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "high", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:auditing-cloud-with-cis-benchmarks", "kind": "leaf", "title": "Auditing Cloud with CIS Benchmarks", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/auditing-cloud-with-cis-benchmarks/SKILL.md", "slug": "Auditing Cloud with CIS Benchmarks" }, "description": "This skill details how to conduct cloud security audits using Center", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:auditing-foundry-smart-contract-security", "kind": "leaf", "title": "Auditing Foundry Smart Contract Security", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/auditing-foundry-smart-contract-security/SKILL.md", "slug": "auditing-foundry-smart-contract-security" }, "description": "Audits Foundry Solidity projects with static analysis, fuzzing, invariants, coverage, key hygiene, and deployment gates. Use before deploying or reviewing EVM smart contracts, triaging Slither/Aderyn/Mythril findings, or validating value-moving contract test coverage.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:auditing-mcp-servers-for-tool-poisoning", "kind": "leaf", "title": "Auditing MCP Servers for Tool Poisoning", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/auditing-mcp-servers-for-tool-poisoning/SKILL.md", "slug": "Auditing MCP Servers for Tool Poisoning" }, "description": "Review Model Context Protocol servers and tool metadata for poisoning, SSRF, unauthenticated exposure, and unsafe agent-supply-chain behavior using authorized, non-exploitative evidence collection.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "high", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:auditing-tls-certificate-transparency-logs", "kind": "leaf", "title": "Auditing TLS Certificate Transparency Logs", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/auditing-tls-certificate-transparency-logs/SKILL.md", "slug": "Auditing TLS Certificate Transparency Logs" }, "description": "Review-gated defensive guidance for monitoring Certificate Transparency signals for owned domains without reconnaissance or external-mutation automation.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "high", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:automating-ioc-enrichment", "kind": "leaf", "title": "Automating IOC Enrichment", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/automating-ioc-enrichment/SKILL.md", "slug": "automating-ioc-enrichment" }, "description": "Automates the enrichment of raw indicators of compromise with multi-source", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:building-attack-pattern-library-from-cti-reports", "kind": "leaf", "title": "Building Attack Pattern Library from CTI Reports", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/building-attack-pattern-library-from-cti-reports/SKILL.md", "slug": "Building Attack Pattern Library from CTI Reports" }, "description": "Review-gated defensive guidance for turning authorized CTI reports into internal detection-engineering knowledge without operationalizing adversary procedures.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "high", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:building-automated-malware-submission-pipeline", "kind": "leaf", "title": "Building Automated Malware Submission Pipeline", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/building-automated-malware-submission-pipeline/SKILL.md", "slug": "Building Automated Malware Submission Pipeline" }, "description": "Review-gated defensive guidance for suspicious-file triage pipelines without executable collection, sandbox-submission, API-key, or blocking automation.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "high", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:building-cloud-siem-with-sentinel", "kind": "leaf", "title": "Building Cloud SIEM with Sentinel", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/building-cloud-siem-with-sentinel/SKILL.md", "slug": "Building Cloud SIEM with Sentinel" }, "description": "Govern Microsoft Sentinel SIEM/SOAR design as an authorized, review-gated defensive security workflow without package-facing cloud mutation snippets.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "high", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:building-detection-rule-with-splunk-spl", "kind": "leaf", "title": "Building Detection Rules with Splunk SPL", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/building-detection-rule-with-splunk-spl/SKILL.md", "slug": "Building Detection Rules with Splunk SPL" }, "description": "Build effective detection rules using Splunk Search Processing Language", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:building-detection-rules-with-sigma", "kind": "leaf", "title": "Building Detection Rules with Sigma", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/building-detection-rules-with-sigma/SKILL.md", "slug": "building-detection-rules-with-sigma" }, "description": "Builds vendor-agnostic detection rules using the Sigma rule format for", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:building-identity-federation-with-saml-azure-ad", "kind": "leaf", "title": "Building Identity Federation with SAML Azure AD", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/building-identity-federation-with-saml-azure-ad/SKILL.md", "slug": "Building Identity Federation with SAML Azure AD" }, "description": "Review-gated defensive governance guidance for SAML and Microsoft Entra ID federation without exposing tenant mutation commands, signing-certificate operations, or production account-control procedures.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "high", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:building-incident-response-dashboard", "kind": "leaf", "title": "Building Incident Response Dashboard", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/building-incident-response-dashboard/SKILL.md", "slug": "Building Incident Response Dashboard" }, "description": "Design defensive incident-response dashboard governance without exposing live incident data, IOCs, credentials, or SIEM mutation snippets.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "high", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:building-ioc-defanging-and-sharing-pipeline", "kind": "leaf", "title": "Building IOC Defanging and Sharing Pipeline", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/building-ioc-defanging-and-sharing-pipeline/SKILL.md", "slug": "Building IOC Defanging and Sharing Pipeline" }, "description": "Review-gated defensive guidance for handling, defanging, and sharing indicators of compromise without exposing active malicious indicators, credentials, or automated external submission paths.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "high", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:building-malware-incident-communication-template", "kind": "leaf", "title": "Building Malware Incident Communication Template", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/building-malware-incident-communication-template/SKILL.md", "slug": "Building Malware Incident Communication Template" }, "description": "Plan malware incident communications with review-gated, legally coordinated stakeholder messaging.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "high", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:building-phishing-reporting-button-workflow", "kind": "leaf", "title": "Building Phishing Reporting Button Workflow", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/building-phishing-reporting-button-workflow/SKILL.md", "slug": "Building Phishing Reporting Button Workflow" }, "description": "Govern phishing reporting-button programs without exposing package-facing mailbox mutation, external-submission, or private-data automation.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "high", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:building-ransomware-playbook-with-cisa-framework", "kind": "leaf", "title": "Building Ransomware Playbook with CISA Framework", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/building-ransomware-playbook-with-cisa-framework/SKILL.md", "slug": "Building Ransomware Playbook with CISA Framework" }, "description": "Builds a structured ransomware incident response playbook aligned with", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "high", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:building-soc-escalation-matrix", "kind": "leaf", "title": "Building SOC Escalation Matrix", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/building-soc-escalation-matrix/SKILL.md", "slug": "Building SOC Escalation Matrix" }, "description": "Build a structured SOC escalation matrix defining severity tiers, response", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:building-soc-metrics-and-kpi-tracking", "kind": "leaf", "title": "Building SOC Metrics and KPI Tracking", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/building-soc-metrics-and-kpi-tracking/SKILL.md", "slug": "Building SOC Metrics and KPI Tracking" }, "description": "Builds SOC performance metrics and KPI tracking dashboards measuring", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:building-soc-playbook-for-ransomware", "kind": "leaf", "title": "Building SOC Playbook for Ransomware", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/building-soc-playbook-for-ransomware/SKILL.md", "slug": "Building SOC Playbook for Ransomware" }, "description": "Builds a structured SOC incident response playbook for ransomware attacks", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "high", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:building-threat-feed-aggregation-with-misp", "kind": "leaf", "title": "Building Threat Feed Aggregation with MISP", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/building-threat-feed-aggregation-with-misp/SKILL.md", "slug": "building-threat-feed-aggregation-with-misp" }, "description": "Deploy MISP (Malware Information Sharing Platform) to aggregate, correlate,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:building-threat-hunt-hypothesis-framework", "kind": "leaf", "title": "Building Threat Hunt Hypothesis Framework", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/building-threat-hunt-hypothesis-framework/SKILL.md", "slug": "building-threat-hunt-hypothesis-framework" }, "description": "Build a systematic threat hunt hypothesis framework that transforms threat", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:building-vulnerability-aging-and-sla-tracking", "kind": "leaf", "title": "Building Vulnerability Aging and SLA Tracking", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/building-vulnerability-aging-and-sla-tracking/SKILL.md", "slug": "Building Vulnerability Aging and SLA Tracking" }, "description": "Implement a vulnerability aging dashboard and SLA tracking system to", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:building-vulnerability-exception-tracking-system", "kind": "leaf", "title": "Building Vulnerability Exception Tracking System", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/building-vulnerability-exception-tracking-system/SKILL.md", "slug": "Building Vulnerability Exception Tracking System" }, "description": "Build a vulnerability exception and risk acceptance tracking system with", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:building-vulnerability-scanning-workflow", "kind": "leaf", "title": "Building Vulnerability Scanning Workflow", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/building-vulnerability-scanning-workflow/SKILL.md", "slug": "Building Vulnerability Scanning Workflow" }, "description": "Builds a structured vulnerability scanning workflow using tools like", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:configuring-ldap-security-hardening", "kind": "leaf", "title": "Configuring LDAP Security Hardening", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/configuring-ldap-security-hardening/SKILL.md", "slug": "Configuring LDAP Security Hardening" }, "description": "Harden LDAP directory services against common attacks including credential", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:detecting-anomalies-in-industrial-control-systems", "kind": "leaf", "title": "Detecting Anomalies in Industrial Control Systems", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-anomalies-in-industrial-control-systems/SKILL.md", "slug": "Detecting Anomalies in Industrial Control Systems" }, "description": "This skill covers deploying anomaly detection systems for industrial", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:detecting-aws-cloudtrail-anomalies", "kind": "leaf", "title": "Detecting AWS CloudTrail Anomalies", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-aws-cloudtrail-anomalies/SKILL.md", "slug": "Detecting AWS CloudTrail Anomalies" }, "description": "Detect unusual API call patterns in AWS CloudTrail logs using boto3,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:detecting-dnp3-protocol-anomalies", "kind": "leaf", "title": "Detecting DNP3 Protocol Anomalies", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-dnp3-protocol-anomalies/SKILL.md", "slug": "Detecting DNP3 Protocol Anomalies" }, "description": "Detect anomalies in DNP3 (Distributed Network Protocol 3) communications", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:detecting-insider-threat-with-ueba", "kind": "leaf", "title": "Detecting Insider Threat with UEBA", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-insider-threat-with-ueba/SKILL.md", "slug": "Detecting Insider Threat with UEBA" }, "description": "Implement User and Entity Behavior Analytics using Elasticsearch/OpenSearch", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:detecting-rdp-brute-force-attacks", "kind": "leaf", "title": "Detecting RDP Brute Force Attacks", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-rdp-brute-force-attacks/SKILL.md", "slug": "Detecting RDP Brute Force Attacks" }, "description": "Detect RDP brute force attacks by analyzing Windows Security Event Logs", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:detecting-sql-injection-via-waf-logs", "kind": "leaf", "title": "Detecting SQL Injection via WAF Logs", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-sql-injection-via-waf-logs/SKILL.md", "slug": "Detecting SQL Injection via WAF Logs" }, "description": "Analyze WAF (ModSecurity/AWS WAF/Cloudflare) logs to detect SQL injection", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:detecting-suspicious-oauth-application-consent", "kind": "leaf", "title": "Detecting Suspicious OAuth Application Consent", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-suspicious-oauth-application-consent/SKILL.md", "slug": "Detecting Suspicious OAuth Application Consent" }, "description": "Detect risky OAuth application consent grants in Azure AD / Microsoft", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:hardening-linux-endpoint-with-cis-benchmark", "kind": "leaf", "title": "Hardening Linux Endpoint with CIS Benchmark", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/hardening-linux-endpoint-with-cis-benchmark/SKILL.md", "slug": "Hardening Linux Endpoint with CIS Benchmark" }, "description": "Hardens Linux endpoints using CIS Benchmark recommendations for Ubuntu,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:hunting-credential-stuffing-attacks", "kind": "leaf", "title": "Hunting Credential Stuffing Attacks", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/hunting-credential-stuffing-attacks/SKILL.md", "slug": "Hunting Credential Stuffing Attacks" }, "description": "Detects credential stuffing attacks by analyzing authentication logs", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:hunting-for-data-staging-before-exfiltration", "kind": "leaf", "title": "Hunting for Data Staging Before Exfiltration", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/hunting-for-data-staging-before-exfiltration/SKILL.md", "slug": "Hunting for Data Staging Before Exfiltration" }, "description": "Detect data staging activity before exfiltration by monitoring for archive", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:hunting-for-dns-based-persistence", "kind": "leaf", "title": "Hunting for DNS-based Persistence", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/hunting-for-dns-based-persistence/SKILL.md", "slug": "Hunting for DNS-based Persistence" }, "description": "Hunt for DNS-based persistence mechanisms including DNS hijacking, dangling", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:hunting-for-ntlm-relay-attacks", "kind": "leaf", "title": "Hunting for NTLM Relay Attacks", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/hunting-for-ntlm-relay-attacks/SKILL.md", "slug": "Hunting for NTLM Relay Attacks" }, "description": "Detect NTLM relay attacks by analyzing Windows Event 4624 logon type", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:hunting-for-registry-run-key-persistence", "kind": "leaf", "title": "Hunting for Registry Run Key Persistence", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/hunting-for-registry-run-key-persistence/SKILL.md", "slug": "Hunting for Registry Run Key Persistence" }, "description": "Detect MITRE ATT&CK T1547.001 registry Run key persistence by analyzing", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:hunting-for-startup-folder-persistence", "kind": "leaf", "title": "Hunting for Startup Folder Persistence", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/hunting-for-startup-folder-persistence/SKILL.md", "slug": "Hunting for Startup Folder Persistence" }, "description": "Detect T1547.001 startup folder persistence by monitoring Windows startup", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-ddos-mitigation-with-cloudflare", "kind": "leaf", "title": "Implementing DDoS Mitigation with Cloudflare", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-ddos-mitigation-with-cloudflare/SKILL.md", "slug": "Implementing DDoS Mitigation with Cloudflare" }, "description": "Configure Cloudflare DDoS protection with managed rulesets, rate limiting,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-device-posture-assessment-in-zero-trust", "kind": "leaf", "title": "Implementing Device Posture Assessment in Zero Trust", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-device-posture-assessment-in-zero-trust/SKILL.md", "slug": "Implementing Device Posture Assessment in Zero Trust" }, "description": "Implementing device posture assessment as a zero trust access control", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-digital-signatures-with-ed25519", "kind": "leaf", "title": "Implementing Digital Signatures with Ed25519", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-digital-signatures-with-ed25519/SKILL.md", "slug": "Implementing Digital Signatures with Ed25519" }, "description": "Ed25519 is a high-performance digital signature algorithm using the Edwards", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-endpoint-detection-with-wazuh", "kind": "leaf", "title": "Implementing Endpoint Detection with Wazuh", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-endpoint-detection-with-wazuh/SKILL.md", "slug": "Implementing Endpoint Detection with Wazuh" }, "description": "Deploy and configure Wazuh SIEM/XDR for endpoint detection including", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-epss-score-for-vulnerability-prioritization", "kind": "leaf", "title": "Implementing EPSS Score for Vulnerability Prioritization", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-epss-score-for-vulnerability-prioritization/SKILL.md", "slug": "Implementing EPSS Score for Vulnerability Prioritization" }, "description": "Integrate FIRST's Exploit Prediction Scoring System (EPSS) API to prioritize", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-file-integrity-monitoring-with-aide", "kind": "leaf", "title": "Implementing File Integrity Monitoring with AIDE", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-file-integrity-monitoring-with-aide/SKILL.md", "slug": "Implementing File Integrity Monitoring with AIDE" }, "description": "Configure AIDE (Advanced Intrusion Detection Environment) for file integrity", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-privileged-access-workstation", "kind": "leaf", "title": "Implementing Privileged Access Workstation", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-privileged-access-workstation/SKILL.md", "slug": "Implementing Privileged Access Workstation" }, "description": "Design and implement Privileged Access Workstations (PAWs) with device", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-runtime-application-self-protection", "kind": "leaf", "title": "Implementing Runtime Application Self-Protection", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-runtime-application-self-protection/SKILL.md", "slug": "Implementing Runtime Application Self-Protection" }, "description": "Deploy Runtime Application Self-Protection (RASP) agents to detect and", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-runtime-security-with-tetragon", "kind": "leaf", "title": "Implementing Runtime Security with Tetragon", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-runtime-security-with-tetragon/SKILL.md", "slug": "Implementing Runtime Security with Tetragon" }, "description": "Implement eBPF-based runtime security observability and enforcement in", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-siem-use-case-tuning", "kind": "leaf", "title": "Implementing SIEM Use Case Tuning", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-siem-use-case-tuning/SKILL.md", "slug": "Implementing SIEM Use Case Tuning" }, "description": "Tune SIEM detection rules to reduce false positives by analyzing alert", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-vulnerability-management-with-greenbone", "kind": "leaf", "title": "Implementing Vulnerability Management with Greenbone", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-vulnerability-management-with-greenbone/SKILL.md", "slug": "Implementing Vulnerability Management with Greenbone" }, "description": "Deploy and operate Greenbone/OpenVAS vulnerability management using the", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-vulnerability-remediation-sla", "kind": "leaf", "title": "Implementing Vulnerability Remediation SLA", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-vulnerability-remediation-sla/SKILL.md", "slug": "Implementing Vulnerability Remediation SLA" }, "description": "Vulnerability remediation SLAs define mandatory timeframes for patching", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:monitoring-scada-modbus-traffic-anomalies", "kind": "leaf", "title": "Monitoring SCADA Modbus Traffic Anomalies", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/monitoring-scada-modbus-traffic-anomalies/SKILL.md", "slug": "Monitoring SCADA Modbus Traffic Anomalies" }, "description": "Monitors Modbus TCP traffic on SCADA and ICS networks to detect anomalous", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-bandwidth-throttling-attack-simulation", "kind": "leaf", "title": "Performing Bandwidth Throttling Attack Simulation", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-bandwidth-throttling-attack-simulation/SKILL.md", "slug": "Performing Bandwidth Throttling Attack Simulation" }, "description": "Simulates bandwidth throttling and network degradation attacks using", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-cloud-native-forensics-with-falco", "kind": "leaf", "title": "Performing Cloud Native Forensics with Falco", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-cloud-native-forensics-with-falco/SKILL.md", "slug": "Performing Cloud Native Forensics with Falco" }, "description": "Uses Falco YAML rules for runtime threat detection in containers and", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-dns-tunneling-detection", "kind": "leaf", "title": "Performing DNS Tunneling Detection", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-dns-tunneling-detection/SKILL.md", "slug": "Performing DNS Tunneling Detection" }, "description": "Detects DNS tunneling by computing Shannon entropy of DNS query names,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-endpoint-vulnerability-remediation", "kind": "leaf", "title": "Performing Endpoint Vulnerability Remediation", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-endpoint-vulnerability-remediation/SKILL.md", "slug": "Performing Endpoint Vulnerability Remediation" }, "description": "Performs vulnerability remediation on endpoints by prioritizing CVEs", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-ot-vulnerability-assessment-with-claroty", "kind": "leaf", "title": "Performing OT Vulnerability Assessment with Claroty", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-ot-vulnerability-assessment-with-claroty/SKILL.md", "slug": "Performing OT Vulnerability Assessment with Claroty" }, "description": "This skill covers performing vulnerability assessments in OT environments", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-ot-vulnerability-scanning-safely", "kind": "leaf", "title": "Performing OT Vulnerability Scanning Safely", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-ot-vulnerability-scanning-safely/SKILL.md", "slug": "Performing OT Vulnerability Scanning Safely" }, "description": "Perform vulnerability scanning in OT/ICS environments safely using passive", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-packet-injection-attack", "kind": "leaf", "title": "Performing Packet Injection Attack", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-packet-injection-attack/SKILL.md", "slug": "Performing Packet Injection Attack" }, "description": "Crafts and injects custom network packets using Scapy, hping3, and Nemesis", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-privileged-account-discovery", "kind": "leaf", "title": "Performing Privileged Account Discovery", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-privileged-account-discovery/SKILL.md", "slug": "Performing Privileged Account Discovery" }, "description": "Discover and inventory all privileged accounts across enterprise infrastructure", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-s7comm-protocol-security-analysis", "kind": "leaf", "title": "Performing S7comm Protocol Security Analysis", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-s7comm-protocol-security-analysis/SKILL.md", "slug": "Performing S7comm Protocol Security Analysis" }, "description": "Perform security analysis of Siemens S7comm and S7CommPlus protocols", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-ssrf-vulnerability-exploitation", "kind": "leaf", "title": "For authorized penetration testing and lab environments only", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-ssrf-vulnerability-exploitation/SKILL.md", "slug": "For authorized penetration testing and lab environments only" }, "description": "Test for Server-Side Request Forgery vulnerabilities by probing cloud", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-threat-emulation-with-atomic-red-team", "kind": "leaf", "title": "Performing Threat Emulation with Atomic Red Team", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-threat-emulation-with-atomic-red-team/SKILL.md", "slug": "Performing Threat Emulation with Atomic Red Team" }, "description": "Executes Atomic Red Team tests for MITRE ATT&CK technique validation", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-threat-modeling-with-owasp-threat-dragon", "kind": "leaf", "title": "Performing Threat Modeling with OWASP Threat Dragon", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-threat-modeling-with-owasp-threat-dragon/SKILL.md", "slug": "Performing Threat Modeling with OWASP Threat Dragon" }, "description": "Use OWASP Threat Dragon to create data flow diagrams, identify threats", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-user-behavior-analytics", "kind": "leaf", "title": "Performing User Behavior Analytics", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-user-behavior-analytics/SKILL.md", "slug": "Performing User Behavior Analytics" }, "description": "Performs User and Entity Behavior Analytics (UEBA) to detect anomalous", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-web-application-vulnerability-triage", "kind": "leaf", "title": "Performing Web Application Vulnerability Triage", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-web-application-vulnerability-triage/SKILL.md", "slug": "Performing Web Application Vulnerability Triage" }, "description": "Triage web application vulnerability findings from DAST/SAST scanners", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:scanning-infrastructure-with-nessus", "kind": "leaf", "title": "Scanning Infrastructure with Nessus", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/scanning-infrastructure-with-nessus/SKILL.md", "slug": "Scanning Infrastructure with Nessus" }, "description": "Tenable Nessus is the industry-leading vulnerability scanner used to", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "group:dist:security-defensive:playbook", "kind": "group", "title": "Playbook", "children": [ "leaf:dist:agentic-actions-auditor", "leaf:dist:analyzing-active-directory-acl-abuse", "leaf:dist:analyzing-apt-group-with-mitre-navigator", "leaf:dist:analyzing-command-and-control-communication", "leaf:dist:analyzing-golang-malware-with-ghidra", "leaf:dist:analyzing-office365-audit-logs-for-compromise", "leaf:dist:analyzing-threat-actor-ttps-with-mitre-attack", "leaf:dist:analyzing-web-server-logs-for-intrusion", "leaf:dist:assessing-vector-and-embedding-weaknesses", "leaf:dist:auditing-cloud-with-cis-benchmarks", "leaf:dist:auditing-foundry-smart-contract-security", "leaf:dist:auditing-mcp-servers-for-tool-poisoning", "leaf:dist:auditing-tls-certificate-transparency-logs", "leaf:dist:automating-ioc-enrichment", "leaf:dist:building-attack-pattern-library-from-cti-reports", "leaf:dist:building-automated-malware-submission-pipeline", "leaf:dist:building-cloud-siem-with-sentinel", "leaf:dist:building-detection-rule-with-splunk-spl", "leaf:dist:building-detection-rules-with-sigma", "leaf:dist:building-identity-federation-with-saml-azure-ad", "leaf:dist:building-incident-response-dashboard", "leaf:dist:building-ioc-defanging-and-sharing-pipeline", "leaf:dist:building-malware-incident-communication-template", "leaf:dist:building-phishing-reporting-button-workflow", "leaf:dist:building-ransomware-playbook-with-cisa-framework", "leaf:dist:building-soc-escalation-matrix", "leaf:dist:building-soc-metrics-and-kpi-tracking", "leaf:dist:building-soc-playbook-for-ransomware", "leaf:dist:building-threat-feed-aggregation-with-misp", "leaf:dist:building-threat-hunt-hypothesis-framework", "leaf:dist:building-vulnerability-aging-and-sla-tracking", "leaf:dist:building-vulnerability-exception-tracking-system", "leaf:dist:building-vulnerability-scanning-workflow", "leaf:dist:configuring-ldap-security-hardening", "leaf:dist:detecting-anomalies-in-industrial-control-systems", "leaf:dist:detecting-aws-cloudtrail-anomalies", "leaf:dist:detecting-dnp3-protocol-anomalies", "leaf:dist:detecting-insider-threat-with-ueba", "leaf:dist:detecting-rdp-brute-force-attacks", "leaf:dist:detecting-sql-injection-via-waf-logs", "leaf:dist:detecting-suspicious-oauth-application-consent", "leaf:dist:hardening-linux-endpoint-with-cis-benchmark", "leaf:dist:hunting-credential-stuffing-attacks", "leaf:dist:hunting-for-data-staging-before-exfiltration", "leaf:dist:hunting-for-dns-based-persistence", "leaf:dist:hunting-for-ntlm-relay-attacks", "leaf:dist:hunting-for-registry-run-key-persistence", "leaf:dist:hunting-for-startup-folder-persistence", "leaf:dist:implementing-ddos-mitigation-with-cloudflare", "leaf:dist:implementing-device-posture-assessment-in-zero-trust", "leaf:dist:implementing-digital-signatures-with-ed25519", "leaf:dist:implementing-endpoint-detection-with-wazuh", "leaf:dist:implementing-epss-score-for-vulnerability-prioritization", "leaf:dist:implementing-file-integrity-monitoring-with-aide", "leaf:dist:implementing-privileged-access-workstation", "leaf:dist:implementing-runtime-application-self-protection", "leaf:dist:implementing-runtime-security-with-tetragon", "leaf:dist:implementing-siem-use-case-tuning", "leaf:dist:implementing-vulnerability-management-with-greenbone", "leaf:dist:implementing-vulnerability-remediation-sla", "leaf:dist:monitoring-scada-modbus-traffic-anomalies", "leaf:dist:performing-bandwidth-throttling-attack-simulation", "leaf:dist:performing-cloud-native-forensics-with-falco", "leaf:dist:performing-dns-tunneling-detection", "leaf:dist:performing-endpoint-vulnerability-remediation", "leaf:dist:performing-ot-vulnerability-assessment-with-claroty", "leaf:dist:performing-ot-vulnerability-scanning-safely", "leaf:dist:performing-packet-injection-attack", "leaf:dist:performing-privileged-account-discovery", "leaf:dist:performing-s7comm-protocol-security-analysis", "leaf:dist:performing-ssrf-vulnerability-exploitation", "leaf:dist:performing-threat-emulation-with-atomic-red-team", "leaf:dist:performing-threat-modeling-with-owasp-threat-dragon", "leaf:dist:performing-user-behavior-analytics", "leaf:dist:performing-web-application-vulnerability-triage", "leaf:dist:scanning-infrastructure-with-nessus" ] }, { "id": "leaf:dist:hook-security", "kind": "leaf", "title": "Hook Security", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/hook-security/SKILL.md", "slug": "Hook Security" }, "description": "Follow security best practices for hooks — input validation, path safety, quote discipline, timeouts, parallel execution, and temporary activation. Use when building hooks that validate or modify tool calls.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "high", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:prompt-injection-detection", "kind": "leaf", "title": "Prompt Injection Detection", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/prompt-injection-detection/SKILL.md", "slug": "Prompt Injection Detection" }, "description": "Detect prompt injection attacks targeting LLM-based applications. Use when sanitizing user inputs, building input validation for AI agents, or scanning for prompt injection vulnerabilities. Covers direct injections (system prompt overrides, role-play escapes) and indirect injections (encoded payloads, multi-language obfuscation).", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "group:dist:security-defensive:skill", "kind": "group", "title": "Skill", "children": [ "leaf:dist:hook-security", "leaf:dist:prompt-injection-detection" ] }, { "id": "leaf:dist:building-threat-intelligence-enrichment-in-splunk", "kind": "leaf", "title": "Building Threat Intelligence Enrichment in Splunk", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/building-threat-intelligence-enrichment-in-splunk/SKILL.md", "slug": "Building Threat Intelligence Enrichment in Splunk" }, "description": "Build automated threat intelligence enrichment pipelines in Splunk Enterprise", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "high", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:building-threat-intelligence-feed-integration", "kind": "leaf", "title": "Building Threat Intelligence Feed Integration", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/building-threat-intelligence-feed-integration/SKILL.md", "slug": "Building Threat Intelligence Feed Integration" }, "description": "Builds automated threat intelligence feed integration pipelines connecting", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "high", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:collecting-threat-intelligence-with-misp", "kind": "leaf", "title": "Collecting Threat Intelligence with MISP", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/collecting-threat-intelligence-with-misp/SKILL.md", "slug": "Collecting Threat Intelligence with MISP" }, "description": "MISP (Malware Information Sharing Platform) is an open-source threat", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "high", "classification_status": "complete", "catalog_decision": false } }, { "id": "group:dist:security-defensive:workflow", "kind": "group", "title": "Workflow", "children": [ "leaf:dist:building-threat-intelligence-enrichment-in-splunk", "leaf:dist:building-threat-intelligence-feed-integration", "leaf:dist:collecting-threat-intelligence-with-misp" ] }, { "id": "category:dist:security-defensive", "kind": "category", "title": "Security Defensive", "children": [ "group:dist:security-defensive:playbook", "group:dist:security-defensive:skill", "group:dist:security-defensive:workflow" ] }, { "id": "leaf:dist:abusing-dpapi-for-credential-access", "kind": "leaf", "title": "Abusing DPAPI for Credential Access", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/abusing-dpapi-for-credential-access/SKILL.md", "slug": "abusing-dpapi-for-credential-access" }, "description": "Review-gated defensive assessment wrapper for DPAPI credential-access risk. Use only for authorized Windows security planning, evidence boundaries, detection mapping, and remediation.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "high", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:abusing-shadow-credentials-for-privesc", "kind": "leaf", "title": "Abusing Shadow Credentials for Privilege Escalation", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/abusing-shadow-credentials-for-privesc/SKILL.md", "slug": "abusing-shadow-credentials-for-privesc" }, "description": "Take over Active Directory user and computer accounts by writing alternate certificate keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, and Certipy, then authenticate via PKINIT. Use only for authorized security testing, red-team engagements, and purple-team validation.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "high", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-persistence-mechanisms-in-linux", "kind": "leaf", "title": "Analyzing Persistence Mechanisms in Linux", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-persistence-mechanisms-in-linux/SKILL.md", "slug": "Analyzing Persistence Mechanisms in Linux" }, "description": "Detect and analyze Linux persistence mechanisms including crontab entries,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:attacking-entra-id-with-roadtools", "kind": "leaf", "title": "Attacking Entra ID with ROADtools", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/attacking-entra-id-with-roadtools/SKILL.md", "slug": "attacking-entra-id-with-roadtools" }, "description": "Review-gated defensive assessment wrapper for ROADtools-based Entra ID security validation. Use only for authorized identity-security planning, evidence boundaries, and remediation mapping.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "high", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:attacking-oauth-with-device-code-phishing", "kind": "leaf", "title": "Attacking OAuth with Device-Code Phishing", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/attacking-oauth-with-device-code-phishing/SKILL.md", "slug": "attacking-oauth-with-device-code-phishing" }, "description": "Review-gated defensive wrapper for OAuth identity-risk validation. Use only for authorized planning, control review, detection design, and remediation mapping.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "high", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:auditing-entra-id-with-aadinternals", "kind": "leaf", "title": "Auditing Entra ID with AADInternals", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/auditing-entra-id-with-aadinternals/SKILL.md", "slug": "auditing-entra-id-with-aadinternals" }, "description": "Review-gated defensive assessment wrapper for AADInternals-based Entra ID security validation. Use only for authorized identity-security planning, evidence boundaries, detection design, and remediation mapping.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "high", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:building-c2-infrastructure-with-sliver-framework", "kind": "leaf", "title": "Building C2 Infrastructure with Sliver Framework", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/building-c2-infrastructure-with-sliver-framework/SKILL.md", "slug": "building-c2-infrastructure-with-sliver-framework" }, "description": "Safety placeholder for a removed high-risk security entry. Use only to record review status, authorization boundaries, and defensive remediation planning.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "high", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:building-c2-redirector-infrastructure", "kind": "leaf", "title": "Building C2 Redirector Infrastructure", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/building-c2-redirector-infrastructure/SKILL.md", "slug": "building-c2-redirector-infrastructure" }, "description": "Safety placeholder for a removed high-risk security entry. Use only to record review status, authorization boundaries, and defensive remediation planning.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "high", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:building-red-team-c2-infrastructure-with-havoc", "kind": "leaf", "title": "Building Red Team C2 Infrastructure with Havoc", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/building-red-team-c2-infrastructure-with-havoc/SKILL.md", "slug": "building-red-team-c2-infrastructure-with-havoc" }, "description": "Safety placeholder for a removed high-risk security entry. Use only to record review status, authorization boundaries, and defensive remediation planning.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "high", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-memory-protection-with-dep-aslr", "kind": "leaf", "title": "Implementing Memory Protection with DEP and ASLR", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-memory-protection-with-dep-aslr/SKILL.md", "slug": "Implementing Memory Protection with DEP and ASLR" }, "description": "Implements memory protection mechanisms including DEP (Data Execution", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-patch-management-workflow", "kind": "leaf", "title": "Implementing Patch Management Workflow", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-patch-management-workflow/SKILL.md", "slug": "Implementing Patch Management Workflow" }, "description": "Patch management is the systematic process of identifying, testing, deploying,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:moving-laterally-with-netexec", "kind": "leaf", "title": "Moving Laterally with NetExec", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/moving-laterally-with-netexec/SKILL.md", "slug": "moving-laterally-with-netexec" }, "description": "Review-gated defensive assessment wrapper for NetExec lateral-movement and credential-abuse risk. Use only for authorized network security planning, detection mapping, evidence boundaries, and remediation.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "high", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-credential-access-with-lazagne", "kind": "leaf", "title": "Performing Credential Access with LaZagne", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-credential-access-with-lazagne/SKILL.md", "slug": "performing-credential-access-with-lazagne" }, "description": "Review-gated defensive assessment wrapper for LaZagne credential-access risk. Use only for authorized security planning, evidence boundaries, detection mapping, and remediation.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "high", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-initial-access-with-evilginx3", "kind": "leaf", "title": "Performing Initial Access with EvilGinx3", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-initial-access-with-evilginx3/SKILL.md", "slug": "performing-initial-access-with-evilginx3" }, "description": "Review-gated defensive assessment wrapper for EvilGinx3 adversary-in-the-middle phishing and session-capture risk. Use only for authorized security planning, detection mapping, and remediation.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "high", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-kerberoasting-attack", "kind": "leaf", "title": "Performing Kerberoasting Attack", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-kerberoasting-attack/SKILL.md", "slug": "performing-kerberoasting-attack" }, "description": "Review-gated defensive assessment wrapper for Kerberoasting risk. Use only for authorized Active Directory security planning, detection mapping, evidence boundaries, and remediation.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "high", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-privilege-escalation-on-linux", "kind": "leaf", "title": "Performing Privilege Escalation on Linux", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-privilege-escalation-on-linux/SKILL.md", "slug": "Performing Privilege Escalation on Linux" }, "description": "Linux privilege escalation involves elevating from a low-privilege user", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "group:dist:security-offensive:playbook", "kind": "group", "title": "Playbook", "children": [ "leaf:dist:abusing-dpapi-for-credential-access", "leaf:dist:abusing-shadow-credentials-for-privesc", "leaf:dist:analyzing-persistence-mechanisms-in-linux", "leaf:dist:attacking-entra-id-with-roadtools", "leaf:dist:attacking-oauth-with-device-code-phishing", "leaf:dist:auditing-entra-id-with-aadinternals", "leaf:dist:building-c2-infrastructure-with-sliver-framework", "leaf:dist:building-c2-redirector-infrastructure", "leaf:dist:building-red-team-c2-infrastructure-with-havoc", "leaf:dist:implementing-memory-protection-with-dep-aslr", "leaf:dist:implementing-patch-management-workflow", "leaf:dist:moving-laterally-with-netexec", "leaf:dist:performing-credential-access-with-lazagne", "leaf:dist:performing-initial-access-with-evilginx3", "leaf:dist:performing-kerberoasting-attack", "leaf:dist:performing-privilege-escalation-on-linux" ] }, { "id": "leaf:dist:coercing-authentication-with-coercer-petitpotam", "kind": "leaf", "title": "Coercing Authentication with Coercer and PetitPotam", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/coercing-authentication-with-coercer-petitpotam/SKILL.md", "slug": "Coercing Authentication with Coercer and PetitPotam" }, "description": "Trigger machine account authentication with PetitPotam (MS-EFSR) and Coercer across MS-RPRN, MS-DFSNM, and MS-FSRVP to feed NTLM relay into AD CS Web Enrollment (ESC8) and other relay targets.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "high", "classification_status": "complete", "catalog_decision": false } }, { "id": "group:dist:security-offensive:runbook", "kind": "group", "title": "Runbook", "children": [ "leaf:dist:coercing-authentication-with-coercer-petitpotam" ] }, { "id": "category:dist:security-offensive", "kind": "category", "title": "Security Offensive", "children": [ "group:dist:security-offensive:playbook", "group:dist:security-offensive:runbook" ] }, { "id": "leaf:dist:ai-sdk-provider-tool-safety", "kind": "leaf", "title": "AI SDK Provider Tool Safety", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/ai-sdk-provider-tool-safety/SKILL.md", "slug": "ai-sdk-provider-tool-safety" }, "description": "Design provider-agnostic AI features with explicit tool, sandbox, model, and runtime boundaries before implementation.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:analyzing-api-gateway-access-logs", "kind": "leaf", "title": "Analyzing API Gateway Access Logs", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/analyzing-api-gateway-access-logs/SKILL.md", "slug": "Analyzing API Gateway Access Logs" }, "description": "Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:api-design-reviewer", "kind": "leaf", "title": "API Design Reviewer — Linting, Breaking Change Detection, and Scorecards", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/api-design-reviewer/SKILL.md", "slug": "API Design Reviewer — Linting, Breaking Change Detection, and Scorecards" }, "description": "Comprehensive REST API design review with automated linting, breaking-change detection, and design scorecards. Catches inconsistent conventions, missing versioning, and design smells before APIs ship. Use when reviewing a PR that adds or changes API endpoints, auditing an existing API for v2 migration, or establishing API standards for a team.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:auditing-kubernetes-rbac-privilege-escalation", "kind": "leaf", "title": "Auditing Kubernetes RBAC Privilege Escalation", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/auditing-kubernetes-rbac-privilege-escalation/SKILL.md", "slug": "Auditing Kubernetes RBAC Privilege Escalation" }, "description": "Find over-permissive RBAC roles and service-account token abuse paths in Kubernetes using kubectl auth can-i, rbac-police, kubectl-who-can, and rakkess during authorized cluster security reviews.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:auditing-terraform-infrastructure-for-security", "kind": "leaf", "title": "Auditing Terraform Infrastructure for Security", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/auditing-terraform-infrastructure-for-security/SKILL.md", "slug": "Auditing Terraform Infrastructure for Security" }, "description": "Auditing Terraform infrastructure-as-code for security misconfigurations", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:auditing-uefi-firmware-with-chipsec", "kind": "leaf", "title": "Auditing UEFI Firmware with CHIPSEC", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/auditing-uefi-firmware-with-chipsec/SKILL.md", "slug": "Auditing UEFI Firmware with CHIPSEC" }, "description": "Use Intel CHIPSEC to assess platform firmware configuration, SPI flash write protection, BIOS lock, SMM/SMRR, and Secure Boot variable state, dump SPI flash, and triage UEFI variables for firmware-level threats.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:benchmarking-kubernetes-with-kube-bench", "kind": "leaf", "title": "Benchmarking Kubernetes with kube-bench", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/benchmarking-kubernetes-with-kube-bench/SKILL.md", "slug": "Benchmarking Kubernetes with kube-bench" }, "description": "Run CIS Kubernetes Benchmark checks and remediate findings with kube-bench.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:browser-trace", "kind": "leaf", "title": "Browser Trace", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/browser-trace/SKILL.md", "slug": "Browser Trace" }, "description": "Review-gated guidance for collecting and inspecting browser automation traces in authorized debugging contexts. Use only for read-only defensive investigation of owned or explicitly authorized browser sessions; do not use for account/session surveillance, credential capture, or unapproved browser attachment.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "high", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:building-devsecops-pipeline-with-gitlab-ci", "kind": "leaf", "title": "Building DevSecOps Pipeline with GitLab CI", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/building-devsecops-pipeline-with-gitlab-ci/SKILL.md", "slug": "Building DevSecOps Pipeline with GitLab CI" }, "description": "Design and implement a comprehensive DevSecOps pipeline in GitLab CI/CD", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:building-identity-governance-lifecycle-process", "kind": "leaf", "title": "Building Identity Governance Lifecycle Process", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/building-identity-governance-lifecycle-process/SKILL.md", "slug": "Building Identity Governance Lifecycle Process" }, "description": "Builds comprehensive identity governance and lifecycle management processes", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:building-ioc-enrichment-pipeline-with-opencti", "kind": "leaf", "title": "Building IOC Enrichment Pipeline with OpenCTI", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/building-ioc-enrichment-pipeline-with-opencti/SKILL.md", "slug": "Building IOC Enrichment Pipeline with OpenCTI" }, "description": "OpenCTI is an open-source platform for managing cyber threat intelligence", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:building-threat-intelligence-platform", "kind": "leaf", "title": "Building Threat Intelligence Platform", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/building-threat-intelligence-platform/SKILL.md", "slug": "Building Threat Intelligence Platform" }, "description": "Building a Threat Intelligence Platform (TIP) involves deploying and", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:building-vulnerability-dashboard-with-defectdojo", "kind": "leaf", "title": "Building Vulnerability Dashboard with DefectDojo", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/building-vulnerability-dashboard-with-defectdojo/SKILL.md", "slug": "Building Vulnerability Dashboard with DefectDojo" }, "description": "Deploy DefectDojo as a centralized vulnerability management dashboard", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:bypassing-authentication-with-forced-browsing", "kind": "leaf", "title": "Bypassing Authentication with Forced Browsing", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/bypassing-authentication-with-forced-browsing/SKILL.md", "slug": "Bypassing Authentication with Forced Browsing" }, "description": "Discovering and accessing unprotected pages, APIs, and administrative", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:capacity-planner", "kind": "leaf", "title": "Capacity Planner — Ops Team Sizing with Erlang-C Queueing Theory", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/capacity-planner/SKILL.md", "slug": "Capacity Planner — Ops Team Sizing with Erlang-C Queueing Theory" }, "description": "Size ops capacity for teams that handle queued work (Support, CX, CS, BizOps, IT ops, Finance ops). Erlang-C queueing math, P90 demand sizing, shrinkage-adjusted FTE, manager-trigger thresholds, and quarterly hiring sequence with ramp + attrition. Produces capacity sizing at multiple utilization levels, per-member utilization health, and a 12-month hiring plan.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:code-complexity-scanner", "kind": "leaf", "title": "Code Complexity Scanner", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/code-complexity-scanner/SKILL.md", "slug": "Code Complexity Scanner" }, "description": "Measure cyclomatic complexity, cognitive complexity, and function length across codebases to identify maintenance hotspots. Use when analyzing code quality, finding complex functions, or prioritizing refactoring targets.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "low", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:code-review", "kind": "leaf", "title": "Code Review", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/code-review/SKILL.md", "slug": "Code Review" }, "description": "Pre-landing PR review analyzing diff for structural issues, security concerns, and correctness. Use when asked to \"review this PR\", \"code review\", \"check my diff\", or before merging any pull request.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:code-review-excellence", "kind": "leaf", "title": "Code Review Excellence", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/code-review-excellence/SKILL.md", "slug": "Code Review Excellence" }, "description": "Master effective code review practices to provide constructive feedback, catch bugs early, and foster knowledge sharing while maintaining team morale. Use when reviewing pull requests, establishing review standards, or mentoring developers.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:codebase-design", "kind": "leaf", "title": "Codebase Design — Deep Modules", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/codebase-design/SKILL.md", "slug": "codebase-design" }, "description": "Design **deep modules**: a lot of behaviour behind a small interface, placed at a clean seam, testable through that interface. Use this language and these principles wherever code is being designed or restructured.", "trust": { "lifecycle_status": "reviewed", "install_recommendation": "conditional", "risk_level": "low", "classification_status": "complete", "catalog_decision": true } }, { "id": "leaf:dist:complexity-cuts", "kind": "leaf", "title": "complexity-cuts — Lower Big-O on Existing Code", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/complexity-cuts/SKILL.md", "slug": "complexity-cuts" }, "description": "Lower time/space complexity on existing code via a one-transformation-at-a-time playbook with verify-revert-stop.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:conducting-api-security-testing", "kind": "leaf", "title": "Conducting API Security Testing", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/conducting-api-security-testing/SKILL.md", "slug": "Conducting API Security Testing" }, "description": "Conducts security testing of REST, GraphQL, and gRPC APIs to identify", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:configuring-active-directory-tiered-model", "kind": "leaf", "title": "Configuring Active Directory Tiered Model", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/configuring-active-directory-tiered-model/SKILL.md", "slug": "Configuring Active Directory Tiered Model" }, "description": "Implement Microsoft's Enhanced Security Admin Environment (ESAE) tiered", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:cso", "kind": "leaf", "title": "cso", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/cso/SKILL.md", "slug": "cso" }, "description": "Chief Security Officer mode. (gstack)", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:database-lookup", "kind": "leaf", "title": "Database Lookup", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/database-lookup/SKILL.md", "slug": "Database Lookup" }, "description": "Deterministically query 78+ public scientific, biomedical, materials science, regulatory, finance, and demographics databases through documented REST APIs. Use for reproducible lookups of compounds, genes, proteins, pathways, variants, clinical trials, patents, economic indicators, and database-backed scientific facts when endpoints, filters, pagination, and provenance need to be explicit.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:defending-llms-with-guardrails", "kind": "leaf", "title": "Defending LLMs with Guardrails", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/defending-llms-with-guardrails/SKILL.md", "slug": "Defending LLMs with Guardrails" }, "description": "Deploy Llama Guard, NeMo Guardrails, and LLM Guard input/output scanners as runtime defenses.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:deploying-tailscale-for-zero-trust-vpn", "kind": "leaf", "title": "Deploying Tailscale for Zero Trust VPN", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/deploying-tailscale-for-zero-trust-vpn/SKILL.md", "slug": "Deploying Tailscale for Zero Trust VPN" }, "description": "Deploy and configure Tailscale as a WireGuard-based zero trust mesh VPN", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:detecting-api-enumeration-attacks", "kind": "leaf", "title": "Detecting API Enumeration Attacks", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-api-enumeration-attacks/SKILL.md", "slug": "Detecting API Enumeration Attacks" }, "description": "Detect and prevent API enumeration attacks including BOLA and IDOR exploitation", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:detecting-aws-credential-exposure-with-trufflehog", "kind": "leaf", "title": "Detecting AWS Credential Exposure with TruffleHog", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-aws-credential-exposure-with-trufflehog/SKILL.md", "slug": "Detecting AWS Credential Exposure with TruffleHog" }, "description": "Detecting exposed AWS credentials in source code repositories, CI/CD", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:detecting-broken-object-property-level-authorization", "kind": "leaf", "title": "Detecting Broken Object Property Level Authorization", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-broken-object-property-level-authorization/SKILL.md", "slug": "Detecting Broken Object Property Level Authorization" }, "description": "Detect and test for OWASP API3:2023 Broken Object Property Level Authorization", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:detecting-container-escape-attempts", "kind": "leaf", "title": "Detecting Container Escape Attempts", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-container-escape-attempts/SKILL.md", "slug": "Detecting Container Escape Attempts" }, "description": "Container escape is a critical attack technique where an adversary breaks", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:detecting-container-escape-with-falco-rules", "kind": "leaf", "title": "Detecting Container Escape with Falco Rules", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-container-escape-with-falco-rules/SKILL.md", "slug": "Detecting Container Escape with Falco Rules" }, "description": "Detect container escape attempts in real-time using Falco runtime security", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:detecting-shadow-api-endpoints", "kind": "leaf", "title": "Detecting Shadow API Endpoints", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-shadow-api-endpoints/SKILL.md", "slug": "Detecting Shadow API Endpoints" }, "description": "Discover and inventory shadow API endpoints that operate outside documented", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:detecting-supply-chain-attacks-in-ci-cd", "kind": "leaf", "title": "Detecting Supply Chain Attacks in CI/CD", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-supply-chain-attacks-in-ci-cd/SKILL.md", "slug": "Detecting Supply Chain Attacks in CI/CD" }, "description": "Scans GitHub Actions workflows and CI/CD pipeline configurations for", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:detecting-typosquatting-packages", "kind": "leaf", "title": "Detecting Typosquatting Packages", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-typosquatting-packages/SKILL.md", "slug": "Detecting Typosquatting Packages" }, "description": "Flag misspelled, brandjacked, and typosquatted package names across npm, PyPI, and crates.io before installation using edit-distance, keyboard-proximity, and known-target corpus matching with typomania, OSSGadget, and pypi-scan.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:diagnosing-bugs", "kind": "leaf", "title": "Diagnosing Bugs", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/diagnosing-bugs/SKILL.md", "slug": "Diagnosing Bugs" }, "description": "Systematic diagnosis loop for hard bugs and performance regressions. Use when the user says \"diagnose\"/\"debug this\", or reports something broken/throwing/failing/slow. Covers feedback-loop construction, bisection, differential testing, and instrumentation with browser, trace, fuzz, and human-in-the-loop surfaces review-gated.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:diagram", "kind": "leaf", "title": "diagram", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/diagram/SKILL.md", "slug": "diagram" }, "description": "on excalidraw.com, and rendered SVG + PNG (clean mermaid style; the .excalidraw carries the hand-drawn aesthetic). Fully offline. Use when asked to \"make a diagram\", \"draw the architecture\", \"create a flowchart\", \"diagram this\", or \"visualize this flow\".", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:docker-development", "kind": "leaf", "title": "Docker Development", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/docker-development/SKILL.md", "slug": "docker-development" }, "description": "Smaller images. Faster builds. Secure containers. No guesswork.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:escaping-containers-to-host", "kind": "leaf", "title": "Escaping Containers to Host", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/escaping-containers-to-host/SKILL.md", "slug": "Escaping Containers to Host" }, "description": "Exploit privileged pods, host mounts, runC CVEs, and exposed Docker sockets to break out of a container and reach the underlying host during authorized container-security assessments.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:exploiting-api-injection-vulnerabilities", "kind": "leaf", "title": "Exploiting API Injection Vulnerabilities", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/exploiting-api-injection-vulnerabilities/SKILL.md", "slug": "Exploiting API Injection Vulnerabilities" }, "description": "Tests APIs for injection vulnerabilities including SQL injection, NoSQL", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:exploiting-excessive-data-exposure-in-api", "kind": "leaf", "title": "Exploiting Excessive Data Exposure in API", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/exploiting-excessive-data-exposure-in-api/SKILL.md", "slug": "Exploiting Excessive Data Exposure in API" }, "description": "Tests APIs for excessive data exposure where endpoints return more data", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:exploiting-mass-assignment-in-rest-apis", "kind": "leaf", "title": "Exploiting Mass Assignment in REST APIs", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/exploiting-mass-assignment-in-rest-apis/SKILL.md", "slug": "Exploiting Mass Assignment in REST APIs" }, "description": "Discover and exploit mass assignment vulnerabilities in REST APIs to", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:exploiting-prototype-pollution-in-javascript", "kind": "leaf", "title": "Exploiting Prototype Pollution in JavaScript", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/exploiting-prototype-pollution-in-javascript/SKILL.md", "slug": "Exploiting Prototype Pollution in JavaScript" }, "description": "Detect and exploit JavaScript prototype pollution vulnerabilities on", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:exploiting-sql-injection-with-sqlmap", "kind": "leaf", "title": "Exploiting SQL Injection with sqlmap", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/exploiting-sql-injection-with-sqlmap/SKILL.md", "slug": "Exploiting SQL Injection with sqlmap" }, "description": "Detecting and exploiting SQL injection vulnerabilities using sqlmap to", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:exploiting-websocket-vulnerabilities", "kind": "leaf", "title": "Exploiting WebSocket Vulnerabilities", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/exploiting-websocket-vulnerabilities/SKILL.md", "slug": "Exploiting WebSocket Vulnerabilities" }, "description": "Testing WebSocket implementations for authentication bypass, cross-site", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:freeze", "kind": "leaf", "title": "freeze", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/freeze/SKILL.md", "slug": "freeze" }, "description": "Restrict file edits to a specific directory for the session. (gstack)", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:get-available-resources", "kind": "leaf", "title": "Get Available Resources", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/get-available-resources/SKILL.md", "slug": "Get Available Resources" }, "description": "Detect available computational resources (CPU cores, GPUs, memory, disk space) at the start of any computationally intensive task. Generates a resource report with strategic recommendations for parallel processing, memory management, GPU acceleration, and large-data handling. Use proactively before data analysis, model training, or large-scale processing.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:git-guardrails-claude-code", "kind": "leaf", "title": "Setup Git Guardrails", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/git-guardrails-claude-code/SKILL.md", "slug": "git-guardrails-claude-code" }, "description": "Set up Claude Code hooks to block dangerous git commands (push, reset --hard, clean, branch -D, etc.) before they execute. Use when user wants to prevent destructive git operations, add git safety hooks, or block git push/reset in Claude Code.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:gstack-openclaw-ceo-review", "kind": "leaf", "title": "CEO Plan Review", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/gstack-openclaw-ceo-review/SKILL.md", "slug": "gstack-openclaw-ceo-review" }, "description": "Use when asked to review a plan, challenge a proposal, run a CEO review, poke holes in an approach, think bigger about scope, or decide whether to expand or reduce the plan.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:gstack-openclaw-investigate", "kind": "leaf", "title": "Systematic Debugging", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/gstack-openclaw-investigate/SKILL.md", "slug": "gstack-openclaw-investigate" }, "description": "Use when asked to debug, fix a bug, investigate an error, or do root cause analysis, and when users report errors, stack traces, unexpected behavior, or say something stopped working.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:gstack-openclaw-retro", "kind": "leaf", "title": "Weekly Engineering Retrospective", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/gstack-openclaw-retro/SKILL.md", "slug": "gstack-openclaw-retro" }, "description": "Weekly engineering retrospective. Analyzes commit history, work patterns, and code quality metrics with persistent history and trend tracking. Team-aware with per-person contributions, praise, and growth areas. Use when asked for weekly retro, what shipped this week, or engineering retrospective.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:guard", "kind": "leaf", "title": "guard", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/guard/SKILL.md", "slug": "guard" }, "description": "Combines /careful (warns before rm -rf, DROP TABLE, force-push, etc.) with /freeze (blocks edits outside a specified directory). Use for maximum safety when touching prod or debugging live systems. Use when asked to \"guard mode\",", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "low", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:hardening-docker-containers-for-production", "kind": "leaf", "title": "Hardening Docker Containers for Production", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/hardening-docker-containers-for-production/SKILL.md", "slug": "Hardening Docker Containers for Production" }, "description": "Hardening Docker containers for production involves applying security", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:hunting-for-t1098-account-manipulation", "kind": "leaf", "title": "Hunting for T1098 Account Manipulation", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/hunting-for-t1098-account-manipulation/SKILL.md", "slug": "Hunting for T1098 Account Manipulation" }, "description": "Hunt for MITRE ATT&CK T1098 account manipulation including shadow admin", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:hunting-for-unusual-service-installations", "kind": "leaf", "title": "Hunting for Unusual Service Installations", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/hunting-for-unusual-service-installations/SKILL.md", "slug": "Hunting for Unusual Service Installations" }, "description": "Detect suspicious Windows service installations (MITRE ATT&CK T1543.003)", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-api-abuse-detection-with-rate-limiting", "kind": "leaf", "title": "Implementing API Abuse Detection with Rate Limiting", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-api-abuse-detection-with-rate-limiting/SKILL.md", "slug": "Implementing API Abuse Detection with Rate Limiting" }, "description": "Implement API abuse detection using token bucket, sliding window, and", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-api-gateway-security-controls", "kind": "leaf", "title": "Implementing API Gateway Security Controls", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-api-gateway-security-controls/SKILL.md", "slug": "Implementing API Gateway Security Controls" }, "description": "Implements security controls at the API gateway layer including authentication", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-api-rate-limiting-and-throttling", "kind": "leaf", "title": "Implementing API Rate Limiting and Throttling", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-api-rate-limiting-and-throttling/SKILL.md", "slug": "Implementing API Rate Limiting and Throttling" }, "description": "Implements API rate limiting and throttling controls using token bucket,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-api-schema-validation-security", "kind": "leaf", "title": "Implementing API Schema Validation Security", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-api-schema-validation-security/SKILL.md", "slug": "Implementing API Schema Validation Security" }, "description": "Implement API schema validation using OpenAPI specifications and JSON", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-api-security-posture-management", "kind": "leaf", "title": "Implementing API Security Posture Management", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-api-security-posture-management/SKILL.md", "slug": "Implementing API Security Posture Management" }, "description": "Implement API Security Posture Management to continuously discover, classify,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-api-security-testing-with-42crunch", "kind": "leaf", "title": "Implementing API Security Testing with 42Crunch", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-api-security-testing-with-42crunch/SKILL.md", "slug": "Implementing API Security Testing with 42Crunch" }, "description": "Implement comprehensive API security testing using the 42Crunch platform", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-aqua-security-for-container-scanning", "kind": "leaf", "title": "Implementing Aqua Security for Container Scanning", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-aqua-security-for-container-scanning/SKILL.md", "slug": "Implementing Aqua Security for Container Scanning" }, "description": "Deploy Aqua Security's Trivy scanner to detect vulnerabilities, misconfigurations,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-attack-surface-management", "kind": "leaf", "title": "Implementing Attack Surface Management", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-attack-surface-management/SKILL.md", "slug": "Implementing Attack Surface Management" }, "description": "Implements external attack surface management (EASM) using Shodan, Censys,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-code-signing-for-artifacts", "kind": "leaf", "title": "Implementing Code Signing for Artifacts", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-code-signing-for-artifacts/SKILL.md", "slug": "Implementing Code Signing for Artifacts" }, "description": "This skill covers implementing code signing for build artifacts to ensure", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-deception-based-detection-with-canarytoken", "kind": "leaf", "title": "Implementing Deception-Based Detection with Canarytoken", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-deception-based-detection-with-canarytoken/SKILL.md", "slug": "Implementing Deception-Based Detection with Canarytoken" }, "description": "Deploy and monitor Canary Tokens via the Thinkst Canary API for deception-based", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-fuzz-testing-in-cicd-with-aflplusplus", "kind": "leaf", "title": "Implementing Fuzz Testing in CI/CD with AFL++", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-fuzz-testing-in-cicd-with-aflplusplus/SKILL.md", "slug": "Implementing Fuzz Testing in CI/CD with AFL++" }, "description": "Integrate AFL++ coverage-guided fuzz testing into CI/CD pipelines to", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-gcp-binary-authorization", "kind": "leaf", "title": "Implementing GCP Binary Authorization", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-gcp-binary-authorization/SKILL.md", "slug": "Implementing GCP Binary Authorization" }, "description": "Implement GCP Binary Authorization to enforce deploy-time security controls", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-github-advanced-security-for-code-scanning", "kind": "leaf", "title": "Implementing GitHub Advanced Security for Code Scanning", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-github-advanced-security-for-code-scanning/SKILL.md", "slug": "Implementing GitHub Advanced Security for Code Scanning" }, "description": "Configure GitHub Advanced Security with CodeQL to perform automated static", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-hashicorp-vault-dynamic-secrets", "kind": "leaf", "title": "Implementing HashiCorp Vault Dynamic Secrets", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-hashicorp-vault-dynamic-secrets/SKILL.md", "slug": "Implementing HashiCorp Vault Dynamic Secrets" }, "description": "Implements HashiCorp Vault dynamic secrets engines for database credentials,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-honeytokens-for-breach-detection", "kind": "leaf", "title": "Implementing Honeytokens for Breach Detection", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-honeytokens-for-breach-detection/SKILL.md", "slug": "Implementing Honeytokens for Breach Detection" }, "description": "Deploys canary tokens and honeytokens (fake AWS credentials, DNS canaries,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-infrastructure-as-code-security-scanning", "kind": "leaf", "title": "Implementing Infrastructure as Code Security Scanning", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-infrastructure-as-code-security-scanning/SKILL.md", "slug": "Implementing Infrastructure as Code Security Scanning" }, "description": "This skill covers implementing automated security scanning for Infrastructure", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-kubernetes-network-policy-with-calico", "kind": "leaf", "title": "Implementing Kubernetes Network Policy with Calico", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-kubernetes-network-policy-with-calico/SKILL.md", "slug": "Implementing Kubernetes Network Policy with Calico" }, "description": "Implement Kubernetes network segmentation using Calico NetworkPolicy", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-kubernetes-pod-security-standards", "kind": "leaf", "title": "Implementing Kubernetes Pod Security Standards", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-kubernetes-pod-security-standards/SKILL.md", "slug": "Implementing Kubernetes Pod Security Standards" }, "description": "Pod Security Standards (PSS) define three levels of security policies", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-log-forwarding-with-fluentd", "kind": "leaf", "title": "Implementing Log Forwarding with Fluentd", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-log-forwarding-with-fluentd/SKILL.md", "slug": "Implementing Log Forwarding with Fluentd" }, "description": "Configure Fluentd and Fluent Bit for centralized log aggregation, routing,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-mobile-application-management", "kind": "leaf", "title": "Implementing Mobile Application Management", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-mobile-application-management/SKILL.md", "slug": "Implementing Mobile Application Management" }, "description": "Implements Mobile Application Management (MAM) policies to protect enterprise", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-opa-gatekeeper-for-policy-enforcement", "kind": "leaf", "title": "Implementing OPA Gatekeeper for Policy Enforcement", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-opa-gatekeeper-for-policy-enforcement/SKILL.md", "slug": "Implementing OPA Gatekeeper for Policy Enforcement" }, "description": "Enforce Kubernetes admission policies using OPA Gatekeeper with ConstraintTemplates,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-pam-for-database-access", "kind": "leaf", "title": "Implementing PAM for Database Access", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-pam-for-database-access/SKILL.md", "slug": "Implementing PAM for Database Access" }, "description": "Deploy privileged access management for database systems including Oracle,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-pod-security-admission-controller", "kind": "leaf", "title": "Implementing Pod Security Admission Controller", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-pod-security-admission-controller/SKILL.md", "slug": "Implementing Pod Security Admission Controller" }, "description": "Implement Kubernetes Pod Security Admission to enforce baseline and restricted", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-secret-scanning-with-gitleaks", "kind": "leaf", "title": "Implementing Secret Scanning with Gitleaks", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-secret-scanning-with-gitleaks/SKILL.md", "slug": "Implementing Secret Scanning with Gitleaks" }, "description": "This skill covers implementing Gitleaks for detecting and preventing", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-secrets-management-with-vault", "kind": "leaf", "title": "Implementing Secrets Management with Vault", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-secrets-management-with-vault/SKILL.md", "slug": "Implementing Secrets Management with Vault" }, "description": "This skill covers deploying HashiCorp Vault for centralized secrets", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-secrets-scanning-in-ci-cd", "kind": "leaf", "title": "Implementing Secrets Scanning in CI/CD", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-secrets-scanning-in-ci-cd/SKILL.md", "slug": "Implementing Secrets Scanning in CI/CD" }, "description": "Integrate gitleaks and trufflehog into CI/CD pipelines to detect leaked", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-supply-chain-security-with-in-toto", "kind": "leaf", "title": "Implementing Supply Chain Security with in-toto", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-supply-chain-security-with-in-toto/SKILL.md", "slug": "Implementing Supply Chain Security with in-toto" }, "description": "Implement software supply chain integrity verification for container", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-vulnerability-sla-breach-alerting", "kind": "leaf", "title": "Implementing Vulnerability SLA Breach Alerting", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-vulnerability-sla-breach-alerting/SKILL.md", "slug": "Implementing Vulnerability SLA Breach Alerting" }, "description": "Build automated alerting for vulnerability remediation SLA breaches with", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-web-application-logging-with-modsecurity", "kind": "leaf", "title": "Implementing Web Application Logging with ModSecurity", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-web-application-logging-with-modsecurity/SKILL.md", "slug": "Implementing Web Application Logging with ModSecurity" }, "description": "Configure ModSecurity WAF with OWASP Core Rule Set (CRS) for web application", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-zero-trust-for-saas-applications", "kind": "leaf", "title": "Implementing Zero Trust for SaaS Applications", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-zero-trust-for-saas-applications/SKILL.md", "slug": "Implementing Zero Trust for SaaS Applications" }, "description": "Implementing zero trust access controls for SaaS applications using", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:integrating-sast-into-github-actions-pipeline", "kind": "leaf", "title": "Integrating SAST into GitHub Actions Pipeline", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/integrating-sast-into-github-actions-pipeline/SKILL.md", "slug": "Integrating SAST into GitHub Actions Pipeline" }, "description": "This skill covers integrating Static Application Security Testing (SAST)", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:invariant-guard", "kind": "leaf", "title": "Invariant-Guard — Correctness-First Coding", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/invariant-guard/SKILL.md", "slug": "invariant-guard" }, "description": "The model knows what a loop invariant is. It knows recursion needs a base case. It knows about empty lists, integer overflow, and the difference between `<` and `≤`. It just does not write these down before producing code — so it ships subtle correctness bugs that tests do not catch.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:land-and-deploy", "kind": "leaf", "title": "land-and-deploy", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/land-and-deploy/SKILL.md", "slug": "land-and-deploy" }, "description": "Land and deploy workflow. (gstack)", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:migrate-to-shoehorn", "kind": "leaf", "title": "Migrate to Shoehorn", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/migrate-to-shoehorn/SKILL.md", "slug": "migrate-to-shoehorn" }, "description": "Migrate test files from `as` type assertions to @total-typescript/shoehorn. Use when user mentions shoehorn, wants to replace `as` in tests, or needs partial test data.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:monorepo-navigator", "kind": "leaf", "title": "Monorepo Navigator", "browse_default": true, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/monorepo-navigator/SKILL.md", "slug": "monorepo-navigator" }, "description": "Navigate, manage, and optimize monorepos. Covers Turborepo, Nx, pnpm workspaces, and Lerna. Cross-package impact analysis, selective builds/tests on affected packages, remote caching, dependency graph visualization, and structured multi-repo to monorepo migrations. Use when setting up a new monorepo, optimizing CI for a large workspace, debugging cross-package dependency issues, or planning a multi-repo consolidation.", "trust": { "lifecycle_status": "reviewed", "install_recommendation": "conditional", "risk_level": "high", "classification_status": "unclassified", "catalog_decision": true } }, { "id": "leaf:dist:netlify-deploy", "kind": "leaf", "title": "Netlify Deployment", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/netlify-deploy/SKILL.md", "slug": "netlify-deploy" }, "description": "Deploy web projects to Netlify using the Netlify CLI. Use when the user asks to deploy, host, publish, or link a site/repo on Netlify, including preview and production deploys. Complements existing vercel-deploy and cloudflare-deploy skills.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:observability-designer", "kind": "leaf", "title": "Observability Designer — Production Observability Strategy", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/observability-designer/SKILL.md", "slug": "Observability Designer — Production Observability Strategy" }, "description": "Design production-ready observability strategies combining metrics, logs, and traces. SLI/SLO design, golden-signals monitoring, alert optimization, dashboard generation. Use when adding observability to a new service, refactoring noisy alerting, or designing an SLO program before scaling production load. Complements slo-architect (which handles error-budget math).", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:obsidian-vault", "kind": "leaf", "title": "Obsidian Vault", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/obsidian-vault/SKILL.md", "slug": "obsidian-vault" }, "description": "Search, create, and manage notes in the Obsidian vault with wikilinks and index notes. Use when user wants to find, create, or organize notes in Obsidian.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:okf-knowledge-format", "kind": "leaf", "title": "OKF Knowledge Format", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/okf-knowledge-format/SKILL.md", "slug": "OKF Knowledge Format" }, "description": "Reference for OKF-compatible YAML frontmatter, source status values, risk levels, preferred types, and repository fields. Use when creating new OKF-compatible entries or reviewing existing ones.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:openclaw-skills-framework", "kind": "leaf", "title": "OpenClaw Skills Framework", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/openclaw-skills-framework/SKILL.md", "slug": "openclaw-skills-framework" }, "description": "OpenClaw skill system architecture — SKILL.md format, loading order, workshop, and gating.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performance-engineer", "kind": "leaf", "title": "Performance Engineer", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performance-engineer/SKILL.md", "slug": "performance-engineer" }, "description": "1. **Establish Baseline**: Measure current performance with real user monitoring 2. **Identify Bottlenecks**: Use profiling, distributed tracing, and load testing 3. **Prioritize Optimizations**: Based on user impact, business value, and effort", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-android-app-static-analysis-with-mobsf", "kind": "leaf", "title": "Performing Android App Static Analysis with MobSF", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-android-app-static-analysis-with-mobsf/SKILL.md", "slug": "Performing Android App Static Analysis with MobSF" }, "description": "Performs automated static analysis of Android applications using Mobile", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-api-fuzzing-with-restler", "kind": "leaf", "title": "Performing API Fuzzing with RESTler", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-api-fuzzing-with-restler/SKILL.md", "slug": "Performing API Fuzzing with RESTler" }, "description": "Uses Microsoft RESTler to perform stateful REST API fuzzing by automatically", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-api-inventory-and-discovery", "kind": "leaf", "title": "Performing API Inventory and Discovery", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-api-inventory-and-discovery/SKILL.md", "slug": "Performing API Inventory and Discovery" }, "description": "Performs API inventory and discovery to identify all API endpoints in", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-api-security-testing-with-postman", "kind": "leaf", "title": "Performing API Security Testing with Postman", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-api-security-testing-with-postman/SKILL.md", "slug": "Performing API Security Testing with Postman" }, "description": "Uses Postman to perform structured API security testing by building", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-arp-spoofing-attack-simulation", "kind": "leaf", "title": "Performing ARP Spoofing Attack Simulation", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-arp-spoofing-attack-simulation/SKILL.md", "slug": "Performing ARP Spoofing Attack Simulation" }, "description": "Simulates ARP spoofing attacks in authorized lab or pentest environments", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-binary-exploitation-analysis", "kind": "leaf", "title": "Performing Binary Exploitation Analysis", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-binary-exploitation-analysis/SKILL.md", "slug": "Performing Binary Exploitation Analysis" }, "description": "Analyze binary exploitation techniques including buffer overflows and", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-bluetooth-security-assessment", "kind": "leaf", "title": "Performing Bluetooth Security Assessment", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-bluetooth-security-assessment/SKILL.md", "slug": "Performing Bluetooth Security Assessment" }, "description": "Assess Bluetooth Low Energy device security by scanning, enumerating", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-container-escape-detection", "kind": "leaf", "title": "Performing Container Escape Detection", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-container-escape-detection/SKILL.md", "slug": "Performing Container Escape Detection" }, "description": "Detects container escape attempts by analyzing namespace configurations,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-container-image-hardening", "kind": "leaf", "title": "Performing Container Image Hardening", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-container-image-hardening/SKILL.md", "slug": "Performing Container Image Hardening" }, "description": "This skill covers hardening container images by minimizing attack surface,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-docker-bench-security-assessment", "kind": "leaf", "title": "Performing Docker Bench Security Assessment", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-docker-bench-security-assessment/SKILL.md", "slug": "Performing Docker Bench Security Assessment" }, "description": "Docker Bench for Security is an open-source script that checks dozens", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-fuzzing-with-aflplusplus", "kind": "leaf", "title": "Performing Fuzzing with AFL++", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-fuzzing-with-aflplusplus/SKILL.md", "slug": "Performing Fuzzing with AFL++" }, "description": "Perform coverage-guided fuzzing of compiled binaries using AFL++ (American", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-graphql-depth-limit-attack", "kind": "leaf", "title": "Performing GraphQL Depth Limit Attack", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-graphql-depth-limit-attack/SKILL.md", "slug": "Performing GraphQL Depth Limit Attack" }, "description": "Execute and test GraphQL depth limit attacks using deeply nested recursive", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-graphql-introspection-attack", "kind": "leaf", "title": "Performing GraphQL Introspection Attack", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-graphql-introspection-attack/SKILL.md", "slug": "Performing GraphQL Introspection Attack" }, "description": "Performs GraphQL introspection attacks to extract the full API schema", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-osint-with-spiderfoot", "kind": "leaf", "title": "Performing OSINT with SpiderFoot", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-osint-with-spiderfoot/SKILL.md", "slug": "Performing OSINT with SpiderFoot" }, "description": "Automate OSINT collection using SpiderFoot REST API and CLI for target", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-sca-dependency-scanning-with-snyk", "kind": "leaf", "title": "Performing SCA Dependency Scanning with Snyk", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-sca-dependency-scanning-with-snyk/SKILL.md", "slug": "Performing SCA Dependency Scanning with Snyk" }, "description": "This skill covers implementing Software Composition Analysis (SCA) using", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-scada-hmi-security-assessment", "kind": "leaf", "title": "Performing SCADA HMI Security Assessment", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-scada-hmi-security-assessment/SKILL.md", "slug": "Performing SCADA HMI Security Assessment" }, "description": "Perform security assessments of SCADA Human-Machine Interface (HMI)", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-serverless-function-security-review", "kind": "leaf", "title": "Performing Serverless Function Security Review", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-serverless-function-security-review/SKILL.md", "slug": "Performing Serverless Function Security Review" }, "description": "Performing security reviews of serverless functions across AWS Lambda,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-service-account-audit", "kind": "leaf", "title": "Performing Service Account Audit", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-service-account-audit/SKILL.md", "slug": "Performing Service Account Audit" }, "description": "Audit service accounts across enterprise infrastructure to identify orphaned,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-service-account-credential-rotation", "kind": "leaf", "title": "Performing Service Account Credential Rotation", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-service-account-credential-rotation/SKILL.md", "slug": "Performing Service Account Credential Rotation" }, "description": "Automate credential rotation for service accounts across Active Directory,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-subdomain-enumeration-with-subfinder", "kind": "leaf", "title": "Performing Subdomain Enumeration with Subfinder", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-subdomain-enumeration-with-subfinder/SKILL.md", "slug": "Performing Subdomain Enumeration with Subfinder" }, "description": "Enumerate subdomains of target domains using ProjectDiscovery's Subfinder", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-supply-chain-attack-simulation", "kind": "leaf", "title": "Performing Supply Chain Attack Simulation", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-supply-chain-attack-simulation/SKILL.md", "slug": "Performing Supply Chain Attack Simulation" }, "description": "Simulate and detect software supply chain attacks including typosquatting", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-thick-client-application-penetration-test", "kind": "leaf", "title": "Performing Thick Client Application Penetration Test", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-thick-client-application-penetration-test/SKILL.md", "slug": "Performing Thick Client Application Penetration Test" }, "description": "Conduct a thick client application penetration test to identify insecure", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:ponytail", "kind": "leaf", "title": "Ponytail — Lazy Senior Dev Mode", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/ponytail/SKILL.md", "slug": "Ponytail — Lazy Senior Dev Mode" }, "description": "Lazy senior dev mode. Forces the simplest, shortest solution that works: YAGNI, stdlib first, no unrequested abstractions. Active every response until stopped.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:ponytail-debt", "kind": "leaf", "title": "Ponytail Debt — Shortcut Ledger", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/ponytail-debt/SKILL.md", "slug": "Ponytail Debt — Shortcut Ledger" }, "description": "Harvest every ponytail: shortcut comment into one debt ledger, so deferrals get tracked instead of forgotten. One-shot report.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:prompt-governance", "kind": "leaf", "title": "Prompt Governance", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/prompt-governance/SKILL.md", "slug": "prompt-governance" }, "description": "Treat prompts as first-class infrastructure — versioned, tested, evaluated, and deployed with the same rigor as application code. Prevent quality regressions, enable safe iteration, and give teams confidence that prompt changes will not break production.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:python-background-jobs", "kind": "leaf", "title": "Python Background Jobs & Task Queues", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/python-background-jobs/SKILL.md", "slug": "python-background-jobs" }, "description": "Implement background job processing and task queues in Python. Use when building async task processing, job queues, long-running operations, event-driven architectures, or decoupling work from request/response cycles. Covers Celery, RQ, Dramatiq, idempotency, DLQ, and job state management.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:python-debugpy", "kind": "leaf", "title": "python-debugpy", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/python-debugpy/SKILL.md", "slug": "python-debugpy" }, "description": "Three tools, picked by situation:", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:qa", "kind": "leaf", "title": "qa", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/qa/SKILL.md", "slug": "qa" }, "description": "Systematically QA test a web application and fix bugs found. (gstack)", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:qa-only", "kind": "leaf", "title": "qa-only", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/qa-only/SKILL.md", "slug": "qa-only" }, "description": "Report-only QA testing. (gstack)", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:render-deploy", "kind": "leaf", "title": "Deploy to Render", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/render-deploy/SKILL.md", "slug": "render-deploy" }, "description": "Deploy applications to Render using Git-backed Blueprints (render.yaml). Use when the user wants to deploy, host, publish, or set up their application on Render's cloud platform. Complements existing vercel-deploy, cloudflare-deploy, and netlify-deploy skills.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:runaway-guard", "kind": "leaf", "title": "Runaway Guard — $-Cost is the Third Complexity Dimension", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/runaway-guard/SKILL.md", "slug": "runaway-guard" }, "description": "Every loop has time complexity and space complexity. A loop that calls a paid API has a third: **dollars per execution**. The model tracks the first two automatically. It does not track the third, so it ships code where a single bug — a retry without bound, a stream reconnect storm, an agent that re-queues itself, a webhook that fires the same job twice — silently spends real money.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:scanning-container-images-with-grype", "kind": "leaf", "title": "Scanning Container Images with Grype", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/scanning-container-images-with-grype/SKILL.md", "slug": "Scanning Container Images with Grype" }, "description": "Scan container images for known vulnerabilities using Anchore Grype with", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:scanning-kubernetes-manifests-with-kubesec", "kind": "leaf", "title": "Scanning Kubernetes Manifests with Kubesec", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/scanning-kubernetes-manifests-with-kubesec/SKILL.md", "slug": "Scanning Kubernetes Manifests with Kubesec" }, "description": "Perform security risk analysis on Kubernetes resource manifests using", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:securing-api-gateway-with-aws-waf", "kind": "leaf", "title": "Securing API Gateway with AWS WAF", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/securing-api-gateway-with-aws-waf/SKILL.md", "slug": "Securing API Gateway with AWS WAF" }, "description": "Securing API Gateway endpoints with AWS WAF by configuring managed rule", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:securing-container-registry-images", "kind": "leaf", "title": "Securing Container Registry Images", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/securing-container-registry-images/SKILL.md", "slug": "Securing Container Registry Images" }, "description": "Securing container registry images by implementing vulnerability scanning", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:securing-container-registry-with-harbor", "kind": "leaf", "title": "Securing Container Registry with Harbor", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/securing-container-registry-with-harbor/SKILL.md", "slug": "Securing Container Registry with Harbor" }, "description": "Harbor is an open-source container registry that provides security features", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:securing-github-actions-workflows", "kind": "leaf", "title": "Securing GitHub Actions Workflows", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/securing-github-actions-workflows/SKILL.md", "slug": "Securing GitHub Actions Workflows" }, "description": "This skill covers hardening GitHub Actions workflows against supply", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:securing-helm-chart-deployments", "kind": "leaf", "title": "Securing Helm Chart Deployments", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/securing-helm-chart-deployments/SKILL.md", "slug": "Securing Helm Chart Deployments" }, "description": "Secure Helm chart deployments by validating chart integrity, scanning", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:securing-serverless-functions", "kind": "leaf", "title": "Securing Serverless Functions", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/securing-serverless-functions/SKILL.md", "slug": "Securing Serverless Functions" }, "description": "This skill covers security hardening for serverless compute platforms", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:setup-deploy", "kind": "leaf", "title": "setup-deploy", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/setup-deploy/SKILL.md", "slug": "setup-deploy" }, "description": "Configure deployment settings for /land-and-deploy.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:setup-gbrain", "kind": "leaf", "title": "setup-gbrain", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/setup-gbrain/SKILL.md", "slug": "setup-gbrain" }, "description": "One command from zero to \"gbrain is running, and this agent can call it.\" Use when: \"setup gbrain\", \"connect gbrain\", \"start gbrain\", \"install gbrain\", \"configure gbrain for this machine\".", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:setup-pre-commit", "kind": "leaf", "title": "Setup Pre-Commit Hooks", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/setup-pre-commit/SKILL.md", "slug": "setup-pre-commit" }, "description": "Set up Husky pre-commit hooks with lint-staged (Prettier), type checking, and tests in the current repo. Use when user wants to add pre-commit hooks, set up Husky, configure lint-staged, or add commit-time formatting/typechecking/testing.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:ship", "kind": "leaf", "title": "ship", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/ship/SKILL.md", "slug": "ship" }, "description": "Use when asked to \"ship\", \"deploy\", \"push to main\", \"create a PR\", \"merge and push\", or \"get it deployed\". Proactively invoke this skill (do NOT push/PR directly) when the user says code is ready, asks about deploying, wants to push code up, or asks to create a PR.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:skill-lifecycle-states", "kind": "leaf", "title": "Skill Lifecycle States", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/skill-lifecycle-states/SKILL.md", "slug": "skill-lifecycle-states" }, "description": "Canonical skill lifecycle states (S0–S7) for tracking skill maturity from raw experience to archived. Use when designing skill registries, ingestion pipelines, or governance workflows that need explicit state transitions.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:source-discovery-triage", "kind": "leaf", "title": "Source Discovery and Triage", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/source-discovery-triage/SKILL.md", "slug": "Source Discovery and Triage" }, "description": "Find, evaluate, and normalize newly published agent skill sets, loop repositories, and knowledge bundles. Use when scanning for new public agent knowledge to catalog.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:testing-api-for-broken-object-level-authorization", "kind": "leaf", "title": "Testing API for Broken Object Level Authorization", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/testing-api-for-broken-object-level-authorization/SKILL.md", "slug": "Testing API for Broken Object Level Authorization" }, "description": "Tests REST and GraphQL APIs for Broken Object Level Authorization (BOLA/IDOR)", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:testing-api-for-mass-assignment-vulnerability", "kind": "leaf", "title": "Testing API for Mass Assignment Vulnerability", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/testing-api-for-mass-assignment-vulnerability/SKILL.md", "slug": "Testing API for Mass Assignment Vulnerability" }, "description": "Tests APIs for mass assignment (auto-binding) vulnerabilities where", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:testing-cors-misconfiguration", "kind": "leaf", "title": "Testing CORS Misconfiguration", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/testing-cors-misconfiguration/SKILL.md", "slug": "Testing CORS Misconfiguration" }, "description": "Identifying and exploiting Cross-Origin Resource Sharing misconfigurations", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:testing-for-sensitive-data-exposure", "kind": "leaf", "title": "Testing for Sensitive Data Exposure", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/testing-for-sensitive-data-exposure/SKILL.md", "slug": "Testing for Sensitive Data Exposure" }, "description": "Identifying sensitive data exposure vulnerabilities including API key", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:testing-mobile-api-authentication", "kind": "leaf", "title": "Testing Mobile API Authentication", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/testing-mobile-api-authentication/SKILL.md", "slug": "Testing Mobile API Authentication" }, "description": "Tests authentication and authorization mechanisms in mobile application", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:testing-oauth2-implementation-flaws", "kind": "leaf", "title": "Testing OAuth2 Implementation Flaws", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/testing-oauth2-implementation-flaws/SKILL.md", "slug": "Testing OAuth2 Implementation Flaws" }, "description": "Tests OAuth 2.0 and OpenID Connect implementations for security flaws", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:testing-websocket-api-security", "kind": "leaf", "title": "Testing WebSocket API Security", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/testing-websocket-api-security/SKILL.md", "slug": "Testing WebSocket API Security" }, "description": "Tests WebSocket API implementations for security vulnerabilities including", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:using-agent-skills", "kind": "leaf", "title": "Using Agent Skills", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/using-agent-skills/SKILL.md", "slug": "using-agent-skills" }, "description": "Discovers and invokes agent skills. Use when starting a session or when you need to discover which skill applies to the current task. This is the meta-skill that governs how all other skills are discovered and invoked.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:vercel-deploy", "kind": "leaf", "title": "vercel-deploy-claimable", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/vercel-deploy/SKILL.md", "slug": "vercel-deploy-claimable" }, "description": "Deploy applications and websites to Vercel. Use this skill when the user requests deployment actions such as \"Deploy my app\", \"Deploy this to production\", \"Create a preview deployment\", \"Deploy and give me the link\", or \"Push this live\". No authentication required - returns preview URL and claimable deployment link.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:verifying-build-provenance-with-slsa-sigstore", "kind": "leaf", "title": "Verifying Build Provenance with SLSA and Sigstore", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/verifying-build-provenance-with-slsa-sigstore/SKILL.md", "slug": "Verifying Build Provenance with SLSA and Sigstore" }, "description": "Verify signed artifacts and SLSA build provenance with Sigstore cosign and slsa-verifier, enforce keyless OIDC identity, and apply SLSA Build levels to harden the software supply chain.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:vibe-code-auditor", "kind": "leaf", "title": "Vibe Code Auditor", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/vibe-code-auditor/SKILL.md", "slug": "vibe-code-auditor" }, "description": "You are a senior software architect specializing in evaluating prototype-quality and AI-generated code. Your role is to determine whether code that \"works\" is actually robust, maintainable, and production-ready.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:xurl", "kind": "leaf", "title": "xurl", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/xurl/SKILL.md", "slug": "xurl" }, "description": "`xurl` is the X developer platform's official CLI for the X API. It supports shortcut commands for common actions AND raw curl-style access to any v2 endpoint. All commands return JSON to stdout.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "group:dist:software-engineering:playbook", "kind": "group", "title": "Playbook", "children": [ "leaf:dist:ai-sdk-provider-tool-safety", "leaf:dist:analyzing-api-gateway-access-logs", "leaf:dist:api-design-reviewer", "leaf:dist:auditing-kubernetes-rbac-privilege-escalation", "leaf:dist:auditing-terraform-infrastructure-for-security", "leaf:dist:auditing-uefi-firmware-with-chipsec", "leaf:dist:benchmarking-kubernetes-with-kube-bench", "leaf:dist:browser-trace", "leaf:dist:building-devsecops-pipeline-with-gitlab-ci", "leaf:dist:building-identity-governance-lifecycle-process", "leaf:dist:building-ioc-enrichment-pipeline-with-opencti", "leaf:dist:building-threat-intelligence-platform", "leaf:dist:building-vulnerability-dashboard-with-defectdojo", "leaf:dist:bypassing-authentication-with-forced-browsing", "leaf:dist:capacity-planner", "leaf:dist:code-complexity-scanner", "leaf:dist:code-review", "leaf:dist:code-review-excellence", "leaf:dist:codebase-design", "leaf:dist:complexity-cuts", "leaf:dist:conducting-api-security-testing", "leaf:dist:configuring-active-directory-tiered-model", "leaf:dist:cso", "leaf:dist:database-lookup", "leaf:dist:defending-llms-with-guardrails", "leaf:dist:deploying-tailscale-for-zero-trust-vpn", "leaf:dist:detecting-api-enumeration-attacks", "leaf:dist:detecting-aws-credential-exposure-with-trufflehog", "leaf:dist:detecting-broken-object-property-level-authorization", "leaf:dist:detecting-container-escape-attempts", "leaf:dist:detecting-container-escape-with-falco-rules", "leaf:dist:detecting-shadow-api-endpoints", "leaf:dist:detecting-supply-chain-attacks-in-ci-cd", "leaf:dist:detecting-typosquatting-packages", "leaf:dist:diagnosing-bugs", "leaf:dist:diagram", "leaf:dist:docker-development", "leaf:dist:escaping-containers-to-host", "leaf:dist:exploiting-api-injection-vulnerabilities", "leaf:dist:exploiting-excessive-data-exposure-in-api", "leaf:dist:exploiting-mass-assignment-in-rest-apis", "leaf:dist:exploiting-prototype-pollution-in-javascript", "leaf:dist:exploiting-sql-injection-with-sqlmap", "leaf:dist:exploiting-websocket-vulnerabilities", "leaf:dist:freeze", "leaf:dist:get-available-resources", "leaf:dist:git-guardrails-claude-code", "leaf:dist:gstack-openclaw-ceo-review", "leaf:dist:gstack-openclaw-investigate", "leaf:dist:gstack-openclaw-retro", "leaf:dist:guard", "leaf:dist:hardening-docker-containers-for-production", "leaf:dist:hunting-for-t1098-account-manipulation", "leaf:dist:hunting-for-unusual-service-installations", "leaf:dist:implementing-api-abuse-detection-with-rate-limiting", "leaf:dist:implementing-api-gateway-security-controls", "leaf:dist:implementing-api-rate-limiting-and-throttling", "leaf:dist:implementing-api-schema-validation-security", "leaf:dist:implementing-api-security-posture-management", "leaf:dist:implementing-api-security-testing-with-42crunch", "leaf:dist:implementing-aqua-security-for-container-scanning", "leaf:dist:implementing-attack-surface-management", "leaf:dist:implementing-code-signing-for-artifacts", "leaf:dist:implementing-deception-based-detection-with-canarytoken", "leaf:dist:implementing-fuzz-testing-in-cicd-with-aflplusplus", "leaf:dist:implementing-gcp-binary-authorization", "leaf:dist:implementing-github-advanced-security-for-code-scanning", "leaf:dist:implementing-hashicorp-vault-dynamic-secrets", "leaf:dist:implementing-honeytokens-for-breach-detection", "leaf:dist:implementing-infrastructure-as-code-security-scanning", "leaf:dist:implementing-kubernetes-network-policy-with-calico", "leaf:dist:implementing-kubernetes-pod-security-standards", "leaf:dist:implementing-log-forwarding-with-fluentd", "leaf:dist:implementing-mobile-application-management", "leaf:dist:implementing-opa-gatekeeper-for-policy-enforcement", "leaf:dist:implementing-pam-for-database-access", "leaf:dist:implementing-pod-security-admission-controller", "leaf:dist:implementing-secret-scanning-with-gitleaks", "leaf:dist:implementing-secrets-management-with-vault", "leaf:dist:implementing-secrets-scanning-in-ci-cd", "leaf:dist:implementing-supply-chain-security-with-in-toto", "leaf:dist:implementing-vulnerability-sla-breach-alerting", "leaf:dist:implementing-web-application-logging-with-modsecurity", "leaf:dist:implementing-zero-trust-for-saas-applications", "leaf:dist:integrating-sast-into-github-actions-pipeline", "leaf:dist:invariant-guard", "leaf:dist:land-and-deploy", "leaf:dist:migrate-to-shoehorn", "leaf:dist:monorepo-navigator", "leaf:dist:netlify-deploy", "leaf:dist:observability-designer", "leaf:dist:obsidian-vault", "leaf:dist:okf-knowledge-format", "leaf:dist:openclaw-skills-framework", "leaf:dist:performance-engineer", "leaf:dist:performing-android-app-static-analysis-with-mobsf", "leaf:dist:performing-api-fuzzing-with-restler", "leaf:dist:performing-api-inventory-and-discovery", "leaf:dist:performing-api-security-testing-with-postman", "leaf:dist:performing-arp-spoofing-attack-simulation", "leaf:dist:performing-binary-exploitation-analysis", "leaf:dist:performing-bluetooth-security-assessment", "leaf:dist:performing-container-escape-detection", "leaf:dist:performing-container-image-hardening", "leaf:dist:performing-docker-bench-security-assessment", "leaf:dist:performing-fuzzing-with-aflplusplus", "leaf:dist:performing-graphql-depth-limit-attack", "leaf:dist:performing-graphql-introspection-attack", "leaf:dist:performing-osint-with-spiderfoot", "leaf:dist:performing-sca-dependency-scanning-with-snyk", "leaf:dist:performing-scada-hmi-security-assessment", "leaf:dist:performing-serverless-function-security-review", "leaf:dist:performing-service-account-audit", "leaf:dist:performing-service-account-credential-rotation", "leaf:dist:performing-subdomain-enumeration-with-subfinder", "leaf:dist:performing-supply-chain-attack-simulation", "leaf:dist:performing-thick-client-application-penetration-test", "leaf:dist:ponytail", "leaf:dist:ponytail-debt", "leaf:dist:prompt-governance", "leaf:dist:python-background-jobs", "leaf:dist:python-debugpy", "leaf:dist:qa", "leaf:dist:qa-only", "leaf:dist:render-deploy", "leaf:dist:runaway-guard", "leaf:dist:scanning-container-images-with-grype", "leaf:dist:scanning-kubernetes-manifests-with-kubesec", "leaf:dist:securing-api-gateway-with-aws-waf", "leaf:dist:securing-container-registry-images", "leaf:dist:securing-container-registry-with-harbor", "leaf:dist:securing-github-actions-workflows", "leaf:dist:securing-helm-chart-deployments", "leaf:dist:securing-serverless-functions", "leaf:dist:setup-deploy", "leaf:dist:setup-gbrain", "leaf:dist:setup-pre-commit", "leaf:dist:ship", "leaf:dist:skill-lifecycle-states", "leaf:dist:source-discovery-triage", "leaf:dist:testing-api-for-broken-object-level-authorization", "leaf:dist:testing-api-for-mass-assignment-vulnerability", "leaf:dist:testing-cors-misconfiguration", "leaf:dist:testing-for-sensitive-data-exposure", "leaf:dist:testing-mobile-api-authentication", "leaf:dist:testing-oauth2-implementation-flaws", "leaf:dist:testing-websocket-api-security", "leaf:dist:using-agent-skills", "leaf:dist:vercel-deploy", "leaf:dist:verifying-build-provenance-with-slsa-sigstore", "leaf:dist:vibe-code-auditor", "leaf:dist:xurl" ] }, { "id": "leaf:dist:okf-pipeline-pattern", "kind": "leaf", "title": "OKF Pipeline Pattern", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/okf-pipeline-pattern/SKILL.md", "slug": "okf-pipeline-pattern" }, "description": "Build deterministic OKF (Open Knowledge Format) pipelines that extract structured data from sources, produce knowledge bundles, enrich them through agent-guided grounding, and optionally sync back. Use when building reproducible knowledge extraction workflows from databases, filesystems, git repos, or APIs. Covers connector contracts, producer/enrichment loops, provenance, and MCP exposure.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "group:dist:software-engineering:reference", "kind": "group", "title": "Reference", "children": [ "leaf:dist:okf-pipeline-pattern" ] }, { "id": "leaf:dist:chaos-engineering", "kind": "leaf", "title": "Chaos Engineering", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/chaos-engineering/SKILL.md", "slug": "chaos-engineering" }, "description": "Use when planning, running, or learning from chaos engineering experiments. Triggers on \"chaos experiment\", \"fault injection\", \"gameday\", \"resilience test\", \"blast radius\", \"steady state\", \"abort criteria\", or any deliberate failure-injection question. Enforces hypothesis-driven experiment design with mandatory abort criteria and blast-radius bounds.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "high", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:db-backup", "kind": "leaf", "title": "Database Backup & Disaster Recovery", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/db-backup/SKILL.md", "slug": "Database Backup & Disaster Recovery" }, "description": "Set up automated database backup, restore, and disaster recovery procedures for PostgreSQL, MySQL, MongoDB, and Redis. Use when implementing backup schedules, point-in-time recovery, cross-region replication, backup verification, or disaster recovery runbooks.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "high", "classification_status": "complete", "catalog_decision": false } }, { "id": "group:dist:software-engineering:runbook", "kind": "group", "title": "Runbook", "children": [ "leaf:dist:chaos-engineering", "leaf:dist:db-backup" ] }, { "id": "leaf:dist:apple-macos-apps", "kind": "leaf", "title": "apple-macos-apps", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/apple-macos-apps/SKILL.md", "slug": "apple-macos-apps" }, "description": "Operate Apple user-facing macOS apps from the terminal or GUI bridge — Notes, Reminders, Messages, Find My, and adjacent app-specific automation.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:auth-implementation-patterns", "kind": "leaf", "title": "Authentication & Authorization Implementation Patterns", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/auth-implementation-patterns/SKILL.md", "slug": "auth-implementation-patterns" }, "description": "Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC. Use when implementing auth systems, securing APIs, or debugging security issues. Covers JWT generation/verification, refresh token flows, session-based auth with Redis, OAuth2/social login with Passport.js, role-based access control (RBAC), permission-based access control, and resource ownership validation.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "high", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:browser-testing-with-devtools", "kind": "leaf", "title": "Browser Testing with DevTools", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/browser-testing-with-devtools/SKILL.md", "slug": "browser-testing-with-devtools" }, "description": "Tests in real browsers via Chrome DevTools MCP. Use when building or debugging anything that runs in a browser. Use when you need to inspect the DOM, capture console errors, analyze network requests, profile performance, or verify visual output with real runtime data. Requires the chrome-devtools MCP server to be configured.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:c4-architecture", "kind": "leaf", "title": "C4 Architecture Documentation Workflow", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/c4-architecture/SKILL.md", "slug": "c4-architecture" }, "description": "Generate comprehensive C4 architecture documentation for an existing repository/codebase using a bottom-up analysis approach. Creates Context, Container, Component, and Code level documentation with Mermaid diagrams.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "low", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:code-documentation", "kind": "leaf", "title": "Code Documentation Generator", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/code-documentation/SKILL.md", "slug": "Code Documentation Generator" }, "description": "Generate professional, comprehensive documentation for software projects, codebases, libraries, and APIs. Covers README generation, API reference documentation, architecture docs, inline code comments for multiple languages (Python, TypeScript, Go, Rust, Java), developer guides, and changelogs. Follows industry best practices from React, Django, Stripe, and Kubernetes.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "low", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:hook-debugging", "kind": "leaf", "title": "Hook Debugging", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/hook-debugging/SKILL.md", "slug": "Hook Debugging" }, "description": "Debug, test, and troubleshoot hooks. Use when hooks aren't firing, producing errors, or behaving unexpectedly. Covers lifecycle, validation, testing, and implementation workflow.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:python-anti-patterns", "kind": "leaf", "title": "Python Anti-Patterns Checklist", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/python-anti-patterns/SKILL.md", "slug": "Python Anti-Patterns Checklist" }, "description": "Common Python anti-patterns to avoid. Use as a checklist when reviewing code, before finalizing implementations, or when debugging issues that might stem from known bad practices.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "low", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:python-packaging", "kind": "leaf", "title": "Python Packaging", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/python-packaging/SKILL.md", "slug": "Python Packaging" }, "description": "Create distributable Python packages with proper project structure, pyproject.toml, and publishing to PyPI. Use when packaging Python libraries, creating CLI tools, or distributing Python code.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:python-resilience", "kind": "leaf", "title": "Python Resilience Patterns", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/python-resilience/SKILL.md", "slug": "Python Resilience Patterns" }, "description": "Python resilience patterns including automatic retries, exponential backoff, timeouts, and fault-tolerant decorators. Use when adding retry logic, implementing timeouts, building fault-tolerant services, or handling transient failures.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "low", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:resolving-merge-conflicts", "kind": "leaf", "title": "Resolving Merge Conflicts", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/resolving-merge-conflicts/SKILL.md", "slug": "Resolving Merge Conflicts" }, "description": "Use when you need to resolve an in-progress git merge/rebase conflict. Provides a disciplined approach to understanding both sides of a conflict and resolving it without losing intent.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:schema-versioning", "kind": "leaf", "title": "Schema Versioning", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/schema-versioning/SKILL.md", "slug": "Schema Versioning" }, "description": "Set up and manage database schema versioning with migration files, automated rollback capabilities, and CI/CD integration. Use when you need to version database changes, generate migration files from schema diffs, safely roll back failed deployments, or audit schema history.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:sql-optimization-patterns", "kind": "leaf", "title": "SQL Optimization Patterns", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/sql-optimization-patterns/SKILL.md", "slug": "SQL Optimization Patterns" }, "description": "Master SQL query optimization, indexing strategies, and EXPLAIN analysis to dramatically improve database performance and eliminate slow queries. Use when debugging slow queries, designing database schemas, or optimizing application performance.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "group:dist:software-engineering:skill", "kind": "group", "title": "Skill", "children": [ "leaf:dist:apple-macos-apps", "leaf:dist:auth-implementation-patterns", "leaf:dist:browser-testing-with-devtools", "leaf:dist:c4-architecture", "leaf:dist:code-documentation", "leaf:dist:hook-debugging", "leaf:dist:python-anti-patterns", "leaf:dist:python-packaging", "leaf:dist:python-resilience", "leaf:dist:resolving-merge-conflicts", "leaf:dist:schema-versioning", "leaf:dist:sql-optimization-patterns" ] }, { "id": "leaf:dist:performance-profiler", "kind": "leaf", "title": "Performance Profiler", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performance-profiler/SKILL.md", "slug": "Systematic Performance Profiling" }, "description": "Systematic performance profiling for Node.js, Python, and Go applications. Identifies CPU, memory, and I/O bottlenecks, generates flamegraphs, analyzes bundle sizes, optimizes database queries, runs load tests.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:slo-implementation", "kind": "leaf", "title": "SLO Implementation", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/slo-implementation/SKILL.md", "slug": "SLO Implementation" }, "description": "Define and implement Service Level Indicators (SLIs) and Service Level Objectives (SLOs) with error budgets and alerting. Use when establishing reliability targets, implementing SRE practices, or measuring service performance.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "group:dist:software-engineering:workflow", "kind": "group", "title": "Workflow", "children": [ "leaf:dist:performance-profiler", "leaf:dist:slo-implementation" ] }, { "id": "category:dist:software-engineering", "kind": "category", "title": "Software Engineering", "children": [ "group:dist:software-engineering:playbook", "group:dist:software-engineering:reference", "group:dist:software-engineering:runbook", "group:dist:software-engineering:skill", "group:dist:software-engineering:workflow" ] }, { "id": "leaf:dist:anti-sycophancy", "kind": "leaf", "title": "Anti-Sycophancy", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/anti-sycophancy/SKILL.md", "slug": "anti-sycophancy" }, "description": "Eliminate sycophantic agreement patterns in AI responses. Challenges user claims independently, states evidence before deference, and avoids agreement bias.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:architecture-review-loop", "kind": "leaf", "title": "architecture-review-loop", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/architecture-review-loop/SKILL.md", "slug": "architecture-review-loop" }, "description": "Scan a codebase for deepening opportunities, present findings as a visual HTML report, then grill through the chosen candidate. Use when the user wants to improve codebase architecture, find deepening opportunities, turn shallow modules into deep ones, or review architectural friction. Covers deep-module vocabulary (module, interface, depth, seam, adapter, leverage, locality), the deletion test, and the design-it-twice pattern.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:autoplan", "kind": "leaf", "title": "autoplan", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/autoplan/SKILL.md", "slug": "autoplan" }, "description": "Auto-review pipeline — reads the full CEO, design, eng, and DX review skills from disk and runs them sequentially with auto-decisions using 6 decision principles. (gstack)", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:canary", "kind": "leaf", "title": "canary", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/canary/SKILL.md", "slug": "canary" }, "description": "Post-deploy canary monitoring. (gstack)", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:ci-fix-workflow", "kind": "leaf", "title": "CI Fix Workflow", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/ci-fix-workflow/SKILL.md", "slug": "ci-fix-workflow" }, "description": "Debug and fix failing GitHub PR checks (GitHub Actions) using gh CLI. Use when PR checks are failing and the user wants to inspect logs, understand failures, and apply fixes with explicit approval before implementing.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:claude-api-reference", "kind": "leaf", "title": "Claude API Reference", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/claude-api-reference/SKILL.md", "slug": "claude-api-reference" }, "description": "Full reference for the Claude API / Anthropic SDK — model IDs, pricing, params, streaming, tool use, MCP, agents, caching, token counting, model migration.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:claude-automation-recommender", "kind": "leaf", "title": "Claude Automation Recommender", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/claude-automation-recommender/SKILL.md", "slug": "claude-automation-recommender" }, "description": "Analyze a codebase and recommend Claude Code automations (hooks, subagents, skills, plugins, MCP servers). Use when user asks for automation recommendations, wants to optimize their Claude Code setup, mentions improving Claude Code workflows, asks how to first set up Claude Code for a project, or wants to know what Claude Code features they should use.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:claude-md-improver", "kind": "leaf", "title": "CLAUDE.md Improver", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/claude-md-improver/SKILL.md", "slug": "claude-md-improver" }, "description": "Audit and improve CLAUDE.md files in repositories. Use when user asks to check, audit, update, improve, or fix CLAUDE.md files. Scans for all CLAUDE.md files, evaluates quality against templates, outputs quality report, then makes targeted updates. Also use when the user mentions \"CLAUDE.md maintenance\" or \"project memory optimization\".", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:clean-code-discipline", "kind": "leaf", "title": "Clean Code Discipline", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/clean-code-discipline/SKILL.md", "slug": "clean-code-discipline" }, "description": "Clean code principles from Robert C. Martin's \"Clean Code\" — readability, naming, function design, error handling, and boundary separation as agent operating discipline.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:codebase-automation-recommender", "kind": "leaf", "title": "Codebase Automation Recommender", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/codebase-automation-recommender/SKILL.md", "slug": "codebase-automation-recommender" }, "description": "Analyze a codebase and recommend agent automations (hooks, subagents, skills, MCP servers). Use when the user asks for automation recommendations, wants to optimize their agent setup, mentions improving agent workflows, asks how to first set up an agent for a project, or wants to know what agent features they should use. Adapted from anthropic-claude-plugins-official/claude-automation-recommender.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:conducting-cloud-incident-response", "kind": "leaf", "title": "Conducting Cloud Incident Response", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/conducting-cloud-incident-response/SKILL.md", "slug": "Conducting Cloud Incident Response" }, "description": "Responds to security incidents in cloud environments (AWS, Azure, GCP) by performing identity-based containment,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:conducting-cloud-penetration-testing", "kind": "leaf", "title": "Conducting Cloud Penetration Testing", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/conducting-cloud-penetration-testing/SKILL.md", "slug": "Conducting Cloud Penetration Testing" }, "description": "This skill outlines methodologies for performing authorized penetration", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:conducting-domain-persistence-with-dcsync", "kind": "leaf", "title": "Conducting Domain Persistence with DCSync", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/conducting-domain-persistence-with-dcsync/SKILL.md", "slug": "Conducting Domain Persistence with DCSync" }, "description": "Perform DCSync attacks to replicate Active Directory credentials and", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:conducting-external-reconnaissance-with-osint", "kind": "leaf", "title": "Conducting External Reconnaissance with OSINT", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/conducting-external-reconnaissance-with-osint/SKILL.md", "slug": "Conducting External Reconnaissance with OSINT" }, "description": "Conducts external reconnaissance using Open Source Intelligence (OSINT)", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:conducting-full-scope-red-team-engagement", "kind": "leaf", "title": "Conducting Full-Scope Red Team Engagement", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/conducting-full-scope-red-team-engagement/SKILL.md", "slug": "Conducting Full-Scope Red Team Engagement" }, "description": "Plan and execute a comprehensive red team engagement covering reconnaissance", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:conducting-internal-network-penetration-test", "kind": "leaf", "title": "Conducting Internal Network Penetration Test", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/conducting-internal-network-penetration-test/SKILL.md", "slug": "Conducting Internal Network Penetration Test" }, "description": "Execute an internal network penetration test simulating an insider threat", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:conducting-internal-reconnaissance-with-bloodhound-ce", "kind": "leaf", "title": "Conducting Internal Reconnaissance with BloodHound CE", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/conducting-internal-reconnaissance-with-bloodhound-ce/SKILL.md", "slug": "Conducting Internal Reconnaissance with BloodHound CE" }, "description": "Conduct internal Active Directory reconnaissance using BloodHound Community", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:conducting-man-in-the-middle-attack-simulation", "kind": "leaf", "title": "Conducting Man-in-the-Middle Attack Simulation", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/conducting-man-in-the-middle-attack-simulation/SKILL.md", "slug": "Conducting Man-in-the-Middle Attack Simulation" }, "description": "Simulates man-in-the-middle attacks using Ettercap, mitmproxy, and Bettercap", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:conducting-memory-forensics-with-volatility", "kind": "leaf", "title": "Conducting Memory Forensics with Volatility", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/conducting-memory-forensics-with-volatility/SKILL.md", "slug": "Conducting Memory Forensics with Volatility" }, "description": "Performs memory forensics analysis using Volatility 3 to extract evidence", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:conducting-pass-the-ticket-attack", "kind": "leaf", "title": "Conducting Pass-the-Ticket Attack", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/conducting-pass-the-ticket-attack/SKILL.md", "slug": "Conducting Pass-the-Ticket Attack" }, "description": "Pass-the-Ticket (PtT) is a lateral movement technique that uses stolen", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:conducting-phishing-incident-response", "kind": "leaf", "title": "Conducting Phishing Incident Response", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/conducting-phishing-incident-response/SKILL.md", "slug": "Conducting Phishing Incident Response" }, "description": "Responds to phishing incidents by analyzing reported emails, extracting", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:conducting-post-incident-lessons-learned", "kind": "leaf", "title": "Conducting Post-Incident Lessons Learned", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/conducting-post-incident-lessons-learned/SKILL.md", "slug": "Conducting Post-Incident Lessons Learned" }, "description": "Facilitate structured post-incident reviews to identify root causes,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:conducting-social-engineering-penetration-test", "kind": "leaf", "title": "Conducting Social Engineering Penetration Test", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/conducting-social-engineering-penetration-test/SKILL.md", "slug": "Conducting Social Engineering Penetration Test" }, "description": "Design and execute a social engineering penetration test including phishing,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:conducting-social-engineering-pretext-call", "kind": "leaf", "title": "Conducting Social Engineering Pretext Call", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/conducting-social-engineering-pretext-call/SKILL.md", "slug": "Conducting Social Engineering Pretext Call" }, "description": "Plan and execute authorized vishing (voice phishing) pretext calls to", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:conducting-spearphishing-simulation-campaign", "kind": "leaf", "title": "Conducting Spearphishing Simulation Campaign", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/conducting-spearphishing-simulation-campaign/SKILL.md", "slug": "Conducting Spearphishing Simulation Campaign" }, "description": "Spearphishing simulation is a targeted social engineering attack vector", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:configuring-host-based-intrusion-detection", "kind": "leaf", "title": "Configuring Host-Based Intrusion Detection", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/configuring-host-based-intrusion-detection/SKILL.md", "slug": "Configuring Host-Based Intrusion Detection" }, "description": "Configures host-based intrusion detection systems (HIDS) to monitor", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:configuring-microsegmentation-for-zero-trust", "kind": "leaf", "title": "Configuring Microsegmentation for Zero Trust", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/configuring-microsegmentation-for-zero-trust/SKILL.md", "slug": "Configuring Microsegmentation for Zero Trust" }, "description": "Configure microsegmentation policies to enforce least-privilege workload-to-workload", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:configuring-multi-factor-authentication-with-duo", "kind": "leaf", "title": "Configuring Multi-Factor Authentication with Duo", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/configuring-multi-factor-authentication-with-duo/SKILL.md", "slug": "Configuring Multi-Factor Authentication with Duo" }, "description": "Deploy Cisco Duo multi-factor authentication across enterprise applications,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:configuring-network-segmentation-with-vlans", "kind": "leaf", "title": "Configuring Network Segmentation with VLANs", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/configuring-network-segmentation-with-vlans/SKILL.md", "slug": "Configuring Network Segmentation with VLANs" }, "description": "Designs and implements VLAN-based network segmentation on managed switches", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:configuring-pfsense-firewall-rules", "kind": "leaf", "title": "Configuring pfSense Firewall Rules", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/configuring-pfsense-firewall-rules/SKILL.md", "slug": "Configuring pfSense Firewall Rules" }, "description": "Configures pfSense firewall rules, NAT policies, VPN tunnels, and traffic", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:configuring-suricata-for-network-monitoring", "kind": "leaf", "title": "Configuring Suricata for Network Monitoring", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/configuring-suricata-for-network-monitoring/SKILL.md", "slug": "Configuring Suricata for Network Monitoring" }, "description": "Deploys and configures Suricata IDS/IPS with Emerging Threats rulesets,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:configuring-windows-defender-advanced-settings", "kind": "leaf", "title": "Configuring Windows Defender Advanced Settings", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/configuring-windows-defender-advanced-settings/SKILL.md", "slug": "Configuring Windows Defender Advanced Settings" }, "description": "Configures Microsoft Defender for Endpoint (MDE) advanced protection", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:configuring-windows-event-logging-for-detection", "kind": "leaf", "title": "Configuring Windows Event Logging for Detection", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/configuring-windows-event-logging-for-detection/SKILL.md", "slug": "Configuring Windows Event Logging for Detection" }, "description": "Configures Windows Event Logging with advanced audit policies to generate", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:containing-active-breach", "kind": "leaf", "title": "Containing Active Breaches", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/containing-active-breach/SKILL.md", "slug": "Containing Active Breaches" }, "description": "Executes containment strategies to stop active adversary operations", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:continuous-llm-red-teaming-with-promptfoo", "kind": "leaf", "title": "Continuous LLM Red Teaming with Promptfoo", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/continuous-llm-red-teaming-with-promptfoo/SKILL.md", "slug": "Continuous LLM Red Teaming with Promptfoo" }, "description": "Wire Promptfoo and DeepTeam into CI/CD for automated regression red-teaming of LLM apps against OWASP LLM Top 10 and OWASP Agentic presets, failing the build when jailbreak or injection vulnerabilities regress.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:correlating-security-events-in-qradar", "kind": "leaf", "title": "Correlating Security Events in QRadar", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/correlating-security-events-in-qradar/SKILL.md", "slug": "Correlating Security Events in QRadar" }, "description": "Correlates security events in IBM QRadar SIEM using AQL (Ariel Query", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:correlating-threat-campaigns", "kind": "leaf", "title": "Correlating Threat Campaigns", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/correlating-threat-campaigns/SKILL.md", "slug": "Correlating Threat Campaigns" }, "description": "Correlates disparate security incidents, IOCs, and adversary behaviors", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:data-intensive-design", "kind": "leaf", "title": "Data-Intensive Design", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/data-intensive-design/SKILL.md", "slug": "data-intensive-design" }, "description": "Distributed data system design from Martin Kleppmann's \"Designing Data-Intensive Applications\" — consistency, replication, partitioning, stream processing, and schema evolution as agent operating discipline.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:data-pipeline-architecture", "kind": "leaf", "title": "Data Pipeline Architecture", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/data-pipeline-architecture/SKILL.md", "slug": "data-pipeline-architecture" }, "description": "Design and implement scalable, reliable data pipelines for batch and streaming processing. Covers ETL/ELT, Lambda, Kappa, Lakehouse architectures, workflow orchestration (Airflow/Prefect), dbt transformations, Delta Lake/Iceberg storage, and data quality frameworks.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:data-quality", "kind": "leaf", "title": "Data Quality Frameworks", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/data-quality/SKILL.md", "slug": "data-quality" }, "description": "Implement data quality validation with Great Expectations, dbt tests, and data contracts. Covers 6 quality dimensions, testing pyramid, automated validation pipelines, and data contract specification.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:data-quality-auditor", "kind": "leaf", "title": "Data Quality Auditor", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/data-quality-auditor/SKILL.md", "slug": "data-quality-auditor" }, "description": "Audit datasets for completeness, consistency, accuracy, and validity. Profile data distributions, detect anomalies and outliers, surface structural issues, and produce an actionable remediation plan. Use when the user asks to check data quality, profile a dataset, hunt outliers or missing values, or validate data before analysis or model training.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:data-structure-protocol", "kind": "leaf", "title": "Data Structure Protocol (DSP)", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/data-structure-protocol/SKILL.md", "slug": "data-structure-protocol" }, "description": "Give agents persistent structural memory of a codebase — navigate dependencies, track public APIs, and understand why connections exist without re-reading the whole repo. Uses a .dsp/ directory for stable, queryable structural maps.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:decision-mapping", "kind": "leaf", "title": "Decision Mapping", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/decision-mapping/SKILL.md", "slug": "decision-mapping" }, "description": "Turn a loose idea into a sequenced map of investigation tickets, then drive them to resolution one at a time. Use when a multi-session planning effort has open questions that need research, prototyping, or discussion before implementation can begin.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:deobfuscating-javascript-malware", "kind": "leaf", "title": "Deobfuscating JavaScript Malware", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/deobfuscating-javascript-malware/SKILL.md", "slug": "Deobfuscating JavaScript Malware" }, "description": "Deobfuscates malicious JavaScript code used in web-based attacks, phishing", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:deobfuscating-powershell-obfuscated-malware", "kind": "leaf", "title": "Deobfuscating PowerShell Obfuscated Malware", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/deobfuscating-powershell-obfuscated-malware/SKILL.md", "slug": "Deobfuscating PowerShell Obfuscated Malware" }, "description": "Systematically deobfuscate multi-layer PowerShell malware using AST analysis,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:deploying-active-directory-honeytokens", "kind": "leaf", "title": "Deploying Active Directory Honeytokens", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/deploying-active-directory-honeytokens/SKILL.md", "slug": "Deploying Active Directory Honeytokens" }, "description": "Deploys deception-based honeytokens in Active Directory including fake", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:deploying-cloud-deception-with-decoy-resources", "kind": "leaf", "title": "Deploying Cloud Deception with Decoy Resources", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/deploying-cloud-deception-with-decoy-resources/SKILL.md", "slug": "Deploying Cloud Deception with Decoy Resources" }, "description": "This is the cloud counterpart to on-prem honeypot/honeytoken/canary-token deployment skills. For program strategy and how these Activities map to adversary engagement goals, use `designing-adversary-engagement-with-mitre-engage`.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:deploying-cloudflare-access-for-zero-trust", "kind": "leaf", "title": "Deploying Cloudflare Access for Zero Trust", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/deploying-cloudflare-access-for-zero-trust/SKILL.md", "slug": "Deploying Cloudflare Access for Zero Trust" }, "description": "Deploying Cloudflare Access with Cloudflare Tunnel to provide zero trust", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:deploying-decoy-files-for-ransomware-detection", "kind": "leaf", "title": "Deploying Decoy Files for Ransomware Detection", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/deploying-decoy-files-for-ransomware-detection/SKILL.md", "slug": "Deploying Decoy Files for Ransomware Detection" }, "description": "Deploys canary files (honeytokens) across file systems to detect ransomware", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:deploying-edr-agent-with-crowdstrike", "kind": "leaf", "title": "Deploying EDR Agent with CrowdStrike", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/deploying-edr-agent-with-crowdstrike/SKILL.md", "slug": "Deploying EDR Agent with CrowdStrike" }, "description": "Deploys and configures CrowdStrike Falcon EDR agents across enterprise", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:deploying-honeytokens-and-canarytokens", "kind": "leaf", "title": "Deploying Honeytokens and Canarytokens", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/deploying-honeytokens-and-canarytokens/SKILL.md", "slug": "Deploying Honeytokens and Canarytokens" }, "description": "Plant canarytokens and honey credentials and alert on breach.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:deploying-osquery-for-endpoint-monitoring", "kind": "leaf", "title": "Deploying Osquery for Endpoint Monitoring", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/deploying-osquery-for-endpoint-monitoring/SKILL.md", "slug": "Deploying Osquery for Endpoint Monitoring" }, "description": "Deploys and configures osquery for real-time endpoint monitoring using", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:deploying-palo-alto-prisma-access-zero-trust", "kind": "leaf", "title": "Deploying Palo Alto Prisma Access Zero Trust", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/deploying-palo-alto-prisma-access-zero-trust/SKILL.md", "slug": "Deploying Palo Alto Prisma Access Zero Trust" }, "description": "Deploying Palo Alto Networks Prisma Access for SASE-based zero trust", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:deploying-ransomware-canary-files", "kind": "leaf", "title": "Deploying Ransomware Canary Files", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/deploying-ransomware-canary-files/SKILL.md", "slug": "Deploying Ransomware Canary Files" }, "description": "Deploys and monitors ransomware canary files across critical directories", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:deploying-software-defined-perimeter", "kind": "leaf", "title": "Deploying Software-Defined Perimeter", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/deploying-software-defined-perimeter/SKILL.md", "slug": "Deploying Software-Defined Perimeter" }, "description": "Deploy a Software-Defined Perimeter using the CSA v2.0 specification", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:designing-adversary-engagement-with-mitre-engage", "kind": "leaf", "title": "Designing Adversary Engagement with MITRE Engage", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/designing-adversary-engagement-with-mitre-engage/SKILL.md", "slug": "Designing Adversary Engagement with MITRE Engage" }, "description": "This skill is the **strategy and operations layer** that sits above tactical deployment skills (honeypot, honeytoken, canary-token, and decoy-file deployment). Use those skills to *implement* the Activities this skill selects and sequences.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-anomalous-authentication-patterns", "kind": "leaf", "title": "Detecting Anomalous Authentication Patterns", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-anomalous-authentication-patterns/SKILL.md", "slug": "Detecting Anomalous Authentication Patterns" }, "description": "Detects anomalous authentication patterns using UEBA analytics, statistical", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-arp-poisoning-in-network-traffic", "kind": "leaf", "title": "Detecting ARP Poisoning in Network Traffic", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-arp-poisoning-in-network-traffic/SKILL.md", "slug": "Detecting ARP Poisoning in Network Traffic" }, "description": "Detect and prevent ARP spoofing attacks using ARPWatch, Dynamic ARP Inspection,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-attacks-on-historian-servers", "kind": "leaf", "title": "Detecting Attacks on Historian Servers", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-attacks-on-historian-servers/SKILL.md", "slug": "Detecting Attacks on Historian Servers" }, "description": "Detect cyber attacks targeting OT historian servers (OSIsoft PI, Ignition,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-attacks-on-scada-systems", "kind": "leaf", "title": "Detecting Attacks on SCADA Systems", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-attacks-on-scada-systems/SKILL.md", "slug": "Detecting Attacks on SCADA Systems" }, "description": "This skill covers detecting cyber attacks targeting Supervisory Control", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-aws-guardduty-findings-automation", "kind": "leaf", "title": "Detecting AWS GuardDuty Findings Automation", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-aws-guardduty-findings-automation/SKILL.md", "slug": "Detecting AWS GuardDuty Findings Automation" }, "description": "Automate AWS GuardDuty threat detection findings processing using EventBridge", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-azure-service-principal-abuse", "kind": "leaf", "title": "Detecting Azure Service Principal Abuse", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-azure-service-principal-abuse/SKILL.md", "slug": "Detecting Azure Service Principal Abuse" }, "description": "Detect and investigate Azure service principal abuse including privilege", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-beaconing-patterns-with-zeek", "kind": "leaf", "title": "Detecting Beaconing Patterns with Zeek", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-beaconing-patterns-with-zeek/SKILL.md", "slug": "Detecting Beaconing Patterns with Zeek" }, "description": "Performs statistical analysis of Zeek conn.log connection intervals", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-bluetooth-low-energy-attacks", "kind": "leaf", "title": "Detecting Bluetooth Low Energy Attacks", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-bluetooth-low-energy-attacks/SKILL.md", "slug": "Detecting Bluetooth Low Energy Attacks" }, "description": "Detects and analyzes Bluetooth Low Energy (BLE) security attacks including", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-business-email-compromise", "kind": "leaf", "title": "Detecting Business Email Compromise", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-business-email-compromise/SKILL.md", "slug": "Detecting Business Email Compromise" }, "description": "Business Email Compromise (BEC) is a sophisticated fraud scheme where", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-cloud-threats-with-guardduty", "kind": "leaf", "title": "Detecting Cloud Threats with GuardDuty", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-cloud-threats-with-guardduty/SKILL.md", "slug": "Detecting Cloud Threats with GuardDuty" }, "description": "This skill teaches security teams how to deploy and operationalize Amazon", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-command-and-control-over-dns", "kind": "leaf", "title": "Detecting Command and Control Over DNS", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-command-and-control-over-dns/SKILL.md", "slug": "Detecting Command and Control Over DNS" }, "description": "Detects command-and-control (C2) communications tunneled through DNS", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-container-drift-at-runtime", "kind": "leaf", "title": "Detecting Container Drift at Runtime", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-container-drift-at-runtime/SKILL.md", "slug": "Detecting Container Drift at Runtime" }, "description": "Detect unauthorized modifications to running containers by monitoring", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-container-runtime-threats-with-falco", "kind": "leaf", "title": "Detecting Container Runtime Threats with Falco", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-container-runtime-threats-with-falco/SKILL.md", "slug": "Detecting Container Runtime Threats with Falco" }, "description": "Write and deploy Falco rules with the modern eBPF driver to detect container escape, namespace abuse, privileged mounts, and anomalous syscalls at runtime in Kubernetes and Docker.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-credential-dumping-techniques", "kind": "leaf", "title": "Detecting Credential Dumping Techniques", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-credential-dumping-techniques/SKILL.md", "slug": "Detecting Credential Dumping Techniques" }, "description": "Detect LSASS credential dumping, SAM database extraction, and NTDS.dit", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-cryptomining-in-cloud", "kind": "leaf", "title": "Detecting Cryptomining in Cloud", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-cryptomining-in-cloud/SKILL.md", "slug": "Detecting Cryptomining in Cloud" }, "description": "This skill teaches security teams how to detect and respond to unauthorized", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-data-and-model-poisoning", "kind": "leaf", "title": "Detecting Data and Model Poisoning", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-data-and-model-poisoning/SKILL.md", "slug": "Detecting Data and Model Poisoning" }, "description": "Identify poisoned training data and backdoored models across the ML pipeline.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-dcsync-attack-in-active-directory", "kind": "leaf", "title": "Detecting DCSync Attack in Active Directory", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-dcsync-attack-in-active-directory/SKILL.md", "slug": "Detecting DCSync Attack in Active Directory" }, "description": "Detect DCSync attacks where adversaries abuse Active Directory replication", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-deepfake-audio-in-vishing-attacks", "kind": "leaf", "title": "Detecting Deepfake Audio in Vishing Attacks", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-deepfake-audio-in-vishing-attacks/SKILL.md", "slug": "Detecting Deepfake Audio in Vishing Attacks" }, "description": "Detects AI-generated deepfake audio used in voice phishing (vishing)", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-dll-sideloading-attacks", "kind": "leaf", "title": "Detecting DLL Sideloading Attacks", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-dll-sideloading-attacks/SKILL.md", "slug": "Detecting DLL Sideloading Attacks" }, "description": "Detect DLL side-loading attacks where adversaries place malicious DLLs", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-dns-exfiltration-with-dns-query-analysis", "kind": "leaf", "title": "Detecting DNS Exfiltration with DNS Query Analysis", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-dns-exfiltration-with-dns-query-analysis/SKILL.md", "slug": "Detecting DNS Exfiltration with DNS Query Analysis" }, "description": "Detect data exfiltration through DNS tunneling by analyzing query entropy,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-email-forwarding-rules-attack", "kind": "leaf", "title": "Detecting Email Forwarding Rules Attack", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-email-forwarding-rules-attack/SKILL.md", "slug": "Detecting Email Forwarding Rules Attack" }, "description": "Detect malicious email forwarding rules created by adversaries to maintain", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-entra-offensive-tools-in-graph-logs", "kind": "leaf", "title": "Detecting Entra Offensive Tools in Graph Logs", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-entra-offensive-tools-in-graph-logs/SKILL.md", "slug": "Detecting Entra Offensive Tools in Graph Logs" }, "description": "Hunt AADGraphActivityLogs and MicrosoftGraphActivityLogs in Microsoft Sentinel/Log Analytics for fingerprints of offensive Entra ID tools such as ROADtools, AADInternals, and AzureHound.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-evasion-techniques-in-endpoint-logs", "kind": "leaf", "title": "Detecting Evasion Techniques in Endpoint Logs", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-evasion-techniques-in-endpoint-logs/SKILL.md", "slug": "Detecting Evasion Techniques in Endpoint Logs" }, "description": "Detects defense evasion techniques used by adversaries in endpoint logs", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-exfiltration-over-dns-with-zeek", "kind": "leaf", "title": "Detecting Exfiltration over DNS with Zeek", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-exfiltration-over-dns-with-zeek/SKILL.md", "slug": "Detecting Exfiltration over DNS with Zeek" }, "description": "Detect DNS-based data exfiltration by analyzing Zeek dns.log for high-entropy", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-fileless-attacks-on-endpoints", "kind": "leaf", "title": "Detecting Fileless Attacks on Endpoints", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-fileless-attacks-on-endpoints/SKILL.md", "slug": "Detecting Fileless Attacks on Endpoints" }, "description": "Detects fileless malware and in-memory attacks that execute entirely", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-fileless-malware-techniques", "kind": "leaf", "title": "Detecting Fileless Malware Techniques", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-fileless-malware-techniques/SKILL.md", "slug": "Detecting Fileless Malware Techniques" }, "description": "Detects and analyzes fileless malware that operates entirely in memory", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-golden-ticket-attacks-in-kerberos-logs", "kind": "leaf", "title": "Detecting Golden Ticket Attacks in Kerberos Logs", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-golden-ticket-attacks-in-kerberos-logs/SKILL.md", "slug": "Detecting Golden Ticket Attacks in Kerberos Logs" }, "description": "Detect Golden Ticket attacks in Active Directory by analyzing Kerberos", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-golden-ticket-forgery", "kind": "leaf", "title": "Detecting Golden Ticket Forgery", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-golden-ticket-forgery/SKILL.md", "slug": "Detecting Golden Ticket Forgery" }, "description": "Detect Kerberos Golden Ticket forgery by analyzing Windows Event ID 4769", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-insider-data-exfiltration-via-dlp", "kind": "leaf", "title": "Detecting Insider Data Exfiltration via DLP", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-insider-data-exfiltration-via-dlp/SKILL.md", "slug": "Detecting Insider Data Exfiltration via DLP" }, "description": "Detects insider data exfiltration by analyzing DLP policy violations,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-insider-threat-behaviors", "kind": "leaf", "title": "Detecting Insider Threat Behaviors", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-insider-threat-behaviors/SKILL.md", "slug": "Detecting Insider Threat Behaviors" }, "description": "Detect insider threat behavioral indicators including unusual data access,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-kerberoasting-attacks", "kind": "leaf", "title": "Detecting Kerberoasting Attacks", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-kerberoasting-attacks/SKILL.md", "slug": "Detecting Kerberoasting Attacks" }, "description": "Detect Kerberoasting attacks by monitoring for anomalous Kerberos TGS", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-lateral-movement-in-network", "kind": "leaf", "title": "Detecting Lateral Movement in Network", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-lateral-movement-in-network/SKILL.md", "slug": "Detecting Lateral Movement in Network" }, "description": "Identifies lateral movement techniques in enterprise networks by analyzing", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-lateral-movement-with-splunk", "kind": "leaf", "title": "Detecting Lateral Movement with Splunk", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-lateral-movement-with-splunk/SKILL.md", "slug": "Detecting Lateral Movement with Splunk" }, "description": "Detect adversary lateral movement across networks using Splunk SPL queries", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-living-off-the-land-attacks", "kind": "leaf", "title": "Detecting Living Off the Land Attacks", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-living-off-the-land-attacks/SKILL.md", "slug": "Detecting Living Off the Land Attacks" }, "description": "Detect abuse of legitimate Windows binaries (LOLBins) used for living", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-malicious-npm-packages", "kind": "leaf", "title": "Detecting Malicious npm Packages", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-malicious-npm-packages/SKILL.md", "slug": "Detecting Malicious npm Packages" }, "description": "Triage npm packages for install-script malware, exfiltration, and worming behavior.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-malicious-scheduled-tasks-with-sysmon", "kind": "leaf", "title": "Detecting Malicious Scheduled Tasks with Sysmon", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-malicious-scheduled-tasks-with-sysmon/SKILL.md", "slug": "Detecting Malicious Scheduled Tasks with Sysmon" }, "description": "Detect malicious scheduled task creation and modification using Sysmon", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-mimikatz-execution-patterns", "kind": "leaf", "title": "Detecting Mimikatz Execution Patterns", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-mimikatz-execution-patterns/SKILL.md", "slug": "Detecting Mimikatz Execution Patterns" }, "description": "Detect Mimikatz execution through command-line patterns, LSASS access", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-mobile-malware-behavior", "kind": "leaf", "title": "Detecting Mobile Malware Behavior", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-mobile-malware-behavior/SKILL.md", "slug": "Detecting Mobile Malware Behavior" }, "description": "Detects and analyzes malicious behavior in mobile applications through", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-modbus-command-injection-attacks", "kind": "leaf", "title": "Detecting Modbus Command Injection Attacks", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-modbus-command-injection-attacks/SKILL.md", "slug": "Detecting Modbus Command Injection Attacks" }, "description": "Detect command injection attacks against Modbus TCP/RTU protocol in", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-model-extraction-attacks", "kind": "leaf", "title": "Detecting Model Extraction Attacks", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-model-extraction-attacks/SKILL.md", "slug": "Detecting Model Extraction Attacks" }, "description": "Detect model stealing, model inversion, and membership inference performed through inference-API abuse by monitoring query patterns, applying output perturbation, and red-teaming your own model's extractability.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-network-anomalies-with-zeek", "kind": "leaf", "title": "Detecting Network Anomalies with Zeek", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-network-anomalies-with-zeek/SKILL.md", "slug": "Detecting Network Anomalies with Zeek" }, "description": "Deploys and configures Zeek (formerly Bro) network security monitor", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-network-scanning-with-ids-signatures", "kind": "leaf", "title": "Detecting Network Scanning with IDS Signatures", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-network-scanning-with-ids-signatures/SKILL.md", "slug": "Detecting Network Scanning with IDS Signatures" }, "description": "Detect network reconnaissance and port scanning using Suricata and Snort", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-ntlm-relay-with-event-correlation", "kind": "leaf", "title": "Detecting NTLM Relay with Event Correlation", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-ntlm-relay-with-event-correlation/SKILL.md", "slug": "Detecting NTLM Relay with Event Correlation" }, "description": "Detect NTLM relay attacks through Windows Security Event correlation", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-oauth-token-theft", "kind": "leaf", "title": "Detecting OAuth Token Theft", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-oauth-token-theft/SKILL.md", "slug": "Detecting OAuth Token Theft" }, "description": "Detects and responds to OAuth token theft and replay attacks in cloud", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-pass-the-hash-attacks", "kind": "leaf", "title": "Detecting Pass The Hash Attacks", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-pass-the-hash-attacks/SKILL.md", "slug": "Detecting Pass The Hash Attacks" }, "description": "Detect Pass-the-Hash attacks by analyzing NTLM authentication patterns,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-privilege-escalation-attempts", "kind": "leaf", "title": "Detecting Privilege Escalation Attempts", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-privilege-escalation-attempts/SKILL.md", "slug": "Detecting Privilege Escalation Attempts" }, "description": "Detect privilege escalation attempts including token manipulation, UAC", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-privilege-escalation-in-kubernetes-pods", "kind": "leaf", "title": "Detecting Privilege Escalation in Kubernetes Pods", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-privilege-escalation-in-kubernetes-pods/SKILL.md", "slug": "Detecting Privilege Escalation in Kubernetes Pods" }, "description": "Detect and prevent privilege escalation in Kubernetes pods by monitoring", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-process-hollowing-technique", "kind": "leaf", "title": "Detecting Process Hollowing Technique", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-process-hollowing-technique/SKILL.md", "slug": "Detecting Process Hollowing Technique" }, "description": "Detect process hollowing (T1055.012) by analyzing memory-mapped sections,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-process-injection-techniques", "kind": "leaf", "title": "Detecting Process Injection Techniques", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-process-injection-techniques/SKILL.md", "slug": "Detecting Process Injection Techniques" }, "description": "Detects and analyzes process injection techniques used by malware including", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-qr-code-phishing-with-email-security", "kind": "leaf", "title": "Detecting QR Code Phishing with Email Security", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-qr-code-phishing-with-email-security/SKILL.md", "slug": "Detecting QR Code Phishing with Email Security" }, "description": "Detect and prevent QR code phishing (quishing) attacks that bypass traditional", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-ransomware-encryption-behavior", "kind": "leaf", "title": "Detecting Ransomware Encryption Behavior", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-ransomware-encryption-behavior/SKILL.md", "slug": "Detecting Ransomware Encryption Behavior" }, "description": "Detects ransomware encryption activity in real time using entropy analysis,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-ransomware-precursors-in-network", "kind": "leaf", "title": "Detecting Ransomware Precursors in Network Traffic", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-ransomware-precursors-in-network/SKILL.md", "slug": "Detecting Ransomware Precursors in Network Traffic" }, "description": "Detects early-stage ransomware indicators in network traffic before", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-rootkit-activity", "kind": "leaf", "title": "Detecting Rootkit Activity", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-rootkit-activity/SKILL.md", "slug": "Detecting Rootkit Activity" }, "description": "Detects rootkit presence on compromised systems by identifying hidden", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-secure-boot-bypass", "kind": "leaf", "title": "Detecting Secure Boot Bypass", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-secure-boot-bypass/SKILL.md", "slug": "Detecting Secure Boot Bypass" }, "description": "Detect bootkits such as BlackLotus and Bootkitty and Secure Boot bypass via DBX and binary checks.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-serverless-function-injection", "kind": "leaf", "title": "Detecting Serverless Function Injection", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-serverless-function-injection/SKILL.md", "slug": "Detecting Serverless Function Injection" }, "description": "Detects and prevents code injection attacks targeting serverless functions", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-service-account-abuse", "kind": "leaf", "title": "Detecting Service Account Abuse", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-service-account-abuse/SKILL.md", "slug": "Detecting Service Account Abuse" }, "description": "Detect abuse of service accounts through anomalous interactive logons,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-spearphishing-with-email-gateway", "kind": "leaf", "title": "Detecting Spearphishing with Email Gateway", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-spearphishing-with-email-gateway/SKILL.md", "slug": "Detecting Spearphishing with Email Gateway" }, "description": "Spearphishing targets specific individuals using personalized, researched", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-stuxnet-style-attacks", "kind": "leaf", "title": "Detecting Stuxnet-Style Attacks", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-stuxnet-style-attacks/SKILL.md", "slug": "Detecting Stuxnet-Style Attacks" }, "description": "This skill covers detecting sophisticated cyber-physical attacks that", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-suspicious-powershell-execution", "kind": "leaf", "title": "Detecting Suspicious Powershell Execution", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-suspicious-powershell-execution/SKILL.md", "slug": "Detecting Suspicious Powershell Execution" }, "description": "Detect suspicious PowerShell execution patterns including encoded commands,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-t1003-credential-dumping-with-edr", "kind": "leaf", "title": "Detecting T1003 Credential Dumping with EDR", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-t1003-credential-dumping-with-edr/SKILL.md", "slug": "Detecting T1003 Credential Dumping with EDR" }, "description": "Detect OS credential dumping techniques targeting LSASS memory, SAM database,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-t1055-process-injection-with-sysmon", "kind": "leaf", "title": "Detecting T1055 Process Injection with Sysmon", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-t1055-process-injection-with-sysmon/SKILL.md", "slug": "Detecting T1055 Process Injection with Sysmon" }, "description": "Detect process injection techniques (T1055) including classic DLL injection,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-t1548-abuse-elevation-control-mechanism", "kind": "leaf", "title": "Detecting T1548 Abuse Elevation Control Mechanism", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-t1548-abuse-elevation-control-mechanism/SKILL.md", "slug": "Detecting T1548 Abuse Elevation Control Mechanism" }, "description": "Detect abuse of elevation control mechanisms including UAC bypass, sudo", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:detecting-wmi-persistence", "kind": "leaf", "title": "Detecting WMI Persistence", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-wmi-persistence/SKILL.md", "slug": "Detecting WMI Persistence" }, "description": "Detect WMI event subscription persistence by analyzing Sysmon Event IDs", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:distributed-tracing", "kind": "leaf", "title": "Distributed Tracing", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/distributed-tracing/SKILL.md", "slug": "distributed-tracing" }, "description": "Implement distributed tracing with Jaeger and Tempo to track requests across microservices. Use when debugging latency in microservices, analyzing request flows, or implementing observability for distributed systems.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:enumerating-cloud-with-cloudfox", "kind": "leaf", "title": "Enumerating Cloud with CloudFox", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/enumerating-cloud-with-cloudfox/SKILL.md", "slug": "Enumerating Cloud with CloudFox" }, "description": "Map AWS and Azure attack paths and find exploitable misconfigurations with", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:eradicating-malware-from-infected-systems", "kind": "leaf", "title": "Eradicating Malware from Infected Systems", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/eradicating-malware-from-infected-systems/SKILL.md", "slug": "Eradicating Malware from Infected Systems" }, "description": "Systematically remove malware, backdoors, and attacker persistence mechanisms", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:event-sourcing-architect", "kind": "leaf", "title": "Event Sourcing Architect", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/event-sourcing-architect/SKILL.md", "slug": "event-sourcing-architect" }, "description": "Expert in event sourcing, CQRS, and event-driven architecture patterns. Use when building systems requiring audit trails, temporal queries, complex domain modeling, or separating read and write models for performance.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:event-store-design", "kind": "leaf", "title": "Event Store Design", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/event-store-design/SKILL.md", "slug": "event-store-design" }, "description": "Design and implement event stores for event-sourced systems. Use when building event sourcing infrastructure, choosing event store technologies, or implementing event persistence patterns.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:executing-active-directory-attack-simulation", "kind": "leaf", "title": "Executing Active Directory Attack Simulation", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/executing-active-directory-attack-simulation/SKILL.md", "slug": "Executing Active Directory Attack Simulation" }, "description": "Executes authorized attack simulations against Active Directory environments", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:executing-nist-rmf-authorization-to-operate", "kind": "leaf", "title": "Executing the NIST RMF to an Authorization to Operate (ATO)", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/executing-nist-rmf-authorization-to-operate/SKILL.md", "slug": "Executing the NIST RMF to an Authorization to Operate (ATO)" }, "description": "NIST SP 800-37 Rev 2 defines **seven steps**. Prepare is the foundation; the rest run in order and then loop through Monitor.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:executing-red-team-engagement-planning", "kind": "leaf", "title": "Executing Red Team Engagement Planning", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/executing-red-team-engagement-planning/SKILL.md", "slug": "Executing Red Team Engagement Planning" }, "description": "Red team engagement planning is the foundational phase that defines scope,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:executing-red-team-exercise", "kind": "leaf", "title": "Executing Red Team Exercise", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/executing-red-team-exercise/SKILL.md", "slug": "Executing Red Team Exercise" }, "description": "Executes comprehensive red team exercises that simulate real-world adversary", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:exploiting-active-directory-certificate-services-esc1", "kind": "leaf", "title": "Exploiting Active Directory Certificate Services ESC1", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/exploiting-active-directory-certificate-services-esc1/SKILL.md", "slug": "Exploiting Active Directory Certificate Services ESC1" }, "description": "Exploit misconfigured Active Directory Certificate Services (AD CS) ESC1", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:exploiting-active-directory-with-bloodhound", "kind": "leaf", "title": "Exploiting Active Directory with BloodHound", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/exploiting-active-directory-with-bloodhound/SKILL.md", "slug": "Exploiting Active Directory with BloodHound" }, "description": "BloodHound is a graph-based Active Directory reconnaissance tool that", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:exploiting-adcs-with-certipy", "kind": "leaf", "title": "Exploiting AD CS with Certipy", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/exploiting-adcs-with-certipy/SKILL.md", "slug": "Exploiting AD CS with Certipy" }, "description": "Enumerate and exploit Active Directory Certificate Services ESC1 through ESC16 misconfigurations with Certipy, including SAN abuse, NTLM relay to web enrollment (ESC8), and golden certificate forgery.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:exploiting-aws-with-pacu", "kind": "leaf", "title": "Exploiting AWS with Pacu", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/exploiting-aws-with-pacu/SKILL.md", "slug": "Exploiting AWS with Pacu" }, "description": "Use Pacu modules for AWS privilege escalation, persistence, and backdooring.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:exploiting-broken-function-level-authorization", "kind": "leaf", "title": "Exploiting Broken Function Level Authorization", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/exploiting-broken-function-level-authorization/SKILL.md", "slug": "Exploiting Broken Function Level Authorization" }, "description": "Tests APIs for Broken Function Level Authorization (BFLA) vulnerabilities", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:exploiting-broken-link-hijacking", "kind": "leaf", "title": "Exploiting Broken Link Hijacking", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/exploiting-broken-link-hijacking/SKILL.md", "slug": "Exploiting Broken Link Hijacking" }, "description": "Discover and exploit broken link hijacking vulnerabilities by identifying", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:exploiting-constrained-delegation-abuse", "kind": "leaf", "title": "Exploiting Constrained Delegation Abuse", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/exploiting-constrained-delegation-abuse/SKILL.md", "slug": "Exploiting Constrained Delegation Abuse" }, "description": "Exploit Kerberos Constrained Delegation misconfigurations in Active Directory", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:exploiting-http-request-smuggling", "kind": "leaf", "title": "Exploiting HTTP Request Smuggling", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/exploiting-http-request-smuggling/SKILL.md", "slug": "Exploiting HTTP Request Smuggling" }, "description": "Detecting and exploiting HTTP request smuggling vulnerabilities caused", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:exploiting-insecure-deserialization", "kind": "leaf", "title": "Exploiting Insecure Deserialization", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/exploiting-insecure-deserialization/SKILL.md", "slug": "Exploiting Insecure Deserialization" }, "description": "Identifying and exploiting insecure deserialization vulnerabilities in", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:exploiting-kerberoasting-with-impacket", "kind": "leaf", "title": "Exploiting Kerberoasting with Impacket", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/exploiting-kerberoasting-with-impacket/SKILL.md", "slug": "Exploiting Kerberoasting with Impacket" }, "description": "Perform Kerberoasting attacks using Impacket's GetUserSPNs to extract", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:exploiting-ms17-010-eternalblue-vulnerability", "kind": "leaf", "title": "Exploiting MS17-010 EternalBlue Vulnerability", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/exploiting-ms17-010-eternalblue-vulnerability/SKILL.md", "slug": "Exploiting MS17-010 EternalBlue Vulnerability" }, "description": "MS17-010 (EternalBlue) is a critical vulnerability in Microsoft's SMBv1", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:exploiting-nopac-cve-2021-42278-42287", "kind": "leaf", "title": "Exploiting noPac (CVE-2021-42278 / CVE-2021-42287)", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/exploiting-nopac-cve-2021-42278-42287/SKILL.md", "slug": "Exploiting noPac (CVE-2021-42278 / CVE-2021-42287)" }, "description": "Exploit the noPac vulnerability chain (CVE-2021-42278 sAMAccountName", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:exploiting-oauth-misconfiguration", "kind": "leaf", "title": "Exploiting OAuth Misconfiguration", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/exploiting-oauth-misconfiguration/SKILL.md", "slug": "Exploiting OAuth Misconfiguration" }, "description": "Identifying and exploiting OAuth 2.0 and OpenID Connect misconfigurations", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:exploiting-race-condition-vulnerabilities", "kind": "leaf", "title": "Exploiting Race Condition Vulnerabilities", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/exploiting-race-condition-vulnerabilities/SKILL.md", "slug": "Exploiting Race Condition Vulnerabilities" }, "description": "Detect and exploit race condition vulnerabilities in web applications", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:exploiting-smb-vulnerabilities-with-metasploit", "kind": "leaf", "title": "Exploiting SMB Vulnerabilities with Metasploit", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/exploiting-smb-vulnerabilities-with-metasploit/SKILL.md", "slug": "Exploiting SMB Vulnerabilities with Metasploit" }, "description": "Identifies and exploits SMB protocol vulnerabilities using Metasploit", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:exploiting-zerologon-vulnerability-cve-2020-1472", "kind": "leaf", "title": "Exploiting Zerologon Vulnerability (CVE-2020-1472)", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/exploiting-zerologon-vulnerability-cve-2020-1472/SKILL.md", "slug": "Exploiting Zerologon Vulnerability (CVE-2020-1472)" }, "description": "Exploit the Zerologon vulnerability (CVE-2020-1472) in the Netlogon Remote", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:extracting-config-from-agent-tesla-rat", "kind": "leaf", "title": "Extracting Config from Agent Tesla RAT", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/extracting-config-from-agent-tesla-rat/SKILL.md", "slug": "Extracting Config from Agent Tesla RAT" }, "description": "Extract embedded configuration from Agent Tesla RAT samples including", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:extracting-iocs-from-malware-samples", "kind": "leaf", "title": "Extracting IOCs from Malware Samples", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/extracting-iocs-from-malware-samples/SKILL.md", "slug": "Extracting IOCs from Malware Samples" }, "description": "Extracts indicators of compromise (IOCs) from malware samples including", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:extracting-memory-artifacts-with-rekall", "kind": "leaf", "title": "Extracting Memory Artifacts with Rekall", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/extracting-memory-artifacts-with-rekall/SKILL.md", "slug": "Extracting Memory Artifacts with Rekall" }, "description": "Uses Rekall memory forensics framework to analyze memory dumps for process", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:feature-flags-architect", "kind": "leaf", "title": "Feature Flags Architect", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/feature-flags-architect/SKILL.md", "slug": "feature-flags-architect" }, "description": "Use when adding, retiring, or auditing feature flags. Triggers on \"add a flag\", \"ship behind a flag\", \"rollout plan\", \"kill switch\", \"stale flags\", \"flag debt\", or any progressive-delivery question. Treats flags as a controlled lifecycle with measurable debt — classify, ship, ramp, retire.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:generating-threat-intelligence-reports", "kind": "leaf", "title": "Generating Threat Intelligence Reports", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/generating-threat-intelligence-reports/SKILL.md", "slug": "Generating Threat Intelligence Reports" }, "description": "Generates structured cyber threat intelligence reports at strategic,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:git-worktree-manager", "kind": "leaf", "title": "Git Worktree Manager", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/git-worktree-manager/SKILL.md", "slug": "git-worktree-manager" }, "description": "Run parallel feature work safely with Git worktrees. Standardizes branch isolation, port allocation, environment sync, and cleanup so each worktree behaves like an independent local app. Optimized for multi-agent workflows where each agent or terminal session owns one worktree. Use when running multiple feature branches simultaneously, isolating experimental work, or coordinating multi-agent development across the same repo.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:github-actions-templates", "kind": "leaf", "title": "GitHub Actions Templates", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/github-actions-templates/SKILL.md", "slug": "github-actions-templates" }, "description": "Create production-ready GitHub Actions workflows for automated testing, building, and deploying. Use when setting up CI/CD with GitHub Actions, automating development workflows, or creating reusable workflow templates.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:github-deep-research", "kind": "leaf", "title": "github-deep-research", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/github-deep-research/SKILL.md", "slug": "github-deep-research" }, "description": "Conduct multi-round deep research on any GitHub Repo. Use when users request comprehensive analysis, timeline reconstruction, competitive analysis, or in-depth investigation of GitHub. Produces structured markdown reports with executive summaries, chronological timelines, metrics analysis, and Mermaid diagrams. Triggers on Github repository URL or open source projects.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:gitlab-ci-patterns", "kind": "leaf", "title": "GitLab CI Patterns", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/gitlab-ci-patterns/SKILL.md", "slug": "gitlab-ci-patterns" }, "description": "Build GitLab CI/CD pipelines with multi-stage workflows, caching, and deployment. Use when implementing GitLab CI/CD, optimizing pipeline performance, setting up automated testing/deployment, or implementing GitOps with GitLab.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:gitops-workflow", "kind": "leaf", "title": "GitOps Workflow", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/gitops-workflow/SKILL.md", "slug": "gitops-workflow" }, "description": "Implement GitOps workflows with ArgoCD and Flux for automated, declarative Kubernetes deployments. Use when implementing GitOps practices, automating Kubernetes deployments, setting up declarative infrastructure management, or configuring continuous reconciliation. Covers ArgoCD, Flux CD, sync policies, progressive delivery, and secret management.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:gpu-acceleration-python", "kind": "leaf", "title": "GPU Acceleration for Python", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/gpu-acceleration-python/SKILL.md", "slug": "gpu-acceleration-python" }, "description": "GPU-accelerate Python code using CuPy, Numba CUDA, Warp, cuDF, cuML, cuGraph, and the NVIDIA RAPIDS ecosystem. Use whenever the user mentions GPU/CUDA/NVIDIA acceleration, or wants to speed up NumPy, pandas, scikit-learn, NetworkX, or image processing workloads. Covers physics simulation, differentiable rendering, particle systems, vector search, and interactive dashboards.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:grafana-dashboards", "kind": "leaf", "title": "Grafana Dashboards", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/grafana-dashboards/SKILL.md", "slug": "grafana-dashboards" }, "description": "Create and manage production Grafana dashboards for real-time visualization of system and application metrics. Use when building monitoring dashboards, visualizing metrics, or creating operational observability interfaces.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:grill-me", "kind": "leaf", "title": "grill-me", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/grill-me/SKILL.md", "slug": "grill-me" }, "description": "A relentless interview to sharpen a plan or design.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:grill-with-docs", "kind": "leaf", "title": "grill-with-docs", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/grill-with-docs/SKILL.md", "slug": "grill-with-docs" }, "description": "A relentless interview to sharpen a plan or design, which also creates docs (ADR's and glossary) as we go.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:gstack-upgrade", "kind": "leaf", "title": "gstack-upgrade", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/gstack-upgrade/SKILL.md", "slug": "gstack-upgrade" }, "description": "Upgrade gstack to the latest version.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:hackernews-frontpage", "kind": "leaf", "title": "Hacker News front-page scraper", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/hackernews-frontpage/SKILL.md", "slug": "hackernews-frontpage" }, "description": "Scrape the Hacker News front page (titles, points, comment counts).", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:hardening-docker-daemon-configuration", "kind": "leaf", "title": "Hardening Docker Daemon Configuration", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/hardening-docker-daemon-configuration/SKILL.md", "slug": "Hardening Docker Daemon Configuration" }, "description": "Harden the Docker daemon by configuring daemon.json with user namespace", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:health", "kind": "leaf", "title": "health", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/health/SKILL.md", "slug": "health" }, "description": "Code quality dashboard. (gstack)", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:helm-chart-builder", "kind": "leaf", "title": "Helm Chart Builder", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/helm-chart-builder/SKILL.md", "slug": "helm-chart-builder" }, "description": "Production-grade Helm chart development — chart scaffolding, values design, template patterns, dependency management, security hardening, and chart testing. Use when creating or improving Helm charts, designing values.yaml, implementing template helpers, auditing chart security (RBAC, network policies, pod security), managing subcharts, or running helm lint/test.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:hr-pro", "kind": "leaf", "title": "HR-Pro", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/hr-pro/SKILL.md", "slug": "hr-pro" }, "description": "Professional, ethical HR partner for hiring, onboarding/offboarding, PTO and leave, performance management, compliant policies, and employee relations. Compliance-first with jurisdiction-aware guidance.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:hunting-advanced-persistent-threats", "kind": "leaf", "title": "Hunting Advanced Persistent Threats", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/hunting-advanced-persistent-threats/SKILL.md", "slug": "Hunting Advanced Persistent Threats" }, "description": "Proactively hunts for Advanced Persistent Threat (APT) activity within", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:hunting-bootkits-in-efi-system-partition", "kind": "leaf", "title": "Hunting Bootkits in the EFI System Partition", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/hunting-bootkits-in-efi-system-partition/SKILL.md", "slug": "Hunting Bootkits in the EFI System Partition" }, "description": "Baseline the EFI System Partition and hunt malicious EFI binaries (ESPecter, BlackLotus, Bootkitty, Glupteba) by mounting the ESP, hashing and verifying boot loaders, scanning with YARA, and detecting anomalous non-EFI files.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:hunting-evtx-with-chainsaw", "kind": "leaf", "title": "Hunting EVTX with Chainsaw", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/hunting-evtx-with-chainsaw/SKILL.md", "slug": "Hunting EVTX with Chainsaw" }, "description": "Perform rapid Sigma and keyword hunting across Windows event logs with", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:hunting-for-anomalous-powershell-execution", "kind": "leaf", "title": "Hunting for Anomalous PowerShell Execution", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/hunting-for-anomalous-powershell-execution/SKILL.md", "slug": "Hunting for Anomalous PowerShell Execution" }, "description": "Hunt for malicious PowerShell activity by analyzing Script Block Logging", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:hunting-for-beaconing-with-frequency-analysis", "kind": "leaf", "title": "Hunting for Beaconing with Frequency Analysis", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/hunting-for-beaconing-with-frequency-analysis/SKILL.md", "slug": "Hunting for Beaconing with Frequency Analysis" }, "description": "Identify command-and-control beaconing patterns in network traffic by", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:hunting-for-cobalt-strike-beacons", "kind": "leaf", "title": "Hunting for Cobalt Strike Beacons", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/hunting-for-cobalt-strike-beacons/SKILL.md", "slug": "Hunting for Cobalt Strike Beacons" }, "description": "Detect Cobalt Strike beacon network activity using default TLS certificate", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:hunting-for-command-and-control-beaconing", "kind": "leaf", "title": "Hunting for Command and Control Beaconing", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/hunting-for-command-and-control-beaconing/SKILL.md", "slug": "Hunting for Command and Control Beaconing" }, "description": "Detect C2 beaconing patterns in network traffic using frequency analysis,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:hunting-for-data-exfiltration-indicators", "kind": "leaf", "title": "Hunting for Data Exfiltration Indicators", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/hunting-for-data-exfiltration-indicators/SKILL.md", "slug": "Hunting for Data Exfiltration Indicators" }, "description": "Hunt for data exfiltration through network traffic analysis, detecting", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:hunting-for-dcom-lateral-movement", "kind": "leaf", "title": "Hunting for DCOM Lateral Movement", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/hunting-for-dcom-lateral-movement/SKILL.md", "slug": "Hunting for DCOM Lateral Movement" }, "description": "Hunt for DCOM-based lateral movement by detecting abuse of MMC20.Application,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:hunting-for-dcsync-attacks", "kind": "leaf", "title": "Hunting for DCSync Attacks", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/hunting-for-dcsync-attacks/SKILL.md", "slug": "Hunting for DCSync Attacks" }, "description": "Detect DCSync attacks by analyzing Windows Event ID 4662 for unauthorized", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:hunting-for-defense-evasion-via-timestomping", "kind": "leaf", "title": "Hunting for Defense Evasion via Timestomping", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/hunting-for-defense-evasion-via-timestomping/SKILL.md", "slug": "Hunting for Defense Evasion via Timestomping" }, "description": "Detect NTFS timestamp manipulation (MITRE T1070.006) by comparing $STANDARD_INFORMATION", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:hunting-for-dns-tunneling-with-zeek", "kind": "leaf", "title": "Hunting for DNS Tunneling with Zeek", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/hunting-for-dns-tunneling-with-zeek/SKILL.md", "slug": "Hunting for DNS Tunneling with Zeek" }, "description": "Detect DNS tunneling and data exfiltration by analyzing Zeek dns.log", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:hunting-for-domain-fronting-c2-traffic", "kind": "leaf", "title": "Hunting for Domain Fronting C2 Traffic", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/hunting-for-domain-fronting-c2-traffic/SKILL.md", "slug": "Hunting for Domain Fronting C2 Traffic" }, "description": "Detect domain fronting C2 traffic by analyzing SNI vs HTTP Host header", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:hunting-for-lateral-movement-via-wmi", "kind": "leaf", "title": "Hunting for Lateral Movement via WMI", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/hunting-for-lateral-movement-via-wmi/SKILL.md", "slug": "Hunting for Lateral Movement via WMI" }, "description": "Detect WMI-based lateral movement by analyzing Windows Event ID 4688", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:hunting-for-living-off-the-cloud-techniques", "kind": "leaf", "title": "Hunting For Living Off The Cloud Techniques", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/hunting-for-living-off-the-cloud-techniques/SKILL.md", "slug": "Hunting For Living Off The Cloud Techniques" }, "description": "Hunt for adversary abuse of legitimate cloud services for C2, data staging,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:hunting-for-living-off-the-land-binaries", "kind": "leaf", "title": "Hunting for Living-off-the-Land Binaries (LOLBins)", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/hunting-for-living-off-the-land-binaries/SKILL.md", "slug": "Hunting for Living-off-the-Land Binaries (LOLBins)" }, "description": "Proactively hunt for adversary abuse of legitimate system binaries (LOLBins)", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:hunting-for-lolbins-execution-in-endpoint-logs", "kind": "leaf", "title": "Hunting for LOLBins Execution in Endpoint Logs", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/hunting-for-lolbins-execution-in-endpoint-logs/SKILL.md", "slug": "Hunting for LOLBins Execution in Endpoint Logs" }, "description": "Hunt for adversary abuse of Living Off the Land Binaries (LOLBins) by", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:hunting-for-persistence-mechanisms-in-windows", "kind": "leaf", "title": "Hunting for Persistence Mechanisms in Windows", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/hunting-for-persistence-mechanisms-in-windows/SKILL.md", "slug": "Hunting for Persistence Mechanisms in Windows" }, "description": "Systematically hunt for adversary persistence mechanisms across Windows", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:hunting-for-persistence-via-wmi-subscriptions", "kind": "leaf", "title": "Hunting for Persistence via WMI Subscriptions", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/hunting-for-persistence-via-wmi-subscriptions/SKILL.md", "slug": "Hunting for Persistence via WMI Subscriptions" }, "description": "Hunt for adversary persistence through Windows Management Instrumentation", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:hunting-for-registry-persistence-mechanisms", "kind": "leaf", "title": "Hunting For Registry Persistence Mechanisms", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/hunting-for-registry-persistence-mechanisms/SKILL.md", "slug": "Hunting For Registry Persistence Mechanisms" }, "description": "Hunt for registry-based persistence mechanisms including Run keys, Winlogon", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:hunting-for-scheduled-task-persistence", "kind": "leaf", "title": "Hunting For Scheduled Task Persistence", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/hunting-for-scheduled-task-persistence/SKILL.md", "slug": "Hunting For Scheduled Task Persistence" }, "description": "Hunt for adversary persistence via Windows Scheduled Tasks by analyzing", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:hunting-for-shadow-copy-deletion", "kind": "leaf", "title": "Hunting For Shadow Copy Deletion", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/hunting-for-shadow-copy-deletion/SKILL.md", "slug": "Hunting For Shadow Copy Deletion" }, "description": "Hunt for Volume Shadow Copy deletion activity that indicates ransomware", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:hunting-for-spearphishing-indicators", "kind": "leaf", "title": "Hunting For Spearphishing Indicators", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/hunting-for-spearphishing-indicators/SKILL.md", "slug": "Hunting For Spearphishing Indicators" }, "description": "Hunt for spearphishing campaign indicators across email logs, endpoint", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:hunting-for-supply-chain-compromise", "kind": "leaf", "title": "Hunting For Supply Chain Compromise", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/hunting-for-supply-chain-compromise/SKILL.md", "slug": "Hunting For Supply Chain Compromise" }, "description": "Hunt for supply chain compromise indicators including trojanized software", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:hunting-for-suspicious-scheduled-tasks", "kind": "leaf", "title": "Hunting for Suspicious Scheduled Tasks", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/hunting-for-suspicious-scheduled-tasks/SKILL.md", "slug": "Hunting for Suspicious Scheduled Tasks" }, "description": "Hunt for adversary persistence and execution via Windows scheduled tasks", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:hunting-for-unusual-network-connections", "kind": "leaf", "title": "Hunting For Unusual Network Connections", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/hunting-for-unusual-network-connections/SKILL.md", "slug": "Hunting For Unusual Network Connections" }, "description": "Hunt for unusual network connections by analyzing outbound traffic patterns,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:hunting-for-webshell-activity", "kind": "leaf", "title": "Hunting For Webshell Activity", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/hunting-for-webshell-activity/SKILL.md", "slug": "Hunting For Webshell Activity" }, "description": "Hunt for web shell deployments on internet-facing servers by analyzing", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:hunting-saas-sso-token-abuse", "kind": "leaf", "title": "Hunting SaaS SSO Token Abuse", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/hunting-saas-sso-token-abuse/SKILL.md", "slug": "Hunting SaaS SSO Token Abuse" }, "description": "Detect SSO and OAuth token replay and SaaS lateral movement.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:i18n-localization", "kind": "leaf", "title": "i18n & Localization", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/i18n-localization/SKILL.md", "slug": "i18n-localization" }, "description": "Internationalization and localization patterns. Detecting hardcoded strings, managing translations, locale files, RTL support. Use when making a web app translatable, managing multi-language content, or implementing RTL language support.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implement", "kind": "leaf", "title": "implement", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implement/SKILL.md", "slug": "implement" }, "description": "Implement a piece of work based on a PRD or set of issues.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-alert-fatigue-reduction", "kind": "leaf", "title": "Implementing Alert Fatigue Reduction", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-alert-fatigue-reduction/SKILL.md", "slug": "Implementing Alert Fatigue Reduction" }, "description": "Implements strategies to reduce SOC alert fatigue by tuning detection", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-anti-phishing-training-program", "kind": "leaf", "title": "Implementing Anti-Phishing Training Program", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-anti-phishing-training-program/SKILL.md", "slug": "Implementing Anti-Phishing Training Program" }, "description": "Security awareness training is the human layer of phishing defense. An", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-anti-ransomware-group-policy", "kind": "leaf", "title": "Implementing Anti-Ransomware Group Policy", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-anti-ransomware-group-policy/SKILL.md", "slug": "Implementing Anti-Ransomware Group Policy" }, "description": "Configures Windows Group Policy Objects (GPO) to prevent ransomware", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-attack-path-analysis-with-xm-cyber", "kind": "leaf", "title": "Implementing Attack Path Analysis with XM Cyber", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-attack-path-analysis-with-xm-cyber/SKILL.md", "slug": "Implementing Attack Path Analysis with XM Cyber" }, "description": "Deploy XM Cyber's continuous exposure management platform to map attack", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-aws-nitro-enclave-security", "kind": "leaf", "title": "Implementing AWS Nitro Enclave Security", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-aws-nitro-enclave-security/SKILL.md", "slug": "Implementing AWS Nitro Enclave Security" }, "description": "Implements AWS Nitro Enclave-based confidential computing environments", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-beyondcorp-zero-trust-access-model", "kind": "leaf", "title": "Implementing BeyondCorp Zero Trust Access Model", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-beyondcorp-zero-trust-access-model/SKILL.md", "slug": "Implementing BeyondCorp Zero Trust Access Model" }, "description": "Implementing Google''s BeyondCorp zero trust access model to eliminate", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-browser-isolation-for-zero-trust", "kind": "leaf", "title": "Implementing Browser Isolation for Zero Trust", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-browser-isolation-for-zero-trust/SKILL.md", "slug": "Implementing Browser Isolation for Zero Trust" }, "description": "Deploys remote browser isolation (RBI) as a core component of a Zero", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-canary-tokens-for-network-intrusion", "kind": "leaf", "title": "Implementing Canary Tokens for Network Intrusion Detection", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-canary-tokens-for-network-intrusion/SKILL.md", "slug": "Implementing Canary Tokens for Network Intrusion Detection" }, "description": "Deploys DNS, HTTP, and AWS API key canary tokens across network infrastructure", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-cisa-zero-trust-maturity-model", "kind": "leaf", "title": "Implementing CISA Zero Trust Maturity Model", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-cisa-zero-trust-maturity-model/SKILL.md", "slug": "Implementing CISA Zero Trust Maturity Model" }, "description": "Implement the CISA Zero Trust Maturity Model v2.0 across the five pillars", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-container-image-minimal-base-with-distroless", "kind": "leaf", "title": "Implementing Container Image Minimal Base with Distroless", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-container-image-minimal-base-with-distroless/SKILL.md", "slug": "Implementing Container Image Minimal Base with Distroless" }, "description": "Reduce container attack surface by building application images on Google", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-continuous-security-validation-with-bas", "kind": "leaf", "title": "Implementing Continuous Security Validation with BAS", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-continuous-security-validation-with-bas/SKILL.md", "slug": "Implementing Continuous Security Validation with BAS" }, "description": "Deploy Breach and Attack Simulation tools to continuously validate security", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-devsecops-security-scanning", "kind": "leaf", "title": "Implementing DevSecOps Security Scanning", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-devsecops-security-scanning/SKILL.md", "slug": "Implementing DevSecOps Security Scanning" }, "description": "Integrates Static Application Security Testing (SAST), Dynamic Application", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-diamond-model-analysis", "kind": "leaf", "title": "Implementing Diamond Model Analysis", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-diamond-model-analysis/SKILL.md", "slug": "Implementing Diamond Model Analysis" }, "description": "The Diamond Model of Intrusion Analysis provides a structured framework", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-dmarc-dkim-spf-email-security", "kind": "leaf", "title": "Implementing DMARC, DKIM, and SPF Email Security", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-dmarc-dkim-spf-email-security/SKILL.md", "slug": "Implementing DMARC, DKIM, and SPF Email Security" }, "description": "SPF, DKIM, and DMARC form the three pillars of email authentication.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-dragos-platform-for-ot-monitoring", "kind": "leaf", "title": "Implementing Dragos Platform for OT Monitoring", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-dragos-platform-for-ot-monitoring/SKILL.md", "slug": "Implementing Dragos Platform for OT Monitoring" }, "description": "Deploy and configure the Dragos Platform for OT network monitoring,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-ebpf-security-monitoring", "kind": "leaf", "title": "Implementing eBPF Security Monitoring", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-ebpf-security-monitoring/SKILL.md", "slug": "Implementing eBPF Security Monitoring" }, "description": "Implements eBPF-based security monitoring using Cilium Tetragon for", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-email-sandboxing-with-proofpoint", "kind": "leaf", "title": "Implementing Email Sandboxing with Proofpoint", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-email-sandboxing-with-proofpoint/SKILL.md", "slug": "Implementing Email Sandboxing with Proofpoint" }, "description": "Email sandboxing detonates suspicious attachments and URLs in isolated", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-google-workspace-phishing-protection", "kind": "leaf", "title": "Implementing Google Workspace Phishing Protection", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-google-workspace-phishing-protection/SKILL.md", "slug": "Implementing Google Workspace Phishing Protection" }, "description": "Configure Google Workspace advanced phishing and malware protection settings", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-hardware-security-key-authentication", "kind": "leaf", "title": "Implementing Hardware Security Key Authentication", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-hardware-security-key-authentication/SKILL.md", "slug": "Implementing Hardware Security Key Authentication" }, "description": "Implements FIDO2/WebAuthn hardware security key authentication including", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-hipaa-security-rule-safeguards", "kind": "leaf", "title": "Implementing HIPAA Security Rule Safeguards", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-hipaa-security-rule-safeguards/SKILL.md", "slug": "Implementing HIPAA Security Rule Safeguards" }, "description": "This is **required** and foundational. Inventory ePHI and systems, identify threats and vulnerabilities, assess current controls, determine likelihood and impact, and assign risk levels. (Pair with the NIST 800-30 methodology and HHS's SRA Tool.) Output is a documented, dated risk analysis — the artifact OCR asks for first.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-honeypot-for-ransomware-detection", "kind": "leaf", "title": "Implementing Honeypot for Ransomware Detection", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-honeypot-for-ransomware-detection/SKILL.md", "slug": "Implementing Honeypot for Ransomware Detection" }, "description": "Deploys canary files, honeypot shares, and decoy systems to detect ransomware", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-identity-verification-for-zero-trust", "kind": "leaf", "title": "Implementing Identity Verification for Zero Trust", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-identity-verification-for-zero-trust/SKILL.md", "slug": "Implementing Identity Verification for Zero Trust" }, "description": "Implement continuous identity verification for zero trust using phishing-resistant", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-iec-62443-security-zones", "kind": "leaf", "title": "Implementing IEC 62443 Security Zones", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-iec-62443-security-zones/SKILL.md", "slug": "Implementing IEC 62443 Security Zones" }, "description": "This skill covers designing and implementing security zones and conduits", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-immutable-backup-with-restic", "kind": "leaf", "title": "Implementing Immutable Backup with Restic", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-immutable-backup-with-restic/SKILL.md", "slug": "Implementing Immutable Backup with Restic" }, "description": "Implements immutable backup strategy using restic with S3-compatible", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-llm-guardrails-for-security", "kind": "leaf", "title": "Implementing LLM Guardrails for Security", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-llm-guardrails-for-security/SKILL.md", "slug": "Implementing LLM Guardrails for Security" }, "description": "Implements input and output validation guardrails for LLM-powered applications", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-log-integrity-with-blockchain", "kind": "leaf", "title": "Implementing Log Integrity with Blockchain", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-log-integrity-with-blockchain/SKILL.md", "slug": "Implementing Log Integrity with Blockchain" }, "description": "Build an append-only log integrity chain using SHA-256 hash chaining", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-microsegmentation-with-guardicore", "kind": "leaf", "title": "Implementing Microsegmentation with Guardicore", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-microsegmentation-with-guardicore/SKILL.md", "slug": "Implementing Microsegmentation with Guardicore" }, "description": "Implementing microsegmentation using Akamai Guardicore Segmentation", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-mimecast-targeted-attack-protection", "kind": "leaf", "title": "Implementing Mimecast Targeted Attack Protection", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-mimecast-targeted-attack-protection/SKILL.md", "slug": "Implementing Mimecast Targeted Attack Protection" }, "description": "Deploy Mimecast Targeted Threat Protection including URL Protect, Attachment", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-mitre-attack-coverage-mapping", "kind": "leaf", "title": "Implementing MITRE ATT&CK Coverage Mapping", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-mitre-attack-coverage-mapping/SKILL.md", "slug": "Implementing MITRE ATT&CK Coverage Mapping" }, "description": "Implement MITRE ATT&CK coverage mapping to identify detection gaps, prioritize", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-nerc-cip-compliance-controls", "kind": "leaf", "title": "Implementing NERC CIP Compliance Controls", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-nerc-cip-compliance-controls/SKILL.md", "slug": "Implementing NERC CIP Compliance Controls" }, "description": "This skill covers implementing North American Electric Reliability Corporation", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-network-access-control", "kind": "leaf", "title": "Implementing Network Access Control", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-network-access-control/SKILL.md", "slug": "Implementing Network Access Control" }, "description": "Implements 802.1X port-based network access control using RADIUS authentication,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-network-deception-with-honeypots", "kind": "leaf", "title": "Implementing Network Deception with Honeypots", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-network-deception-with-honeypots/SKILL.md", "slug": "Implementing Network Deception with Honeypots" }, "description": "Deploy and manage network honeypots using OpenCanary, T-Pot, or Cowrie", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-network-intrusion-prevention-with-suricata", "kind": "leaf", "title": "Implementing Network Intrusion Prevention with Suricata", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-network-intrusion-prevention-with-suricata/SKILL.md", "slug": "Implementing Network Intrusion Prevention with Suricata" }, "description": "Deploy and configure Suricata as a network intrusion prevention system", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-network-policies-for-kubernetes", "kind": "leaf", "title": "Implementing Network Policies for Kubernetes", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-network-policies-for-kubernetes/SKILL.md", "slug": "Implementing Network Policies for Kubernetes" }, "description": "Kubernetes NetworkPolicies provide pod-level network segmentation by", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-network-segmentation-for-ot", "kind": "leaf", "title": "Implementing Network Segmentation for OT", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-network-segmentation-for-ot/SKILL.md", "slug": "Implementing Network Segmentation for OT" }, "description": "This skill covers implementing network segmentation in Operational Technology", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-network-segmentation-with-firewall-zones", "kind": "leaf", "title": "Implementing Network Segmentation with Firewall Zones", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-network-segmentation-with-firewall-zones/SKILL.md", "slug": "Implementing Network Segmentation with Firewall Zones" }, "description": "Design and implement network segmentation using firewall security zones,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-network-traffic-analysis-with-arkime", "kind": "leaf", "title": "Implementing Network Traffic Analysis with Arkime", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-network-traffic-analysis-with-arkime/SKILL.md", "slug": "Implementing Network Traffic Analysis with Arkime" }, "description": "Deploy and query Arkime (formerly Moloch) for full packet capture network", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-network-traffic-baselining", "kind": "leaf", "title": "Implementing Network Traffic Baselining", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-network-traffic-baselining/SKILL.md", "slug": "Implementing Network Traffic Baselining" }, "description": "Build network traffic baselines from NetFlow/IPFIX data using Python", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-next-generation-firewall-with-palo-alto", "kind": "leaf", "title": "Implementing Next-Generation Firewall with Palo Alto", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-next-generation-firewall-with-palo-alto/SKILL.md", "slug": "Implementing Next-Generation Firewall with Palo Alto" }, "description": "Configure and deploy Palo Alto Networks next-generation firewalls with", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-ot-incident-response-playbook", "kind": "leaf", "title": "Implementing OT Incident Response Playbook", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-ot-incident-response-playbook/SKILL.md", "slug": "Implementing OT Incident Response Playbook" }, "description": "Develop and implement OT-specific incident response playbooks aligned", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-passwordless-auth-with-microsoft-entra", "kind": "leaf", "title": "Implementing Passwordless Auth with Microsoft Entra", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-passwordless-auth-with-microsoft-entra/SKILL.md", "slug": "Implementing Passwordless Auth with Microsoft Entra" }, "description": "Implements passwordless authentication using Microsoft Entra ID with", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-policy-as-code-with-open-policy-agent", "kind": "leaf", "title": "Implementing Policy as Code with Open Policy Agent", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-policy-as-code-with-open-policy-agent/SKILL.md", "slug": "Implementing Policy as Code with Open Policy Agent" }, "description": "This skill covers implementing Open Policy Agent (OPA) and Gatekeeper", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-privileged-session-monitoring", "kind": "leaf", "title": "Implementing Privileged Session Monitoring", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-privileged-session-monitoring/SKILL.md", "slug": "Implementing Privileged Session Monitoring" }, "description": "Implements privileged session monitoring and recording using Privileged", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-proofpoint-email-security-gateway", "kind": "leaf", "title": "Implementing Proofpoint Email Security Gateway", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-proofpoint-email-security-gateway/SKILL.md", "slug": "Implementing Proofpoint Email Security Gateway" }, "description": "Deploy and configure Proofpoint Email Protection as a secure email gateway", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-ransomware-backup-strategy", "kind": "leaf", "title": "Implementing Ransomware Backup Strategy", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-ransomware-backup-strategy/SKILL.md", "slug": "Implementing Ransomware Backup Strategy" }, "description": "Designs and implements a ransomware-resilient backup strategy following", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-ransomware-kill-switch-detection", "kind": "leaf", "title": "Implementing Ransomware Kill Switch Detection", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-ransomware-kill-switch-detection/SKILL.md", "slug": "Implementing Ransomware Kill Switch Detection" }, "description": "Detects and exploits ransomware kill switch mechanisms including mutex-based", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-rapid7-insightvm-for-scanning", "kind": "leaf", "title": "Implementing Rapid7 InsightVM for Scanning", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-rapid7-insightvm-for-scanning/SKILL.md", "slug": "Implementing Rapid7 InsightVM for Scanning" }, "description": "Deploy and configure Rapid7 InsightVM Security Console and Scan Engines", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-rbac-hardening-for-kubernetes", "kind": "leaf", "title": "Implementing RBAC Hardening for Kubernetes", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-rbac-hardening-for-kubernetes/SKILL.md", "slug": "Implementing RBAC Hardening for Kubernetes" }, "description": "Harden Kubernetes Role-Based Access Control by implementing least-privilege", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-security-chaos-engineering", "kind": "leaf", "title": "Implementing Security Chaos Engineering", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-security-chaos-engineering/SKILL.md", "slug": "Implementing Security Chaos Engineering" }, "description": "Implements security chaos engineering experiments that deliberately", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-security-information-sharing-with-stix2", "kind": "leaf", "title": "Implementing Security Information Sharing with STIX 2.1", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-security-information-sharing-with-stix2/SKILL.md", "slug": "Implementing Security Information Sharing with STIX 2.1" }, "description": "Create, validate, and share STIX 2.1 threat intelligence objects using", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-siem-correlation-rules-for-apt", "kind": "leaf", "title": "Implementing SIEM Correlation Rules for APT", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-siem-correlation-rules-for-apt/SKILL.md", "slug": "Implementing SIEM Correlation Rules for APT" }, "description": "Write multi-event correlation rules that detect APT lateral movement", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-siem-use-cases-for-detection", "kind": "leaf", "title": "Implementing SIEM Use Cases for Detection", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-siem-use-cases-for-detection/SKILL.md", "slug": "Implementing SIEM Use Cases for Detection" }, "description": "Implements SIEM detection use cases by designing correlation rules,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-sigstore-for-software-signing", "kind": "leaf", "title": "Implementing Sigstore for Software Signing", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-sigstore-for-software-signing/SKILL.md", "slug": "Implementing Sigstore for Software Signing" }, "description": "Implements Sigstore-based software signing and verification using Cosign", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-soar-automation-with-phantom", "kind": "leaf", "title": "Implementing SOAR Automation with Phantom", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-soar-automation-with-phantom/SKILL.md", "slug": "Implementing SOAR Automation with Phantom" }, "description": "Implements Security Orchestration, Automation, and Response (SOAR) workflows", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-soar-playbook-for-phishing", "kind": "leaf", "title": "Implementing SOAR Playbook for Phishing", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-soar-playbook-for-phishing/SKILL.md", "slug": "Implementing SOAR Playbook for Phishing" }, "description": "Automate phishing incident response using Splunk SOAR REST API to create", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-soar-playbook-with-palo-alto-xsoar", "kind": "leaf", "title": "Implementing SOAR Playbook with Palo Alto XSOAR", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-soar-playbook-with-palo-alto-xsoar/SKILL.md", "slug": "Implementing SOAR Playbook with Palo Alto XSOAR" }, "description": "Implement automated incident response playbooks in Cortex XSOAR to orchestrate", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-stix-taxii-feed-integration", "kind": "leaf", "title": "Implementing STIX/TAXII Feed Integration", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-stix-taxii-feed-integration/SKILL.md", "slug": "Implementing STIX/TAXII Feed Integration" }, "description": "STIX (Structured Threat Information eXpression) and TAXII (Trusted Automated", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-taxii-server-with-opentaxii", "kind": "leaf", "title": "Implementing TAXII Server with OpenTAXII", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-taxii-server-with-opentaxii/SKILL.md", "slug": "Implementing TAXII Server with OpenTAXII" }, "description": "Deploy and configure an OpenTAXII server to share and consume STIX-formatted", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-threat-intelligence-lifecycle-management", "kind": "leaf", "title": "Implementing Threat Intelligence Lifecycle Management", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-threat-intelligence-lifecycle-management/SKILL.md", "slug": "Implementing Threat Intelligence Lifecycle Management" }, "description": "Implement a structured threat intelligence lifecycle encompassing planning,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-threat-modeling-with-mitre-attack", "kind": "leaf", "title": "Implementing Threat Modeling with MITRE ATT&CK", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-threat-modeling-with-mitre-attack/SKILL.md", "slug": "Implementing Threat Modeling with MITRE ATT&CK" }, "description": "Implements threat modeling using the MITRE ATT&CK framework to map adversary", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-ticketing-system-for-incidents", "kind": "leaf", "title": "Implementing Ticketing System for Incidents", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-ticketing-system-for-incidents/SKILL.md", "slug": "Implementing Ticketing System for Incidents" }, "description": "Implements an integrated incident ticketing system connecting SIEM alerts", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-usb-device-control-policy", "kind": "leaf", "title": "Implementing USB Device Control Policy", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-usb-device-control-policy/SKILL.md", "slug": "Implementing USB Device Control Policy" }, "description": "Implements USB device control policies to restrict unauthorized removable", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-velociraptor-for-ir-collection", "kind": "leaf", "title": "Implementing Velociraptor for IR Collection", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-velociraptor-for-ir-collection/SKILL.md", "slug": "Implementing Velociraptor for IR Collection" }, "description": "Deploy and configure Velociraptor for scalable endpoint forensic artifact", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-zero-trust-dns-with-nextdns", "kind": "leaf", "title": "Implementing Zero Trust DNS with NextDNS", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-zero-trust-dns-with-nextdns/SKILL.md", "slug": "Implementing Zero Trust DNS with NextDNS" }, "description": "Implement NextDNS as a zero trust DNS filtering layer with encrypted", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:implementing-zero-trust-in-cloud", "kind": "leaf", "title": "Implementing Zero Trust in Cloud", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-zero-trust-in-cloud/SKILL.md", "slug": "Implementing Zero Trust in Cloud" }, "description": "This skill guides organizations through implementing zero trust architecture", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:incident-response", "kind": "leaf", "title": "Incident Response", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/incident-response/SKILL.md", "slug": "incident-response" }, "description": "Full lifecycle security incident triage: classify, escalate, collect evidence, notify regulators.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:insecure-defaults", "kind": "leaf", "title": "Insecure Defaults Detection", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/insecure-defaults/SKILL.md", "slug": "Insecure Defaults Detection" }, "description": "Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Distinguishes fail-open from fail-secure patterns. Use when auditing security, reviewing config management, or analyzing environment variable handling.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:integrating-dast-with-owasp-zap-in-pipeline", "kind": "leaf", "title": "Integrating DAST with OWASP ZAP in Pipeline", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/integrating-dast-with-owasp-zap-in-pipeline/SKILL.md", "slug": "Integrating DAST with OWASP ZAP in Pipeline" }, "description": "This skill covers integrating OWASP ZAP (Zed Attack Proxy) for Dynamic", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:interview-me", "kind": "leaf", "title": "Interview Me", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/interview-me/SKILL.md", "slug": "interview-me" }, "description": "Extracts what the user actually wants instead of what they think they should want. Achieves this through one-question-at-a-time interview until ~95% confidence about the underlying intent. Use when an ask is underspecified (\"build me X\" without \"for whom\" or \"why now\"), when the user explicitly invokes (\"interview me\", \"grill me\", \"are we sure?\", \"stress-test my thinking\"), or when you catch yourself silently filling in ambiguous requirements before any plan, spec, or code exists.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:investigate", "kind": "leaf", "title": "Investigate", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/investigate/SKILL.md", "slug": "Investigate" }, "description": "Systematic root-cause investigation and debugging. Use when asked to \"debug this\", \"fix this bug\", \"why is this broken\", or \"root cause analysis\". Covers evidence gathering, hypothesis testing, and fix verification.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:investigating-insider-threat-indicators", "kind": "leaf", "title": "Investigating Insider Threat Indicators", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/investigating-insider-threat-indicators/SKILL.md", "slug": "Investigating Insider Threat Indicators" }, "description": "Investigates insider threat indicators including data exfiltration attempts,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:investigating-phishing-email-incident", "kind": "leaf", "title": "Investigating Phishing Email Incident", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/investigating-phishing-email-incident/SKILL.md", "slug": "Investigating Phishing Email Incident" }, "description": "Investigates phishing email incidents from initial user report through", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:ios-clean", "kind": "leaf", "title": "ios-clean", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/ios-clean/SKILL.md", "slug": "ios-clean" }, "description": "Remove the DebugBridge SPM package and all", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:ios-fix", "kind": "leaf", "title": "ios-fix", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/ios-fix/SKILL.md", "slug": "ios-fix" }, "description": "Autonomous iOS bug fixer. (gstack)", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:ios-qa", "kind": "leaf", "title": "ios-qa", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/ios-qa/SKILL.md", "slug": "ios-qa" }, "description": "Live-device iOS QA for SwiftUI apps. (gstack)", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:ios-sync", "kind": "leaf", "title": "ios-sync", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/ios-sync/SKILL.md", "slug": "ios-sync" }, "description": "Regenerate the iOS debug bridge against the latest upstream gstack templates. (gstack)", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:iso27001-audit-prep", "kind": "leaf", "title": "ISO 27001 ISMS Audit Prep", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/iso27001-audit-prep/SKILL.md", "slug": "iso27001-audit-prep" }, "description": "ISO 27001 ISMS audit readiness 6-question forcing interrogation. Use before annual Clause 9.2 internal audit, surveillance audit prep, or stage 1 certification readiness.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:jupyter-notebook-creation", "kind": "leaf", "title": "Jupyter Notebook Creation", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/jupyter-notebook-creation/SKILL.md", "slug": "jupyter-notebook-creation" }, "description": "Create, scaffold, and edit Jupyter notebooks (.ipynb) for experiments, explorations, or tutorials. Use when the user needs to generate clean, reproducible notebooks with proper structure. Complements jupyter-live-kernel which focuses on execution.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:kubernetes-operator", "kind": "leaf", "title": "Kubernetes Operator", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/kubernetes-operator/SKILL.md", "slug": "Kubernetes Operator Development" }, "description": "Build Kubernetes Operators that reconcile correctly. Covers CRD design, reconcile-loop patterns, framework selection, and OperatorHub capability auditing.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:macos-computer-use", "kind": "leaf", "title": "macos-computer-use", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/macos-computer-use/SKILL.md", "slug": "macos-computer-use" }, "description": "You have a `computer_use` tool that drives the Mac in the **background**. Your actions do NOT move the user's cursor, steal keyboard focus, or switch Spaces. The user can keep typing in their editor while you click around in", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:managed-agent-launch", "kind": "leaf", "title": "Managed Agent Launch", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/managed-agent-launch/SKILL.md", "slug": "Managed Agent Launch" }, "description": "Launch a Claude Managed Agent (CMA) from idea to scheduled deployment — interview, scope, build kit, launch, eval, iterate. Use when the user wants to create a hosted agent on Anthropic's managed infrastructure.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:managing-cloud-identity-with-okta", "kind": "leaf", "title": "Managing Cloud Identity with Okta", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/managing-cloud-identity-with-okta/SKILL.md", "slug": "Managing Cloud Identity with Okta" }, "description": "This skill covers implementing Okta as a centralized identity provider", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:managing-intelligence-lifecycle", "kind": "leaf", "title": "Managing Intelligence Lifecycle", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/managing-intelligence-lifecycle/SKILL.md", "slug": "Managing Intelligence Lifecycle" }, "description": "Manages the end-to-end cyber threat intelligence lifecycle from planning", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:managing-third-party-vendor-risk", "kind": "leaf", "title": "Managing Third-Party Vendor Risk", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/managing-third-party-vendor-risk/SKILL.md", "slug": "Managing Third-Party Vendor Risk" }, "description": "Catalog every third party and capture: data sensitivity handled, type of access (network, physical, none), business criticality, and regulatory scope. You cannot manage what you have not inventoried — shadow vendors are a common blind spot.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:mapping-attack-paths-with-bloodhound-ce", "kind": "leaf", "title": "Mapping Attack Paths with BloodHound CE", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/mapping-attack-paths-with-bloodhound-ce/SKILL.md", "slug": "Mapping Attack Paths with BloodHound CE" }, "description": "Collect Active Directory data with SharpHound and Entra ID data with AzureHound, ingest into BloodHound Community Edition, and analyze on-prem, cloud, and hybrid attack paths with built-in queries and custom Cypher.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:mapping-mitre-attack-techniques", "kind": "leaf", "title": "Mapping MITRE ATT&CK Techniques", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/mapping-mitre-attack-techniques/SKILL.md", "slug": "Mapping MITRE ATT&CK Techniques" }, "description": "Maps observed adversary behaviors, security alerts, and detection rules", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:mcp-integration", "kind": "leaf", "title": "MCP Integration for Claude Code Plugins", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/mcp-integration/SKILL.md", "slug": "mcp-integration" }, "description": "This skill should be used when the user asks to \"add MCP server\", \"integrate MCP\", \"configure MCP in plugin\", \"use .mcp.json\", \"set up Model Context Protocol\", \"connect external service\", mentions \"${CLAUDE_PLUGIN_ROOT} with MCP\", or discusses MCP server types (SSE, stdio, HTTP, WebSocket). Provides comprehensive guidance for integrating Model Context Protocol servers into Claude Code plugins for external tool and service integration.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:mcp-security-review", "kind": "leaf", "title": "MCP Security Review", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/mcp-security-review/SKILL.md", "slug": "MCP Security Review" }, "description": "Security review framework for Model Context Protocol servers. Use before adding an MCP server, when auditing existing MCP tools, or when evaluating MCP server trust boundaries.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:mcp-server-builder", "kind": "leaf", "title": "MCP Server Builder", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/mcp-server-builder/SKILL.md", "slug": "mcp-server-builder" }, "description": "Comprehensive guide for creating high-quality MCP (Model Context Protocol) servers that enable LLMs to interact with external services. Covers four-phase development workflow (research, implementation, review, evaluation), tool design patterns, framework selection (TypeScript/Python), auth, testing with MCP Inspector, and evaluation creation. Use when building MCP servers to integrate external APIs or services.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:migrating-to-post-quantum-cryptography", "kind": "leaf", "title": "Migrating to Post-Quantum Cryptography", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/migrating-to-post-quantum-cryptography/SKILL.md", "slug": "Migrating to Post-Quantum Cryptography" }, "description": "Inventory cryptography, deploy hybrid X25519 and ML-KEM, and prioritize harvest-now-decrypt-later data.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:migration-architect", "kind": "leaf", "title": "Migration Architect", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/migration-architect/SKILL.md", "slug": "migration-architect" }, "description": "Zero-downtime migration planning, compatibility validation, and rollback strategy generation. Tools for system, database, and infrastructure migrations with minimal business impact. Use when planning a database migration, infrastructure cutover, system replacement, or any high-risk transition that needs explicit rollback paths.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:minecraft-modpack-server", "kind": "leaf", "title": "minecraft-modpack-server", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/minecraft-modpack-server/SKILL.md", "slug": "minecraft-modpack-server" }, "description": "Host modded Minecraft servers (CurseForge, Modrinth).", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:mock-hunter", "kind": "leaf", "title": "MockHunter — Live Page Reality Check", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/mock-hunter/SKILL.md", "slug": "mock-hunter" }, "description": "Audit a live web page to identify mock data, hardcoded values, LLM-generated metrics, and broken endpoints. Uses browser automation to trace visible values through network and DOM to their source.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:modeling-threats-with-opencti", "kind": "leaf", "title": "Modeling Threats with OpenCTI", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/modeling-threats-with-opencti/SKILL.md", "slug": "Modeling Threats with OpenCTI" }, "description": "Model threat actors, intrusion sets, campaigns, and TTPs as a STIX 2.1 knowledge graph in OpenCTI (Filigran) using the pycti Python client, connectors, and import workers for structured cyber threat intelligence.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:monitoring-darkweb-sources", "kind": "leaf", "title": "Monitoring Dark Web Sources", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/monitoring-darkweb-sources/SKILL.md", "slug": "Monitoring Dark Web Sources" }, "description": "Monitors dark web forums, marketplaces, paste sites, and ransomware", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:mpp-agent", "kind": "leaf", "title": "MPP Agent", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/mpp-agent/SKILL.md", "slug": "mpp-agent" }, "description": "Pay HTTP 402 APIs via Machine Payments Protocol — mppx, Tempo Wallet, Privy, AgentCash.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:on-call-handoff-patterns", "kind": "leaf", "title": "On-Call Handoff Patterns", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/on-call-handoff-patterns/SKILL.md", "slug": "on-call-handoff-patterns" }, "description": "Effective patterns for on-call shift transitions, ensuring continuity, context transfer, and reliable incident response across shifts. Use when transitioning on-call responsibilities, writing shift handoff summaries, documenting ongoing investigations, or establishing on-call rotation procedures.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:operating-havoc-c2", "kind": "leaf", "title": "Operating Havoc C2", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/operating-havoc-c2/SKILL.md", "slug": "Operating Havoc C2" }, "description": "Deploy a Havoc team server with Yaotl profiles, generate evasive Demon agents with indirect syscalls and sleep obfuscation, and run post-exploitation and pivoting for adversary emulation.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:operating-sliver-c2", "kind": "leaf", "title": "Operating Sliver C2", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/operating-sliver-c2/SKILL.md", "slug": "Operating Sliver C2" }, "description": "Stand up a Sliver C2 server and listeners, generate cross-platform implants and beacons, and run post-exploitation, pivoting, and BOF/.NET tooling via the armory for adversary emulation.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:operationalizing-misp-threat-feeds", "kind": "leaf", "title": "Operationalizing MISP Threat Feeds", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/operationalizing-misp-threat-feeds/SKILL.md", "slug": "Operationalizing MISP Threat Feeds" }, "description": "Run MISP, curate feeds, and auto-generate detections for Wazuh, Sigma, and Suricata.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:patent", "kind": "leaf", "title": "Patent — Prior-Art + Landscape Intelligence", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/patent/SKILL.md", "slug": "patent" }, "description": "Patent prior-art and landscape intelligence — not generic patent help. Commits to one of five sub-use-cases via forcing intake (novelty search / freedom-to-operate / competitive landscape / acquisition diligence / litigation prior-art) before any search runs. Searches Google Patents, Espacenet, USPTO. Output is a structured report with verdict, ranked closest art with claim-text, CPC-class-aware landscape, family-resolved hits, FTO flags, strategy recommendations, and audit log. Use when the user asks for patent searching or analysis. Produces search signal, not legal advice — always recommends consulting a patent attorney.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-active-directory-bloodhound-analysis", "kind": "leaf", "title": "Performing Active Directory BloodHound Analysis", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-active-directory-bloodhound-analysis/SKILL.md", "slug": "Performing Active Directory BloodHound Analysis" }, "description": "Use BloodHound and SharpHound to enumerate Active Directory relationships", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-active-directory-compromise-investigation", "kind": "leaf", "title": "Performing Active Directory Compromise Investigation", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-active-directory-compromise-investigation/SKILL.md", "slug": "Performing Active Directory Compromise Investigation" }, "description": "Investigate Active Directory compromise by analyzing authentication logs,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-active-directory-forest-trust-attack", "kind": "leaf", "title": "Performing Active Directory Forest Trust Attack", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-active-directory-forest-trust-attack/SKILL.md", "slug": "Performing Active Directory Forest Trust Attack" }, "description": "Enumerate and audit Active Directory forest trust relationships using", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-active-directory-penetration-test", "kind": "leaf", "title": "Performing Active Directory Penetration Test", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-active-directory-penetration-test/SKILL.md", "slug": "Performing Active Directory Penetration Test" }, "description": "Conduct a focused Active Directory penetration test to enumerate domain", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-active-directory-vulnerability-assessment", "kind": "leaf", "title": "Performing Active Directory Vulnerability Assessment", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-active-directory-vulnerability-assessment/SKILL.md", "slug": "Performing Active Directory Vulnerability Assessment" }, "description": "Assess Active Directory security posture using PingCastle, BloodHound,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-adversary-in-the-middle-phishing-detection", "kind": "leaf", "title": "Performing Adversary-in-the-Middle Phishing Detection", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-adversary-in-the-middle-phishing-detection/SKILL.md", "slug": "Performing Adversary-in-the-Middle Phishing Detection" }, "description": "Detect and respond to Adversary-in-the-Middle (AiTM) phishing attacks", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-ai-driven-osint-correlation", "kind": "leaf", "title": "Performing AI-Driven OSINT Correlation", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-ai-driven-osint-correlation/SKILL.md", "slug": "Performing AI-Driven OSINT Correlation" }, "description": "Use AI and LLM-based reasoning to correlate findings across multiple", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-alert-triage-with-elastic-siem", "kind": "leaf", "title": "Performing Alert Triage with Elastic SIEM", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-alert-triage-with-elastic-siem/SKILL.md", "slug": "Performing Alert Triage with Elastic SIEM" }, "description": "Perform systematic alert triage in Elastic Security SIEM to rapidly classify,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-api-rate-limiting-bypass", "kind": "leaf", "title": "Performing API Rate Limiting Bypass", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-api-rate-limiting-bypass/SKILL.md", "slug": "Performing API Rate Limiting Bypass" }, "description": "Tests API rate limiting implementations for bypass vulnerabilities by", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-authenticated-scan-with-openvas", "kind": "leaf", "title": "Performing Authenticated Scan with OpenVAS", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-authenticated-scan-with-openvas/SKILL.md", "slug": "Performing Authenticated Scan with OpenVAS" }, "description": "Configure and execute authenticated vulnerability scans using OpenVAS/Greenbone", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-automated-malware-analysis-with-cape", "kind": "leaf", "title": "Performing Automated Malware Analysis with CAPE", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-automated-malware-analysis-with-cape/SKILL.md", "slug": "Performing Automated Malware Analysis with CAPE" }, "description": "Deploy and operate CAPEv2 sandbox for automated malware analysis with", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-blind-ssrf-exploitation", "kind": "leaf", "title": "Performing Blind SSRF Exploitation", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-blind-ssrf-exploitation/SKILL.md", "slug": "Performing Blind SSRF Exploitation" }, "description": "Detect and exploit blind Server-Side Request Forgery vulnerabilities", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-brand-monitoring-for-impersonation", "kind": "leaf", "title": "Performing Brand Monitoring for Impersonation", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-brand-monitoring-for-impersonation/SKILL.md", "slug": "Performing Brand Monitoring for Impersonation" }, "description": "Monitor for brand impersonation attacks across domains, social media,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-container-security-scanning-with-trivy", "kind": "leaf", "title": "Performing Container Security Scanning with Trivy", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-container-security-scanning-with-trivy/SKILL.md", "slug": "Performing Container Security Scanning with Trivy" }, "description": "Scan container images, filesystems, and Kubernetes manifests for vulnerabilities,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-content-security-policy-bypass", "kind": "leaf", "title": "Performing Content Security Policy Bypass", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-content-security-policy-bypass/SKILL.md", "slug": "Performing Content Security Policy Bypass" }, "description": "Analyze and bypass Content Security Policy implementations to achieve", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-dark-web-monitoring-for-threats", "kind": "leaf", "title": "Performing Dark Web Monitoring for Threats", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-dark-web-monitoring-for-threats/SKILL.md", "slug": "Performing Dark Web Monitoring for Threats" }, "description": "Dark web monitoring involves systematically scanning Tor hidden services,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-deception-technology-deployment", "kind": "leaf", "title": "Performing Deception Technology Deployment", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-deception-technology-deployment/SKILL.md", "slug": "Performing Deception Technology Deployment" }, "description": "Deploys deception technology including honeypots, honeytokens, and decoy", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-dmarc-policy-enforcement-rollout", "kind": "leaf", "title": "Performing DMARC Policy Enforcement Rollout", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-dmarc-policy-enforcement-rollout/SKILL.md", "slug": "Performing DMARC Policy Enforcement Rollout" }, "description": "Execute a phased DMARC rollout from p=none monitoring through p=quarantine", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-dynamic-analysis-with-any-run", "kind": "leaf", "title": "Performing Dynamic Analysis with ANY.RUN", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-dynamic-analysis-with-any-run/SKILL.md", "slug": "Performing Dynamic Analysis with ANY.RUN" }, "description": "Performs interactive dynamic malware analysis using the ANY.RUN cloud", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-external-network-penetration-test", "kind": "leaf", "title": "Performing External Network Penetration Test", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-external-network-penetration-test/SKILL.md", "slug": "Performing External Network Penetration Test" }, "description": "Conduct a comprehensive external network penetration test to identify", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-false-positive-reduction-in-siem", "kind": "leaf", "title": "Performing False Positive Reduction in SIEM", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-false-positive-reduction-in-siem/SKILL.md", "slug": "Performing False Positive Reduction in SIEM" }, "description": "Perform systematic SIEM false positive reduction through rule tuning,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-firmware-extraction-with-binwalk", "kind": "leaf", "title": "Performing Firmware Extraction with Binwalk", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-firmware-extraction-with-binwalk/SKILL.md", "slug": "Performing Firmware Extraction with Binwalk" }, "description": "Performs firmware image extraction and analysis using binwalk to identify", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-firmware-malware-analysis", "kind": "leaf", "title": "Performing Firmware Malware Analysis", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-firmware-malware-analysis/SKILL.md", "slug": "Performing Firmware Malware Analysis" }, "description": "Analyzes firmware images for embedded malware, backdoors, and unauthorized", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-http-parameter-pollution-attack", "kind": "leaf", "title": "Performing HTTP Parameter Pollution Attack", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-http-parameter-pollution-attack/SKILL.md", "slug": "Performing HTTP Parameter Pollution Attack" }, "description": "Execute HTTP Parameter Pollution attacks to bypass input validation,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-indicator-lifecycle-management", "kind": "leaf", "title": "Performing Indicator Lifecycle Management", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-indicator-lifecycle-management/SKILL.md", "slug": "Performing Indicator Lifecycle Management" }, "description": "Indicator lifecycle management tracks IOCs from initial discovery through", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-ioc-enrichment-automation", "kind": "leaf", "title": "Performing IOC Enrichment Automation", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-ioc-enrichment-automation/SKILL.md", "slug": "Performing IOC Enrichment Automation" }, "description": "Automates Indicator of Compromise (IOC) enrichment by orchestrating", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-ip-reputation-analysis-with-shodan", "kind": "leaf", "title": "Performing IP Reputation Analysis with Shodan", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-ip-reputation-analysis-with-shodan/SKILL.md", "slug": "Performing IP Reputation Analysis with Shodan" }, "description": "Analyze IP address reputation using the Shodan API to identify open ports,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-kubernetes-cis-benchmark-with-kube-bench", "kind": "leaf", "title": "Performing Kubernetes CIS Benchmark with kube-bench", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-kubernetes-cis-benchmark-with-kube-bench/SKILL.md", "slug": "Performing Kubernetes CIS Benchmark with kube-bench" }, "description": "Audit Kubernetes cluster security posture against CIS benchmarks using", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-kubernetes-penetration-testing", "kind": "leaf", "title": "Performing Kubernetes Penetration Testing", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-kubernetes-penetration-testing/SKILL.md", "slug": "Performing Kubernetes Penetration Testing" }, "description": "Kubernetes penetration testing systematically evaluates cluster security", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-lateral-movement-detection", "kind": "leaf", "title": "Performing Lateral Movement Detection", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-lateral-movement-detection/SKILL.md", "slug": "Performing Lateral Movement Detection" }, "description": "Detects lateral movement techniques including Pass-the-Hash, PsExec,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-lateral-movement-with-wmiexec", "kind": "leaf", "title": "Performing Lateral Movement with WMIExec", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-lateral-movement-with-wmiexec/SKILL.md", "slug": "Performing Lateral Movement with WMIExec" }, "description": "Perform lateral movement across Windows networks using WMI-based remote", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-log-source-onboarding-in-siem", "kind": "leaf", "title": "Performing Log Source Onboarding in SIEM", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-log-source-onboarding-in-siem/SKILL.md", "slug": "Performing Log Source Onboarding in SIEM" }, "description": "Perform structured log source onboarding into SIEM platforms by configuring", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-malware-hash-enrichment-with-virustotal", "kind": "leaf", "title": "Performing Malware Hash Enrichment with VirusTotal", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-malware-hash-enrichment-with-virustotal/SKILL.md", "slug": "Performing Malware Hash Enrichment with VirusTotal" }, "description": "Enrich malware file hashes using the VirusTotal API to retrieve detection", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-malware-ioc-extraction", "kind": "leaf", "title": "Performing Malware IOC Extraction", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-malware-ioc-extraction/SKILL.md", "slug": "Performing Malware IOC Extraction" }, "description": "Malware IOC extraction is the process of analyzing malicious software", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-malware-triage-with-yara", "kind": "leaf", "title": "Performing Malware Triage with YARA", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-malware-triage-with-yara/SKILL.md", "slug": "Performing Malware Triage with YARA" }, "description": "Performs rapid malware triage and classification using YARA rules to", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-memory-forensics-with-volatility3-plugins", "kind": "leaf", "title": "Performing Memory Forensics with Volatility3 Plugins", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-memory-forensics-with-volatility3-plugins/SKILL.md", "slug": "Performing Memory Forensics with Volatility3 Plugins" }, "description": "Analyze memory dumps using Volatility3 plugins to detect injected code,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-network-packet-capture-analysis", "kind": "leaf", "title": "Performing Network Packet Capture Analysis", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-network-packet-capture-analysis/SKILL.md", "slug": "Performing Network Packet Capture Analysis" }, "description": "Perform forensic analysis of network packet captures (PCAP/PCAPNG) using", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-network-traffic-analysis-with-tshark", "kind": "leaf", "title": "Performing Network Traffic Analysis with TShark", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-network-traffic-analysis-with-tshark/SKILL.md", "slug": "Performing Network Traffic Analysis with TShark" }, "description": "Automate network traffic analysis using tshark and pyshark for protocol", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-oauth-scope-minimization-review", "kind": "leaf", "title": "Performing OAuth Scope Minimization Review", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-oauth-scope-minimization-review/SKILL.md", "slug": "Performing OAuth Scope Minimization Review" }, "description": "Performs OAuth 2.0 scope minimization review to identify over-permissioned", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-open-source-intelligence-gathering", "kind": "leaf", "title": "Performing Open Source Intelligence Gathering", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-open-source-intelligence-gathering/SKILL.md", "slug": "Performing Open Source Intelligence Gathering" }, "description": "Open Source Intelligence (OSINT) gathering is the first active phase", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-paste-site-monitoring-for-credentials", "kind": "leaf", "title": "Performing Paste Site Monitoring for Credentials", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-paste-site-monitoring-for-credentials/SKILL.md", "slug": "Performing Paste Site Monitoring for Credentials" }, "description": "Monitor paste sites like Pastebin and GitHub Gists for leaked credentials,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-phishing-simulation-with-gophish", "kind": "leaf", "title": "Performing Phishing Simulation with GoPhish", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-phishing-simulation-with-gophish/SKILL.md", "slug": "Performing Phishing Simulation with GoPhish" }, "description": "GoPhish is an open-source phishing simulation framework used by security", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-physical-intrusion-assessment", "kind": "leaf", "title": "Performing Physical Intrusion Assessment", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-physical-intrusion-assessment/SKILL.md", "slug": "Performing Physical Intrusion Assessment" }, "description": "Conduct authorized physical penetration testing using tailgating, badge", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-plc-firmware-security-analysis", "kind": "leaf", "title": "Performing PLC Firmware Security Analysis", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-plc-firmware-security-analysis/SKILL.md", "slug": "Performing PLC Firmware Security Analysis" }, "description": "This skill covers analyzing Programmable Logic Controller (PLC) firmware", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-purple-team-atomic-testing", "kind": "leaf", "title": "Performing Purple Team Atomic Testing", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-purple-team-atomic-testing/SKILL.md", "slug": "Performing Purple Team Atomic Testing" }, "description": "Executes Atomic Red Team tests mapped to MITRE ATT&CK techniques, performs", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-purple-team-exercise", "kind": "leaf", "title": "Performing Purple Team Exercise", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-purple-team-exercise/SKILL.md", "slug": "Performing Purple Team Exercise" }, "description": "Performs purple team exercises by coordinating red team adversary emulation", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-ransomware-response", "kind": "leaf", "title": "Performing Ransomware Response", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-ransomware-response/SKILL.md", "slug": "Performing Ransomware Response" }, "description": "Executes a structured ransomware incident response from initial detection", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-ransomware-tabletop-exercise", "kind": "leaf", "title": "Performing Ransomware Tabletop Exercise", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-ransomware-tabletop-exercise/SKILL.md", "slug": "Performing Ransomware Tabletop Exercise" }, "description": "Plans and facilitates tabletop exercises simulating ransomware incidents", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-red-team-phishing-with-gophish", "kind": "leaf", "title": "For authorized penetration testing and lab environments only", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-red-team-phishing-with-gophish/SKILL.md", "slug": "For authorized penetration testing and lab environments only" }, "description": "Automate GoPhish phishing simulation campaigns using the Python gophish", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-red-team-with-covenant", "kind": "leaf", "title": "Performing Red Team Operations with Covenant C2", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-red-team-with-covenant/SKILL.md", "slug": "Performing Red Team Operations with Covenant C2" }, "description": "Conduct red team operations using the Covenant C2 framework for authorized", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-second-order-sql-injection", "kind": "leaf", "title": "Performing Second-Order SQL Injection", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-second-order-sql-injection/SKILL.md", "slug": "Performing Second-Order SQL Injection" }, "description": "Detect and exploit second-order SQL injection vulnerabilities where malicious", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-sqlite-database-forensics", "kind": "leaf", "title": "Performing SQLite Database Forensics", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-sqlite-database-forensics/SKILL.md", "slug": "Performing SQLite Database Forensics" }, "description": "Perform forensic analysis of SQLite databases to recover deleted records", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-ssl-tls-inspection-configuration", "kind": "leaf", "title": "Performing SSL/TLS Inspection Configuration", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-ssl-tls-inspection-configuration/SKILL.md", "slug": "Performing SSL/TLS Inspection Configuration" }, "description": "Configure SSL/TLS inspection on network security devices to decrypt,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-static-malware-analysis-with-pe-studio", "kind": "leaf", "title": "Performing Static Malware Analysis with PEStudio", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-static-malware-analysis-with-pe-studio/SKILL.md", "slug": "Performing Static Malware Analysis with PEStudio" }, "description": "Performs static analysis of Windows PE (Portable Executable) malware", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-threat-hunting-with-yara-rules", "kind": "leaf", "title": "Performing Threat Hunting with YARA Rules", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-threat-hunting-with-yara-rules/SKILL.md", "slug": "Performing Threat Hunting with YARA Rules" }, "description": "Use YARA pattern-matching rules to hunt for malware, suspicious files,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-threat-intelligence-sharing-with-misp", "kind": "leaf", "title": "Performing Threat Intelligence Sharing with MISP", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-threat-intelligence-sharing-with-misp/SKILL.md", "slug": "Performing Threat Intelligence Sharing with MISP" }, "description": "Use PyMISP to create, enrich, and share threat intelligence events on", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-threat-landscape-assessment-for-sector", "kind": "leaf", "title": "Performing Threat Landscape Assessment for Sector", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-threat-landscape-assessment-for-sector/SKILL.md", "slug": "Performing Threat Landscape Assessment for Sector" }, "description": "Conduct a sector-specific threat landscape assessment by analyzing threat", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-vlan-hopping-attack", "kind": "leaf", "title": "Performing VLAN Hopping Attack", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-vlan-hopping-attack/SKILL.md", "slug": "Performing VLAN Hopping Attack" }, "description": "Simulates VLAN hopping attacks using switch spoofing and double tagging", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-vulnerability-scanning-with-nessus", "kind": "leaf", "title": "Performing Vulnerability Scanning with Nessus", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-vulnerability-scanning-with-nessus/SKILL.md", "slug": "Performing Vulnerability Scanning with Nessus" }, "description": "Performs authenticated and unauthenticated vulnerability scanning using", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-web-application-scanning-with-nikto", "kind": "leaf", "title": "Performing Web Application Scanning with Nikto", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-web-application-scanning-with-nikto/SKILL.md", "slug": "Performing Web Application Scanning with Nikto" }, "description": "Nikto is an open-source web server and web application scanner that tests", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-web-cache-deception-attack", "kind": "leaf", "title": "Performing Web Cache Deception Attack", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-web-cache-deception-attack/SKILL.md", "slug": "Performing Web Cache Deception Attack" }, "description": "Execute web cache deception attacks by exploiting path normalization", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-wifi-password-cracking-with-aircrack", "kind": "leaf", "title": "Performing WiFi Password Cracking with Aircrack-ng", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-wifi-password-cracking-with-aircrack/SKILL.md", "slug": "Performing WiFi Password Cracking with Aircrack-ng" }, "description": "Captures WPA/WPA2 handshakes and performs offline password cracking", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-windows-artifact-analysis-with-eric-zimmerman-tools", "kind": "leaf", "title": "Performing Windows Artifact Analysis with Eric Zimmerman Tools", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools/SKILL.md", "slug": "Performing Windows Artifact Analysis with Eric Zimmerman Tools" }, "description": "Perform comprehensive Windows forensic artifact analysis using Eric Zimmerman's", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-wireless-security-assessment-with-kismet", "kind": "leaf", "title": "Performing Wireless Security Assessment with Kismet", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-wireless-security-assessment-with-kismet/SKILL.md", "slug": "Performing Wireless Security Assessment with Kismet" }, "description": "Conduct wireless network security assessments using Kismet to detect", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-yara-rule-development-for-detection", "kind": "leaf", "title": "Performing YARA Rule Development for Detection", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-yara-rule-development-for-detection/SKILL.md", "slug": "Performing YARA Rule Development for Detection" }, "description": "Develop precise YARA rules for malware detection by identifying unique", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:phase-gated-debugging", "kind": "leaf", "title": "Phase-Gated Debugging", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/phase-gated-debugging/SKILL.md", "slug": "phase-gated-debugging" }, "description": "Enforces a strict 5-phase debugging protocol where code edits are blocked until root cause is confirmed. Prevents premature fix attempts and debugging spirals.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:plan-design-review", "kind": "leaf", "title": "plan-design-review", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/plan-design-review/SKILL.md", "slug": "plan-design-review" }, "description": "Designer's eye plan review — interactive, like CEO and Eng review. (gstack)", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:playground", "kind": "leaf", "title": "Playground Builder", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/playground/SKILL.md", "slug": "playground" }, "description": "Creates interactive HTML playgrounds — self-contained single-file explorers that let users configure something visually through controls, see a live preview, and copy out a prompt. Use when the user asks to make a playground, explorer, or interactive tool for a topic.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:plugin-creator", "kind": "leaf", "title": "plugin-creator", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/plugin-creator/SKILL.md", "slug": "plugin-creator" }, "description": "Create and scaffold plugin directories for Codex with a required `.codex-plugin/plugin.json`, optional plugin folders/files, valid manifest defaults, and personal-marketplace entries by default. Use when Codex needs to create a new personal plugin, add optional plugin structure, generate or update marketplace entries for plugin ordering and availability metadata, or update an existing local plugin during development with the CLI-driven cachebuster and reinstall flow.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:podcast-generation", "kind": "leaf", "title": "podcast-generation", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/podcast-generation/SKILL.md", "slug": "podcast-generation" }, "description": "Use this skill when the user requests to generate, create, or produce podcasts from text content. Converts written content into a two-host conversational podcast audio format with natural dialogue.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:post-exploiting-microsoft-graph-with-graphrunner", "kind": "leaf", "title": "Post-Exploiting Microsoft Graph with GraphRunner", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/post-exploiting-microsoft-graph-with-graphrunner/SKILL.md", "slug": "Post-Exploiting Microsoft Graph with GraphRunner" }, "description": "Perform recon, persistence, privilege escalation, and data search via the Microsoft Graph API using GraphRunner.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:postmortem-writing", "kind": "leaf", "title": "Postmortem Writing", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/postmortem-writing/SKILL.md", "slug": "postmortem-writing" }, "description": "Comprehensive guide to writing effective, blameless postmortems that drive organizational learning and prevent incident recurrence. Use when conducting post-incident reviews, writing postmortem documents, facilitating blameless postmortem meetings, or identifying root causes and contributing factors.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:pr-comment-handler", "kind": "leaf", "title": "PR Comment Handler", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/pr-comment-handler/SKILL.md", "slug": "pr-comment-handler" }, "description": "Address review and issue comments on an open GitHub PR using gh CLI. Use when the user wants to respond to reviewer feedback, apply suggested fixes, or resolve review threads on the current branch's PR.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:pr-to-video", "kind": "leaf", "title": "PR to HyperFrames", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/pr-to-video/SKILL.md", "slug": "pr-to-video" }, "description": "turn a GitHub pull request (a PR URL like github.com///pull/, an /# ref, or 'this PR' in a checked-out repo) into a code-change explainer video, up to ~3 min (sweet spot 30-90s) — changelog, feature reveal, fix, or refactor walkthrough, rendered from the diff / commits / files. The input is a CODE CHANGE read via the gh CLI; there is no website capture. Use this skill for a GitHub PR. Do not use it for a product launch/promo (use /product-launch-video), a tour of a real website (use /website-to-video), a topic explainer with no PR (use /faceless-explainer), captions on existing footage (use /embedded-captions), or a short unnarrated motion graphic (use /motion-graphics). If the intent is unclear, route through /hyperframes first.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:pricing-strategy", "kind": "leaf", "title": "Pricing Strategy", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/pricing-strategy/SKILL.md", "slug": "pricing-strategy" }, "description": "Design, optimize, and communicate SaaS pricing — tier structure, value metrics, pricing pages, and price increase strategy. Use when building pricing from scratch, redesigning existing pricing, planning a price increase, or improving a pricing page.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:prioritizing-vulnerabilities-with-cvss-scoring", "kind": "leaf", "title": "Prioritizing Vulnerabilities with CVSS Scoring", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/prioritizing-vulnerabilities-with-cvss-scoring/SKILL.md", "slug": "Prioritizing Vulnerabilities with CVSS Scoring" }, "description": "The Common Vulnerability Scoring System (CVSS) is the industry standard", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:processing-stix-taxii-feeds", "kind": "leaf", "title": "Processing STIX/TAXII Feeds", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/processing-stix-taxii-feeds/SKILL.md", "slug": "Processing STIX/TAXII Feeds" }, "description": "Processes STIX 2.1 threat intelligence bundles delivered via TAXII 2.1", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:product-discovery", "kind": "leaf", "title": "Product Discovery", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/product-discovery/SKILL.md", "slug": "product-discovery" }, "description": "Structured product discovery — Opportunity Solution Tree, assumption mapping, problem/solution validation, discovery sprints. Use when validating product opportunities, mapping assumptions, planning discovery sprints, or testing problem-solution fit before committing delivery resources.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:product-launch-video", "kind": "leaf", "title": "Product Launch to HyperFrames", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/product-launch-video/SKILL.md", "slug": "product-launch-video" }, "description": "turn a product or marketing URL, pasted script, or brief into a product launch video, including SaaS promos, feature reveals, app launches, company promos, and product marketing videos. Use this skill when the user wants to market, launch, promote, or reveal a product. Do not use it for general non-launch website tours, non-product topic explainers, GitHub pull requests, captioning existing footage, or short unnarrated motion graphics. If the intent is unclear, route through /hyperframes first.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:profiling-threat-actor-groups", "kind": "leaf", "title": "Profiling Threat Actor Groups", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/profiling-threat-actor-groups/SKILL.md", "slug": "Profiling Threat Actor Groups" }, "description": "Develops comprehensive threat actor profiles for APT groups, criminal", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:progressive-estimation", "kind": "leaf", "title": "Progressive Estimation", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/progressive-estimation/SKILL.md", "slug": "progressive-estimation" }, "description": "Estimate AI-assisted and hybrid human+agent development work with research-backed PERT statistics and calibration feedback loops. Use when estimating development tasks where AI agents handle part of the work, sprint planning with hybrid teams, batch sizing a backlog, or release date forecasting with confidence intervals.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:project-artifact", "kind": "leaf", "title": "project-artifact — an opinionated project status page", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/project-artifact/SKILL.md", "slug": "project-artifact" }, "description": "Generate and publish a project status artifact — an opinionated, tabbed status page for a project too big for one update (overview & success criteria, the workstream sequence, next steps, plus background, plan, risks & open questions, and decisions/FAQ when they earn a tab) — published with the built-in Artifact tool to a default-private claude.ai page the user can share with teammates. Use when a piece of work spans several workstreams and you want a shareable overview kept current. Each artifact is backed by a small per-project config in the plugin data dir, so refreshing it re-gathers live state, redeploys the same URL, and reports only the delta. For software projects whose workstreams are PRs, also read swe.md (the X.Y PR-numbering convention; pulling PR state with gh/git; a per-PR detail block). Needs the built-in Artifact tool (claude.ai login). Not for single-PR changes or public docs.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:prometheus-configuration", "kind": "leaf", "title": "Prometheus Configuration", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/prometheus-configuration/SKILL.md", "slug": "prometheus-configuration" }, "description": "Set up Prometheus for comprehensive metric collection, storage, and monitoring. Use when implementing metrics collection, setting up monitoring infrastructure, configuring recording rules, or designing alert rules.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:prototype", "kind": "leaf", "title": "Prototype", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/prototype/SKILL.md", "slug": "prototype" }, "description": "Build a throwaway prototype to flesh out a design — a runnable terminal app for state/business-logic questions, or several radically different UI variations toggleable from one route.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:pulse", "kind": "leaf", "title": "Pulse — Multi-Source Recency Research", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/pulse/SKILL.md", "slug": "pulse" }, "description": "Multi-source recency research — takes the pulse of any topic across Reddit, Hacker News, and the open web within a configurable recent window (default 30 days). Forcing intake clarifies topic specificity, angle (trend/sentiment/problems/opportunities/comparison), time window, and platform scope. Returns a synthesized briefing with citations, engagement metrics, and cross-platform pattern analysis. Use when the user requests multi-source recency intelligence (e.g., 'pulse on [topic]', 'what's happening with [topic]', 'what are people saying about [topic]').", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:python-observability", "kind": "leaf", "title": "Python Observability", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/python-observability/SKILL.md", "slug": "python-observability" }, "description": "Python observability patterns including structured logging with structlog, Prometheus metrics, and OpenTelemetry distributed tracing. Use when adding logging, implementing metrics collection, setting up tracing, or debugging production Python systems.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:python-patch-safety", "kind": "leaf", "title": "python-patch-safety", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/python-patch-safety/SKILL.md", "slug": "python-patch-safety" }, "description": "Safe editing of Python files — patch discipline, git rollback checkpoints, py_compile verification. Prevents accidental function loss, stale checkouts, and uncommitted work destruction.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:python-performance-optimization", "kind": "leaf", "title": "Python Performance Optimization", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/python-performance-optimization/SKILL.md", "slug": "python-performance-optimization" }, "description": "Profile and optimize Python code for performance. Use when debugging slow Python code, optimizing bottlenecks, reducing latency, optimizing CPU-intensive operations, reducing memory consumption, or improving data processing pipeline speed. Covers cProfile, line_profiler, memory_profiler, py-spy, and common optimization patterns.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:rag-architect", "kind": "leaf", "title": "RAG Architect", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/rag-architect/SKILL.md", "slug": "rag-architect" }, "description": "Design, tune, and evaluate production RAG pipelines. Use when the user asks to design a RAG pipeline, choose a chunking strategy or embedding model, pick a vector database, or evaluate retrieval quality (precision@k, recall@k, NDCG). NOT for general LLM cost tuning (use llm-cost-optimizer) or agent loops over retrieval.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:rag-implementation", "kind": "leaf", "title": "RAG Implementation", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/rag-implementation/SKILL.md", "slug": "rag-implementation" }, "description": "Build Retrieval-Augmented Generation (RAG) systems for LLM applications. Use when implementing knowledge-grounded AI, building document Q&A systems, integrating LLMs with external knowledge bases, reducing hallucinations, or creating documentation assistants. Covers vector databases, embeddings, retrieval strategies, reranking, chunking, and advanced RAG patterns.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:railway-deploy", "kind": "leaf", "title": "Railway Deploy", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/railway-deploy/SKILL.md", "slug": "railway-deploy" }, "description": "Deploy and manage applications on Railway using the CLI. Use when the user asks to deploy to Railway, check deployment status, manage services, set environment variables, view logs, add databases, scale services, or rollback deployments. Complements existing vercel-deploy, cloudflare-deploy, netlify-deploy, and render-deploy skills.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:recovering-from-ransomware-attack", "kind": "leaf", "title": "Recovering from Ransomware Attack", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/recovering-from-ransomware-attack/SKILL.md", "slug": "Recovering from Ransomware Attack" }, "description": "Executes structured recovery from a ransomware incident following NIST", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:refactoring-patterns", "kind": "leaf", "title": "Refactoring Patterns", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/refactoring-patterns/SKILL.md", "slug": "refactoring-patterns" }, "description": "Behavior-preserving refactoring patterns from Martin Fowler's \"Refactoring\" — small-step structural improvements, named moves, and when to apply them.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:relaying-ntlm-for-adcs-esc8", "kind": "leaf", "title": "Relaying NTLM for ADCS ESC8", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/relaying-ntlm-for-adcs-esc8/SKILL.md", "slug": "Relaying NTLM for ADCS ESC8" }, "description": "Run ntlmrelayx into ADCS web enrollment to obtain a domain controller certificate via ESC8.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:remotion-to-hyperframes", "kind": "leaf", "title": "Remotion to HyperFrames", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/remotion-to-hyperframes/SKILL.md", "slug": "remotion-to-hyperframes" }, "description": "Port an existing Remotion (React) composition to HyperFrames HTML. Use ONLY when the user explicitly asks to port/convert/migrate/translate a Remotion source. Do NOT use: (a) authoring a new HyperFrames composition; (b) Remotion mentioned in passing; (c) Remotion code shared as reference only; (d) \"same video as my Remotion one\" without explicit migrate request — treat as fresh build. Doubt → `/general-video`. One-way, Remotion-only: no reverse export (HyperFrames→Remotion or any framework), no non-Remotion source (After Effects, Framer Motion, plain React/CSS) → out of scope, re-create via `/general-video`. Flags unsupported patterns (useState, useEffect, async calculateMetadata, third-party React libs, `@remotion/lambda`) and recommends runtime interop over lossy translation. Unsure whether to port vs. build fresh, or only a passing Remotion mention? → /hyperframes.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:repository-audit-loop", "kind": "leaf", "title": "Repository Audit Loop", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/repository-audit-loop/SKILL.md", "slug": "repository-audit-loop" }, "description": "Audit a codebase using a strong model for judgment and prioritization, then delegate implementation to cheaper agents via self-contained plans in disposable worktrees. Use when the user wants systematic repository improvement, codebase health audits, or prioritized fix campaigns. Covers strong-model audit, false-positive vetting, plan writing, cheap-model execution, diff review, and backlog reconciliation.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:research-router", "kind": "leaf", "title": "Research — Hybrid Router + Fallback", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/research-router/SKILL.md", "slug": "research-router" }, "description": "Default entry point for any research request — a hybrid router that classifies the question deterministically and either delegates to a specialist research skill (pulse for trends/sentiment, litreview for academic literature, syllabus for course reading, patent for prior-art, dossier for entity research) or runs its own plan-decompose-multi-source-search-synthesize-cite fallback workflow. Always surfaces the routing decision so users can override. Use when the user makes any research request that doesn't obviously match a more-specific specialist skill (e.g., 'research [topic]', 'look into [topic]', 'what do we know about [topic]').", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:reverse-engineering-android-malware-with-jadx", "kind": "leaf", "title": "Reverse Engineering Android Malware with JADX", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/reverse-engineering-android-malware-with-jadx/SKILL.md", "slug": "Reverse Engineering Android Malware with JADX" }, "description": "Reverse engineers malicious Android APK files using JADX decompiler", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:reverse-engineering-dotnet-malware-with-dnspy", "kind": "leaf", "title": "Reverse Engineering .NET Malware with dnSpy", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/reverse-engineering-dotnet-malware-with-dnspy/SKILL.md", "slug": "Reverse Engineering .NET Malware with dnSpy" }, "description": "Reverse engineers .NET malware using dnSpy decompiler and debugger to", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:reverse-engineering-malware-with-ghidra", "kind": "leaf", "title": "Reverse Engineering Malware with Ghidra", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/reverse-engineering-malware-with-ghidra/SKILL.md", "slug": "Reverse Engineering Malware with Ghidra" }, "description": "Reverse engineers malware binaries using NSA''s Ghidra disassembler", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:reverse-engineering-ransomware-encryption-routine", "kind": "leaf", "title": "Reverse Engineering Ransomware Encryption Routine", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/reverse-engineering-ransomware-encryption-routine/SKILL.md", "slug": "Reverse Engineering Ransomware Encryption Routine" }, "description": "Reverse engineer ransomware encryption routines to identify cryptographic", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:reverse-engineering-rust-malware", "kind": "leaf", "title": "Reverse Engineering Rust Malware", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/reverse-engineering-rust-malware/SKILL.md", "slug": "Reverse Engineering Rust Malware" }, "description": "Reverse engineer Rust-compiled malware using IDA Pro and Ghidra with", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:saga-orchestration", "kind": "leaf", "title": "Saga Orchestration", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/saga-orchestration/SKILL.md", "slug": "saga-orchestration" }, "description": "Patterns for managing distributed transactions and long-running business processes. Use when coordinating multi-service transactions, implementing compensating transactions, or managing long-running business workflows.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:scanning-containers-with-trivy-in-cicd", "kind": "leaf", "title": "Scanning Containers with Trivy in CI/CD", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/scanning-containers-with-trivy-in-cicd/SKILL.md", "slug": "Scanning Containers with Trivy in CI/CD" }, "description": "This skill covers integrating Aqua Security''s Trivy scanner into CI/CD", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:scanning-docker-images-with-trivy", "kind": "leaf", "title": "Scanning Docker Images with Trivy", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/scanning-docker-images-with-trivy/SKILL.md", "slug": "Scanning Docker Images with Trivy" }, "description": "Trivy is a comprehensive open-source vulnerability scanner by Aqua Security", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:scanning-network-with-nmap-advanced", "kind": "leaf", "title": "Scanning Network with Nmap Advanced Techniques", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/scanning-network-with-nmap-advanced/SKILL.md", "slug": "Scanning Network with Nmap Advanced Techniques" }, "description": "Performs advanced network reconnaissance using Nmap''s scripting engine,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:scenario-war-room", "kind": "leaf", "title": "Scenario War Room", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/scenario-war-room/SKILL.md", "slug": "scenario-war-room" }, "description": "Cross-functional what-if modeling for cascading multi-variable scenarios. Unlike single-assumption stress testing, models compound adversity across all business functions simultaneously. Use when facing complex risk scenarios, strategic decisions with major downside, or when the user asks 'what if X AND Y both happen?", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:scrape", "kind": "leaf", "title": "scrape", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/scrape/SKILL.md", "slug": "scrape" }, "description": "Pull data from a web page. (gstack)", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:screenshot-automation", "kind": "leaf", "title": "Screenshot Automation", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/screenshot-automation/SKILL.md", "slug": "screenshot-automation" }, "description": "Capture desktop, window, application, or pixel-region screenshots across macOS, Linux, and Windows. Use when the user explicitly asks for screenshots, for visual inspection of desktop apps, or when tool-specific capture capabilities are unavailable.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:securing-agentic-ai-tool-invocation", "kind": "leaf", "title": "Securing Agentic AI Tool Invocation", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/securing-agentic-ai-tool-invocation/SKILL.md", "slug": "Securing Agentic AI Tool Invocation" }, "description": "Apply least-privilege tool allowlisting, identity binding, and human-in-the-loop controls for agent tool calls.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:securing-aws-iam-permissions", "kind": "leaf", "title": "Securing AWS IAM Permissions", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/securing-aws-iam-permissions/SKILL.md", "slug": "Securing AWS IAM Permissions" }, "description": "This skill guides practitioners through hardening AWS Identity and Access", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:securing-azure-with-microsoft-defender", "kind": "leaf", "title": "Securing Azure with Microsoft Defender", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/securing-azure-with-microsoft-defender/SKILL.md", "slug": "Securing Azure with Microsoft Defender" }, "description": "This skill instructs security practitioners on deploying Microsoft Defender", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:securing-kubernetes-on-cloud", "kind": "leaf", "title": "Securing Kubernetes on Cloud", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/securing-kubernetes-on-cloud/SKILL.md", "slug": "Securing Kubernetes on Cloud" }, "description": "This skill covers hardening managed Kubernetes clusters on EKS, AKS,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:security-best-practices", "kind": "leaf", "title": "Security Best Practices", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/security-best-practices/SKILL.md", "slug": "Security Best Practices" }, "description": "Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go).", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:self-improving-champion-loop", "kind": "leaf", "title": "Self-Improving Champion Loop", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/self-improving-champion-loop/SKILL.md", "slug": "Self-Improving Champion Loop" }, "description": "Bounded optimization loop that tests targeted challengers, protects an independently evaluated champion, and rejects suspiciously easy wins. Use when improving a prompt, policy, configuration, or other testable artifact where cheap iteration is useful but final acceptance must use fresh evidence.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:session-report", "kind": "leaf", "title": "Session Report", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/session-report/SKILL.md", "slug": "session-report" }, "description": "Generate an explorable HTML report of Claude Code session usage (tokens, cache, subagents, skills, expensive prompts) from ~/.claude/projects transcripts.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:session-usage-report", "kind": "leaf", "title": "Session Usage Report", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/session-usage-report/SKILL.md", "slug": "session-usage-report" }, "description": "Generate an explorable HTML report of agent session usage (tokens, cache, subagents, skills, expensive prompts) from session transcripts. Use when the user wants to analyze agent usage patterns, review token consumption, identify expensive sessions, or generate a usage report. Adapted from anthropic-claude-plugins-official/session-report.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:simmer-refinement", "kind": "leaf", "title": "simmer-refinement", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/simmer-refinement/SKILL.md", "slug": "simmer-refinement" }, "description": "Iterative artifact refinement with criteria-driven judge board. Takes any artifact (code, doc, prompt, config, pipeline) and hones it over multiple rounds — each round, a panel of judges scores against your criteria and proposes the single highest-leverage improvement (ASI). Use when you have an artifact and want it better, especially when you can define what \"better\" means.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:site-architecture", "kind": "leaf", "title": "Site Architecture", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/site-architecture/SKILL.md", "slug": "site-architecture" }, "description": "Plan or restructure website hierarchy, navigation, URL patterns, breadcrumbs, and internal linking. Use when mapping pages, sections, and site structure for new sites or restructuring existing ones. Not for XML sitemap auditing or schema markup.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:skill-contract-schema", "kind": "leaf", "title": "Skill Contract Schema", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/skill-contract-schema/SKILL.md", "slug": "skill-contract-schema" }, "description": "Five-tuple skill contract schema (Precondition, Operation, Artifact, Validator, Failure-modes) for treating skills as explicit, auditable units. Use when designing skill libraries that need maintenance, composition, or automated diagnosis.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:skill-creator", "kind": "leaf", "title": "skill-creator", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/skill-creator/SKILL.md", "slug": "skill-creator" }, "description": "Create, improve, test, and optimize skills. Use when the user wants a new skill, wants to revise an existing skill, wants help with skill structure or trigger wording, or wants to validate a skill against realistic examples.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:skill-factory-review", "kind": "leaf", "title": "skill-factory-review", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/skill-factory-review/SKILL.md", "slug": "skill-factory-review" }, "description": "Review and govern skill generation factories, templates, and automated skill builders. Use when evaluating repositories or tools that produce skills automatically, generate agents/prompts/hooks from templates, or scaffold skill directories. Covers factory output review, template safety, and generated-artifact promotion gates.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:skill-installer", "kind": "leaf", "title": "skill-installer", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/skill-installer/SKILL.md", "slug": "skill-installer" }, "description": "Install Codex skills into $CODEX_HOME/skills from a curated list or a GitHub repo path. Use when a user asks to list installable skills, install a curated skill, or install a skill from another repo (including private repos).", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:skill-library-evolution", "kind": "leaf", "title": "skill-library-evolution", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/skill-library-evolution/SKILL.md", "slug": "skill-library-evolution" }, "description": "Maintain agent skill libraries as self-evolving software ecosystems. Use when pruning stale skills, resolving skill conflicts, tracking technical debt, or planning library-wide maintenance cycles. Covers typed skill contracts, ecosystem graphs, compatibility/risk/validation diagnostics, and campaign-based evolution.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:skillopt-sleep", "kind": "leaf", "title": "SkillOpt-Sleep Pattern", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/skillopt-sleep/SKILL.md", "slug": "skillopt-sleep" }, "description": "Nightly offline self-evolution pattern for coding agents. Use when designing agent memory consolidation, offline skill improvement, or background optimization loops. Covers harvesting past sessions, replaying recurring tasks, bounded skill edits gated by held-out validation, and staged adoption. Derived from Microsoft SkillOpt-Sleep.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:slack-gif-creator", "kind": "leaf", "title": "Slack GIF Creator", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/slack-gif-creator/SKILL.md", "slug": "slack-gif-creator" }, "description": "Knowledge and utilities for creating animated GIFs optimized for Slack. Provides constraints, validation tools, and animation concepts. Use when users request animated GIFs for Slack.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:slides", "kind": "leaf", "title": "slides", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/slides/SKILL.md", "slug": "slides" }, "description": "Create, edit, review, and export slide decks and .pptx presentations. Use when the user asks for slides, presentations, pitch decks, speaker notes, templates, or any .pptx workflow.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:slideshow", "kind": "leaf", "title": "Slideshow authoring contract", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/slideshow/SKILL.md", "slug": "slideshow" }, "description": "Author a HyperFrames slideshow composition — a presentation, pitch deck, or interactive deck with discrete slides, fragment reveals, branching sequences, and hotspot navigation. Use as an intent check when the user asks for a presentation, pitch deck, slide deck, interactive deck, or page-to-deck conversion that might be a slideshow; if the user did not explicitly ask for a slideshow / slide show, confirm before authoring.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:snowflake-development", "kind": "leaf", "title": "Snowflake Development", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/snowflake-development/SKILL.md", "slug": "Snowflake Data Pipeline Development" }, "description": "Build data pipelines with Snowflake Dynamic Tables, Streams+Tasks, Cortex AI functions, Snowpark Python, and dbt integration. Covers SQL best practices, MERGE upserts, semi-structured data, and performance tuning.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:soc2-audit-prep", "kind": "leaf", "title": "SOC 2 Type II Audit Prep", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/soc2-audit-prep/SKILL.md", "slug": "soc2-audit-prep" }, "description": "SOC 2 Type II readiness 6-question forcing interrogation. Observation-period focused. Use before Type II observation begins, mid-period checkpoint, or pre-field-test month-10 readiness.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:spreadsheets", "kind": "leaf", "title": "spreadsheets", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/spreadsheets/SKILL.md", "slug": "spreadsheets" }, "description": "Create, modify, and analyze spreadsheets (.xlsx, .xls, .csv). Use when the user needs to build workbooks, write formulas, format data, perform analysis, create charts, or query tabular data with SQL. Covers both openpyxl/Python-native and DuckDB/SQL workflows.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:stripe-link-cli", "kind": "leaf", "title": "Stripe Link CLI", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/stripe-link-cli/SKILL.md", "slug": "stripe-link-cli" }, "description": "Agent payments via Stripe Link — virtual cards, Shared Payment Tokens, in-app approval flow.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:stripe-projects", "kind": "leaf", "title": "Stripe Projects", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/stripe-projects/SKILL.md", "slug": "stripe-projects" }, "description": "Provision SaaS services and sync credentials via Stripe Projects CLI.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:syllabus", "kind": "leaf", "title": "Syllabus — Course Supplementary Reading List", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/syllabus/SKILL.md", "slug": "syllabus" }, "description": "Generates a curated supplementary reading list from any course syllabus. Grill-me intake (syllabus input format + course audience + year range) plus a grouping forcing-options checkpoint before any search runs. Parses the syllabus to extract topics and learning outcomes, searches for recent peer-reviewed papers per topic, and produces a structured report with plain-language summaries calibrated to audience level and Bloom-higher-order discussion questions tied to course learning goals. Use when the user uploads a syllabus, course outline, or curriculum document and wants supplementary readings.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:sync-gbrain", "kind": "leaf", "title": "sync-gbrain", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/sync-gbrain/SKILL.md", "slug": "sync-gbrain" }, "description": "Keep gbrain current with this repo's code and refresh agent search guidance in CLAUDE.md. Wraps the gstack-gbrain-sync orchestrator with state (gstack)", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:talking-head-recut", "kind": "leaf", "title": "Talking Head Recut", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/talking-head-recut/SKILL.md", "slug": "talking-head-recut" }, "description": "Package an existing talking-head / interview / podcast video by layering timed, designed GRAPHIC OVERLAY cards onto the playing video — titles, lower-thirds, data callouts, quotes, side panels, picture-in-picture — synced to the transcript. The source video plays in full; the agent designs and writes each card's HTML in conversation, then renders to MP4 via hyperframes. Use when the user asks for graphic overlays, on-screen graphics / lower-thirds / data callouts / kinetic titles on a video, \"package / dress up my video\", \"add overlay cards / graphic cards\", or AI-composed graphic packaging of an existing video. NOT for plain subtitles (→ embedded-captions) or building a video from scratch (→ the creation workflows); when unsure overlays-vs-captions, see /hyperframes.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:tdd", "kind": "leaf", "title": "Test-Driven Development", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/tdd/SKILL.md", "slug": "tdd" }, "description": "Test-driven development. Use when the user wants to build features or fix bugs test-first, mentions \"red-green-refactor\", or wants integration tests.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:terraform-patterns", "kind": "leaf", "title": "Terraform Patterns", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/terraform-patterns/SKILL.md", "slug": "terraform-patterns" }, "description": "Terraform infrastructure-as-code discipline — module design, state management, provider patterns, security hardening, and CI/CD workflows. Use when designing Terraform modules, managing state backends, reviewing Terraform security, implementing multi-region deployments, or following IaC best practices.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:testing-api-authentication-weaknesses", "kind": "leaf", "title": "Testing API Authentication Weaknesses", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/testing-api-authentication-weaknesses/SKILL.md", "slug": "Testing API Authentication Weaknesses" }, "description": "Tests API authentication mechanisms for weaknesses including broken", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:testing-api-security-with-owasp-top-10", "kind": "leaf", "title": "Testing API Security with OWASP Top 10", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/testing-api-security-with-owasp-top-10/SKILL.md", "slug": "Testing API Security with OWASP Top 10" }, "description": "Systematically assessing REST and GraphQL API endpoints against the OWASP", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:testing-for-broken-access-control", "kind": "leaf", "title": "Testing for Broken Access Control", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/testing-for-broken-access-control/SKILL.md", "slug": "Testing for Broken Access Control" }, "description": "Systematically testing web applications for broken access control vulnerabilities", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:testing-for-business-logic-vulnerabilities", "kind": "leaf", "title": "Testing for Business Logic Vulnerabilities", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/testing-for-business-logic-vulnerabilities/SKILL.md", "slug": "Testing for Business Logic Vulnerabilities" }, "description": "Identifying flaws in application business logic that allow price manipulation,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:testing-for-email-header-injection", "kind": "leaf", "title": "Testing for Email Header Injection", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/testing-for-email-header-injection/SKILL.md", "slug": "Testing for Email Header Injection" }, "description": "Test web application email functionality for SMTP header injection vulnerabilities", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:testing-for-json-web-token-vulnerabilities", "kind": "leaf", "title": "Testing for JSON Web Token Vulnerabilities", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/testing-for-json-web-token-vulnerabilities/SKILL.md", "slug": "Testing for JSON Web Token Vulnerabilities" }, "description": "Test JWT implementations for critical vulnerabilities including algorithm", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:testing-for-open-redirect-vulnerabilities", "kind": "leaf", "title": "Testing for Open Redirect Vulnerabilities", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/testing-for-open-redirect-vulnerabilities/SKILL.md", "slug": "Testing for Open Redirect Vulnerabilities" }, "description": "Identify and test open redirect vulnerabilities in web applications by", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:testing-for-system-prompt-leakage", "kind": "leaf", "title": "Testing for System Prompt Leakage", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/testing-for-system-prompt-leakage/SKILL.md", "slug": "Testing for System Prompt Leakage" }, "description": "Extract and defend system prompts plus embedded secrets and routing logic.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:testing-for-xml-injection-vulnerabilities", "kind": "leaf", "title": "Testing for XML Injection Vulnerabilities", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/testing-for-xml-injection-vulnerabilities/SKILL.md", "slug": "Testing for XML Injection Vulnerabilities" }, "description": "Test web applications for XML injection vulnerabilities including XXE,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:testing-for-xss-vulnerabilities-with-burpsuite", "kind": "leaf", "title": "Testing for XSS Vulnerabilities with Burp Suite", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/testing-for-xss-vulnerabilities-with-burpsuite/SKILL.md", "slug": "Testing for XSS Vulnerabilities with Burp Suite" }, "description": "Identifying and validating cross-site scripting vulnerabilities using", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:testing-ransomware-recovery-procedures", "kind": "leaf", "title": "Testing Ransomware Recovery Procedures", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/testing-ransomware-recovery-procedures/SKILL.md", "slug": "Testing Ransomware Recovery Procedures" }, "description": "Test and validate ransomware recovery procedures including backup restore", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:theme-factory", "kind": "leaf", "title": "Theme Factory", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/theme-factory/SKILL.md", "slug": "theme-factory" }, "description": "Toolkit for styling artifacts with a professional theme. These artifacts can be slides, docs, reports, HTML landing pages, etc. Provides 10 pre-set themes with curated color palettes and font pairings, or generate a new theme on-the-fly. Use when styling presentations, reports, documents, or any artifact that needs consistent professional visual identity.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:validating-backup-integrity-for-recovery", "kind": "leaf", "title": "Validating Backup Integrity for Recovery", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/validating-backup-integrity-for-recovery/SKILL.md", "slug": "Validating Backup Integrity for Recovery" }, "description": "Validate backup integrity through cryptographic hash verification, automated", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:validating-tpm-measured-boot-attestation", "kind": "leaf", "title": "Validating TPM Measured Boot and Attestation", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/validating-tpm-measured-boot-attestation/SKILL.md", "slug": "Validating TPM Measured Boot and Attestation" }, "description": "Verify TPM PCRs and measured-boot and remote-attestation integrity.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:vendor-skill-packaging", "kind": "leaf", "title": "vendor-skill-packaging", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/vendor-skill-packaging/SKILL.md", "slug": "vendor-skill-packaging" }, "description": "Package and maintain vendor-maintained skill libraries for multi-runtime agent compatibility. Use when creating skills intended for multiple agent runtimes, when reviewing vendor skill packs for ingestion, or when publishing skills to marketplaces. Covers skill family grouping, install/discover workflows, and deployment classification.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:video-generation", "kind": "leaf", "title": "video-generation", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/video-generation/SKILL.md", "slug": "video-generation" }, "description": "Generate videos from text prompts or create programmatic animations. Use when the user wants AI-generated video clips (Gemini/MiniMax APIs) or mathematical/technical animations (Manim CE). Supports structured prompts, reference images, and multi-scene production pipelines.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:web-artifacts-builder", "kind": "leaf", "title": "Web Artifacts Builder", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/web-artifacts-builder/SKILL.md", "slug": "web-artifacts-builder" }, "description": "Suite of tools for creating elaborate, multi-component claude.ai HTML artifacts using modern frontend web technologies (React, Tailwind CSS, shadcn/ui). Use for complex artifacts requiring state management, routing, or shadcn/ui components — not for simple single-file HTML/JSX artifacts.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:web-design-guidelines", "kind": "leaf", "title": "web-design-guidelines", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/web-design-guidelines/SKILL.md", "slug": "web-design-guidelines" }, "description": "Review UI code for Web Interface Guidelines compliance. Use when asked to \"review my UI\", \"check accessibility\", \"audit design\", \"review UX\", or \"check my site against best practices\".", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:website-to-video", "kind": "leaf", "title": "Website to HyperFrames", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/website-to-video/SKILL.md", "slug": "website-to-video" }, "description": "Capture a general website/URL and turn it into a HyperFrames video (site tour, showcase, or social clip from the site's own visuals). Uses headless Chrome screenshots + brand assets. Use when intent is general — portfolio/blog/landing-page showcase or social clip from the site. NOT for: product/SaaS launch or promo (→ /product-launch-video, even from a URL); topic explainer with no site (→ /faceless-explainer); GitHub PR (→ /pr-to-video); adding captions to existing video (→ /embedded-captions); short unnarrated page-highlight motion graphic (→ /motion-graphics). Unclear launch-vs-general-site? Ask one question or start at /hyperframes.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:workflow-builder", "kind": "leaf", "title": "Workflow Builder", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/workflow-builder/SKILL.md", "slug": "Multi-Agent Workflow Orchestration" }, "description": "Design and write deterministic multi-agent workflow scripts for fan-out, pipeline, loop, and judge-panel orchestration patterns.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:workflow-orchestration", "kind": "leaf", "title": "Workflow Orchestration Patterns", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/workflow-orchestration/SKILL.md", "slug": "workflow-orchestration" }, "description": "Master workflow orchestration architecture with Temporal, covering fundamental design decisions, resilience patterns, and best practices for building reliable distributed systems. Use for multi-step processes, long-running workflows, and failure recovery.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "group:dist:uncategorized:playbook", "kind": "group", "title": "Playbook", "children": [ "leaf:dist:anti-sycophancy", "leaf:dist:architecture-review-loop", "leaf:dist:autoplan", "leaf:dist:canary", "leaf:dist:ci-fix-workflow", "leaf:dist:claude-api-reference", "leaf:dist:claude-automation-recommender", "leaf:dist:claude-md-improver", "leaf:dist:clean-code-discipline", "leaf:dist:codebase-automation-recommender", "leaf:dist:conducting-cloud-incident-response", "leaf:dist:conducting-cloud-penetration-testing", "leaf:dist:conducting-domain-persistence-with-dcsync", "leaf:dist:conducting-external-reconnaissance-with-osint", "leaf:dist:conducting-full-scope-red-team-engagement", "leaf:dist:conducting-internal-network-penetration-test", "leaf:dist:conducting-internal-reconnaissance-with-bloodhound-ce", "leaf:dist:conducting-man-in-the-middle-attack-simulation", "leaf:dist:conducting-memory-forensics-with-volatility", "leaf:dist:conducting-pass-the-ticket-attack", "leaf:dist:conducting-phishing-incident-response", "leaf:dist:conducting-post-incident-lessons-learned", "leaf:dist:conducting-social-engineering-penetration-test", "leaf:dist:conducting-social-engineering-pretext-call", "leaf:dist:conducting-spearphishing-simulation-campaign", "leaf:dist:configuring-host-based-intrusion-detection", "leaf:dist:configuring-microsegmentation-for-zero-trust", "leaf:dist:configuring-multi-factor-authentication-with-duo", "leaf:dist:configuring-network-segmentation-with-vlans", "leaf:dist:configuring-pfsense-firewall-rules", "leaf:dist:configuring-suricata-for-network-monitoring", "leaf:dist:configuring-windows-defender-advanced-settings", "leaf:dist:configuring-windows-event-logging-for-detection", "leaf:dist:containing-active-breach", "leaf:dist:continuous-llm-red-teaming-with-promptfoo", "leaf:dist:correlating-security-events-in-qradar", "leaf:dist:correlating-threat-campaigns", "leaf:dist:data-intensive-design", "leaf:dist:data-pipeline-architecture", "leaf:dist:data-quality", "leaf:dist:data-quality-auditor", "leaf:dist:data-structure-protocol", "leaf:dist:decision-mapping", "leaf:dist:deobfuscating-javascript-malware", "leaf:dist:deobfuscating-powershell-obfuscated-malware", "leaf:dist:deploying-active-directory-honeytokens", "leaf:dist:deploying-cloud-deception-with-decoy-resources", "leaf:dist:deploying-cloudflare-access-for-zero-trust", "leaf:dist:deploying-decoy-files-for-ransomware-detection", "leaf:dist:deploying-edr-agent-with-crowdstrike", "leaf:dist:deploying-honeytokens-and-canarytokens", "leaf:dist:deploying-osquery-for-endpoint-monitoring", "leaf:dist:deploying-palo-alto-prisma-access-zero-trust", "leaf:dist:deploying-ransomware-canary-files", "leaf:dist:deploying-software-defined-perimeter", "leaf:dist:designing-adversary-engagement-with-mitre-engage", "leaf:dist:detecting-anomalous-authentication-patterns", "leaf:dist:detecting-arp-poisoning-in-network-traffic", "leaf:dist:detecting-attacks-on-historian-servers", "leaf:dist:detecting-attacks-on-scada-systems", "leaf:dist:detecting-aws-guardduty-findings-automation", "leaf:dist:detecting-azure-service-principal-abuse", "leaf:dist:detecting-beaconing-patterns-with-zeek", "leaf:dist:detecting-bluetooth-low-energy-attacks", "leaf:dist:detecting-business-email-compromise", "leaf:dist:detecting-cloud-threats-with-guardduty", "leaf:dist:detecting-command-and-control-over-dns", "leaf:dist:detecting-container-drift-at-runtime", "leaf:dist:detecting-container-runtime-threats-with-falco", "leaf:dist:detecting-credential-dumping-techniques", "leaf:dist:detecting-cryptomining-in-cloud", "leaf:dist:detecting-data-and-model-poisoning", "leaf:dist:detecting-dcsync-attack-in-active-directory", "leaf:dist:detecting-deepfake-audio-in-vishing-attacks", "leaf:dist:detecting-dll-sideloading-attacks", "leaf:dist:detecting-dns-exfiltration-with-dns-query-analysis", "leaf:dist:detecting-email-forwarding-rules-attack", "leaf:dist:detecting-entra-offensive-tools-in-graph-logs", "leaf:dist:detecting-evasion-techniques-in-endpoint-logs", "leaf:dist:detecting-exfiltration-over-dns-with-zeek", "leaf:dist:detecting-fileless-attacks-on-endpoints", "leaf:dist:detecting-fileless-malware-techniques", "leaf:dist:detecting-golden-ticket-attacks-in-kerberos-logs", "leaf:dist:detecting-golden-ticket-forgery", "leaf:dist:detecting-insider-data-exfiltration-via-dlp", "leaf:dist:detecting-insider-threat-behaviors", "leaf:dist:detecting-kerberoasting-attacks", "leaf:dist:detecting-lateral-movement-in-network", "leaf:dist:detecting-lateral-movement-with-splunk", "leaf:dist:detecting-living-off-the-land-attacks", "leaf:dist:detecting-malicious-npm-packages", "leaf:dist:detecting-malicious-scheduled-tasks-with-sysmon", "leaf:dist:detecting-mimikatz-execution-patterns", "leaf:dist:detecting-mobile-malware-behavior", "leaf:dist:detecting-modbus-command-injection-attacks", "leaf:dist:detecting-model-extraction-attacks", "leaf:dist:detecting-network-anomalies-with-zeek", "leaf:dist:detecting-network-scanning-with-ids-signatures", "leaf:dist:detecting-ntlm-relay-with-event-correlation", "leaf:dist:detecting-oauth-token-theft", "leaf:dist:detecting-pass-the-hash-attacks", "leaf:dist:detecting-privilege-escalation-attempts", "leaf:dist:detecting-privilege-escalation-in-kubernetes-pods", "leaf:dist:detecting-process-hollowing-technique", "leaf:dist:detecting-process-injection-techniques", "leaf:dist:detecting-qr-code-phishing-with-email-security", "leaf:dist:detecting-ransomware-encryption-behavior", "leaf:dist:detecting-ransomware-precursors-in-network", "leaf:dist:detecting-rootkit-activity", "leaf:dist:detecting-secure-boot-bypass", "leaf:dist:detecting-serverless-function-injection", "leaf:dist:detecting-service-account-abuse", "leaf:dist:detecting-spearphishing-with-email-gateway", "leaf:dist:detecting-stuxnet-style-attacks", "leaf:dist:detecting-suspicious-powershell-execution", "leaf:dist:detecting-t1003-credential-dumping-with-edr", "leaf:dist:detecting-t1055-process-injection-with-sysmon", "leaf:dist:detecting-t1548-abuse-elevation-control-mechanism", "leaf:dist:detecting-wmi-persistence", "leaf:dist:distributed-tracing", "leaf:dist:enumerating-cloud-with-cloudfox", "leaf:dist:eradicating-malware-from-infected-systems", "leaf:dist:event-sourcing-architect", "leaf:dist:event-store-design", "leaf:dist:executing-active-directory-attack-simulation", "leaf:dist:executing-nist-rmf-authorization-to-operate", "leaf:dist:executing-red-team-engagement-planning", "leaf:dist:executing-red-team-exercise", "leaf:dist:exploiting-active-directory-certificate-services-esc1", "leaf:dist:exploiting-active-directory-with-bloodhound", "leaf:dist:exploiting-adcs-with-certipy", "leaf:dist:exploiting-aws-with-pacu", "leaf:dist:exploiting-broken-function-level-authorization", "leaf:dist:exploiting-broken-link-hijacking", "leaf:dist:exploiting-constrained-delegation-abuse", "leaf:dist:exploiting-http-request-smuggling", "leaf:dist:exploiting-insecure-deserialization", "leaf:dist:exploiting-kerberoasting-with-impacket", "leaf:dist:exploiting-ms17-010-eternalblue-vulnerability", "leaf:dist:exploiting-nopac-cve-2021-42278-42287", "leaf:dist:exploiting-oauth-misconfiguration", "leaf:dist:exploiting-race-condition-vulnerabilities", "leaf:dist:exploiting-smb-vulnerabilities-with-metasploit", "leaf:dist:exploiting-zerologon-vulnerability-cve-2020-1472", "leaf:dist:extracting-config-from-agent-tesla-rat", "leaf:dist:extracting-iocs-from-malware-samples", "leaf:dist:extracting-memory-artifacts-with-rekall", "leaf:dist:feature-flags-architect", "leaf:dist:generating-threat-intelligence-reports", "leaf:dist:git-worktree-manager", "leaf:dist:github-actions-templates", "leaf:dist:github-deep-research", "leaf:dist:gitlab-ci-patterns", "leaf:dist:gitops-workflow", "leaf:dist:gpu-acceleration-python", "leaf:dist:grafana-dashboards", "leaf:dist:grill-me", "leaf:dist:grill-with-docs", "leaf:dist:gstack-upgrade", "leaf:dist:hackernews-frontpage", "leaf:dist:hardening-docker-daemon-configuration", "leaf:dist:health", "leaf:dist:helm-chart-builder", "leaf:dist:hr-pro", "leaf:dist:hunting-advanced-persistent-threats", "leaf:dist:hunting-bootkits-in-efi-system-partition", "leaf:dist:hunting-evtx-with-chainsaw", "leaf:dist:hunting-for-anomalous-powershell-execution", "leaf:dist:hunting-for-beaconing-with-frequency-analysis", "leaf:dist:hunting-for-cobalt-strike-beacons", "leaf:dist:hunting-for-command-and-control-beaconing", "leaf:dist:hunting-for-data-exfiltration-indicators", "leaf:dist:hunting-for-dcom-lateral-movement", "leaf:dist:hunting-for-dcsync-attacks", "leaf:dist:hunting-for-defense-evasion-via-timestomping", "leaf:dist:hunting-for-dns-tunneling-with-zeek", "leaf:dist:hunting-for-domain-fronting-c2-traffic", "leaf:dist:hunting-for-lateral-movement-via-wmi", "leaf:dist:hunting-for-living-off-the-cloud-techniques", "leaf:dist:hunting-for-living-off-the-land-binaries", "leaf:dist:hunting-for-lolbins-execution-in-endpoint-logs", "leaf:dist:hunting-for-persistence-mechanisms-in-windows", "leaf:dist:hunting-for-persistence-via-wmi-subscriptions", "leaf:dist:hunting-for-registry-persistence-mechanisms", "leaf:dist:hunting-for-scheduled-task-persistence", "leaf:dist:hunting-for-shadow-copy-deletion", "leaf:dist:hunting-for-spearphishing-indicators", "leaf:dist:hunting-for-supply-chain-compromise", "leaf:dist:hunting-for-suspicious-scheduled-tasks", "leaf:dist:hunting-for-unusual-network-connections", "leaf:dist:hunting-for-webshell-activity", "leaf:dist:hunting-saas-sso-token-abuse", "leaf:dist:i18n-localization", "leaf:dist:implement", "leaf:dist:implementing-alert-fatigue-reduction", "leaf:dist:implementing-anti-phishing-training-program", "leaf:dist:implementing-anti-ransomware-group-policy", "leaf:dist:implementing-attack-path-analysis-with-xm-cyber", "leaf:dist:implementing-aws-nitro-enclave-security", "leaf:dist:implementing-beyondcorp-zero-trust-access-model", "leaf:dist:implementing-browser-isolation-for-zero-trust", "leaf:dist:implementing-canary-tokens-for-network-intrusion", "leaf:dist:implementing-cisa-zero-trust-maturity-model", "leaf:dist:implementing-container-image-minimal-base-with-distroless", "leaf:dist:implementing-continuous-security-validation-with-bas", "leaf:dist:implementing-devsecops-security-scanning", "leaf:dist:implementing-diamond-model-analysis", "leaf:dist:implementing-dmarc-dkim-spf-email-security", "leaf:dist:implementing-dragos-platform-for-ot-monitoring", "leaf:dist:implementing-ebpf-security-monitoring", "leaf:dist:implementing-email-sandboxing-with-proofpoint", "leaf:dist:implementing-google-workspace-phishing-protection", "leaf:dist:implementing-hardware-security-key-authentication", "leaf:dist:implementing-hipaa-security-rule-safeguards", "leaf:dist:implementing-honeypot-for-ransomware-detection", "leaf:dist:implementing-identity-verification-for-zero-trust", "leaf:dist:implementing-iec-62443-security-zones", "leaf:dist:implementing-immutable-backup-with-restic", "leaf:dist:implementing-llm-guardrails-for-security", "leaf:dist:implementing-log-integrity-with-blockchain", "leaf:dist:implementing-microsegmentation-with-guardicore", "leaf:dist:implementing-mimecast-targeted-attack-protection", "leaf:dist:implementing-mitre-attack-coverage-mapping", "leaf:dist:implementing-nerc-cip-compliance-controls", "leaf:dist:implementing-network-access-control", "leaf:dist:implementing-network-deception-with-honeypots", "leaf:dist:implementing-network-intrusion-prevention-with-suricata", "leaf:dist:implementing-network-policies-for-kubernetes", "leaf:dist:implementing-network-segmentation-for-ot", "leaf:dist:implementing-network-segmentation-with-firewall-zones", "leaf:dist:implementing-network-traffic-analysis-with-arkime", "leaf:dist:implementing-network-traffic-baselining", "leaf:dist:implementing-next-generation-firewall-with-palo-alto", "leaf:dist:implementing-ot-incident-response-playbook", "leaf:dist:implementing-passwordless-auth-with-microsoft-entra", "leaf:dist:implementing-policy-as-code-with-open-policy-agent", "leaf:dist:implementing-privileged-session-monitoring", "leaf:dist:implementing-proofpoint-email-security-gateway", "leaf:dist:implementing-ransomware-backup-strategy", "leaf:dist:implementing-ransomware-kill-switch-detection", "leaf:dist:implementing-rapid7-insightvm-for-scanning", "leaf:dist:implementing-rbac-hardening-for-kubernetes", "leaf:dist:implementing-security-chaos-engineering", "leaf:dist:implementing-security-information-sharing-with-stix2", "leaf:dist:implementing-siem-correlation-rules-for-apt", "leaf:dist:implementing-siem-use-cases-for-detection", "leaf:dist:implementing-sigstore-for-software-signing", "leaf:dist:implementing-soar-automation-with-phantom", "leaf:dist:implementing-soar-playbook-for-phishing", "leaf:dist:implementing-soar-playbook-with-palo-alto-xsoar", "leaf:dist:implementing-stix-taxii-feed-integration", "leaf:dist:implementing-taxii-server-with-opentaxii", "leaf:dist:implementing-threat-intelligence-lifecycle-management", "leaf:dist:implementing-threat-modeling-with-mitre-attack", "leaf:dist:implementing-ticketing-system-for-incidents", "leaf:dist:implementing-usb-device-control-policy", "leaf:dist:implementing-velociraptor-for-ir-collection", "leaf:dist:implementing-zero-trust-dns-with-nextdns", "leaf:dist:implementing-zero-trust-in-cloud", "leaf:dist:incident-response", "leaf:dist:insecure-defaults", "leaf:dist:integrating-dast-with-owasp-zap-in-pipeline", "leaf:dist:interview-me", "leaf:dist:investigate", "leaf:dist:investigating-insider-threat-indicators", "leaf:dist:investigating-phishing-email-incident", "leaf:dist:ios-clean", "leaf:dist:ios-fix", "leaf:dist:ios-qa", "leaf:dist:ios-sync", "leaf:dist:iso27001-audit-prep", "leaf:dist:jupyter-notebook-creation", "leaf:dist:kubernetes-operator", "leaf:dist:macos-computer-use", "leaf:dist:managed-agent-launch", "leaf:dist:managing-cloud-identity-with-okta", "leaf:dist:managing-intelligence-lifecycle", "leaf:dist:managing-third-party-vendor-risk", "leaf:dist:mapping-attack-paths-with-bloodhound-ce", "leaf:dist:mapping-mitre-attack-techniques", "leaf:dist:mcp-integration", "leaf:dist:mcp-security-review", "leaf:dist:mcp-server-builder", "leaf:dist:migrating-to-post-quantum-cryptography", "leaf:dist:migration-architect", "leaf:dist:minecraft-modpack-server", "leaf:dist:mock-hunter", "leaf:dist:modeling-threats-with-opencti", "leaf:dist:monitoring-darkweb-sources", "leaf:dist:mpp-agent", "leaf:dist:on-call-handoff-patterns", "leaf:dist:operating-havoc-c2", "leaf:dist:operating-sliver-c2", "leaf:dist:operationalizing-misp-threat-feeds", "leaf:dist:patent", "leaf:dist:performing-active-directory-bloodhound-analysis", "leaf:dist:performing-active-directory-compromise-investigation", "leaf:dist:performing-active-directory-forest-trust-attack", "leaf:dist:performing-active-directory-penetration-test", "leaf:dist:performing-active-directory-vulnerability-assessment", "leaf:dist:performing-adversary-in-the-middle-phishing-detection", "leaf:dist:performing-ai-driven-osint-correlation", "leaf:dist:performing-alert-triage-with-elastic-siem", "leaf:dist:performing-api-rate-limiting-bypass", "leaf:dist:performing-authenticated-scan-with-openvas", "leaf:dist:performing-automated-malware-analysis-with-cape", "leaf:dist:performing-blind-ssrf-exploitation", "leaf:dist:performing-brand-monitoring-for-impersonation", "leaf:dist:performing-container-security-scanning-with-trivy", "leaf:dist:performing-content-security-policy-bypass", "leaf:dist:performing-dark-web-monitoring-for-threats", "leaf:dist:performing-deception-technology-deployment", "leaf:dist:performing-dmarc-policy-enforcement-rollout", "leaf:dist:performing-dynamic-analysis-with-any-run", "leaf:dist:performing-external-network-penetration-test", "leaf:dist:performing-false-positive-reduction-in-siem", "leaf:dist:performing-firmware-extraction-with-binwalk", "leaf:dist:performing-firmware-malware-analysis", "leaf:dist:performing-http-parameter-pollution-attack", "leaf:dist:performing-indicator-lifecycle-management", "leaf:dist:performing-ioc-enrichment-automation", "leaf:dist:performing-ip-reputation-analysis-with-shodan", "leaf:dist:performing-kubernetes-cis-benchmark-with-kube-bench", "leaf:dist:performing-kubernetes-penetration-testing", "leaf:dist:performing-lateral-movement-detection", "leaf:dist:performing-lateral-movement-with-wmiexec", "leaf:dist:performing-log-source-onboarding-in-siem", "leaf:dist:performing-malware-hash-enrichment-with-virustotal", "leaf:dist:performing-malware-ioc-extraction", "leaf:dist:performing-malware-triage-with-yara", "leaf:dist:performing-memory-forensics-with-volatility3-plugins", "leaf:dist:performing-network-packet-capture-analysis", "leaf:dist:performing-network-traffic-analysis-with-tshark", "leaf:dist:performing-oauth-scope-minimization-review", "leaf:dist:performing-open-source-intelligence-gathering", "leaf:dist:performing-paste-site-monitoring-for-credentials", "leaf:dist:performing-phishing-simulation-with-gophish", "leaf:dist:performing-physical-intrusion-assessment", "leaf:dist:performing-plc-firmware-security-analysis", "leaf:dist:performing-purple-team-atomic-testing", "leaf:dist:performing-purple-team-exercise", "leaf:dist:performing-ransomware-response", "leaf:dist:performing-ransomware-tabletop-exercise", "leaf:dist:performing-red-team-phishing-with-gophish", "leaf:dist:performing-red-team-with-covenant", "leaf:dist:performing-second-order-sql-injection", "leaf:dist:performing-sqlite-database-forensics", "leaf:dist:performing-ssl-tls-inspection-configuration", "leaf:dist:performing-static-malware-analysis-with-pe-studio", "leaf:dist:performing-threat-hunting-with-yara-rules", "leaf:dist:performing-threat-intelligence-sharing-with-misp", "leaf:dist:performing-threat-landscape-assessment-for-sector", "leaf:dist:performing-vlan-hopping-attack", "leaf:dist:performing-vulnerability-scanning-with-nessus", "leaf:dist:performing-web-application-scanning-with-nikto", "leaf:dist:performing-web-cache-deception-attack", "leaf:dist:performing-wifi-password-cracking-with-aircrack", "leaf:dist:performing-windows-artifact-analysis-with-eric-zimmerman-tools", "leaf:dist:performing-wireless-security-assessment-with-kismet", "leaf:dist:performing-yara-rule-development-for-detection", "leaf:dist:phase-gated-debugging", "leaf:dist:plan-design-review", "leaf:dist:playground", "leaf:dist:plugin-creator", "leaf:dist:podcast-generation", "leaf:dist:post-exploiting-microsoft-graph-with-graphrunner", "leaf:dist:postmortem-writing", "leaf:dist:pr-comment-handler", "leaf:dist:pr-to-video", "leaf:dist:pricing-strategy", "leaf:dist:prioritizing-vulnerabilities-with-cvss-scoring", "leaf:dist:processing-stix-taxii-feeds", "leaf:dist:product-discovery", "leaf:dist:product-launch-video", "leaf:dist:profiling-threat-actor-groups", "leaf:dist:progressive-estimation", "leaf:dist:project-artifact", "leaf:dist:prometheus-configuration", "leaf:dist:prototype", "leaf:dist:pulse", "leaf:dist:python-observability", "leaf:dist:python-patch-safety", "leaf:dist:python-performance-optimization", "leaf:dist:rag-architect", "leaf:dist:rag-implementation", "leaf:dist:railway-deploy", "leaf:dist:recovering-from-ransomware-attack", "leaf:dist:refactoring-patterns", "leaf:dist:relaying-ntlm-for-adcs-esc8", "leaf:dist:remotion-to-hyperframes", "leaf:dist:repository-audit-loop", "leaf:dist:research-router", "leaf:dist:reverse-engineering-android-malware-with-jadx", "leaf:dist:reverse-engineering-dotnet-malware-with-dnspy", "leaf:dist:reverse-engineering-malware-with-ghidra", "leaf:dist:reverse-engineering-ransomware-encryption-routine", "leaf:dist:reverse-engineering-rust-malware", "leaf:dist:saga-orchestration", "leaf:dist:scanning-containers-with-trivy-in-cicd", "leaf:dist:scanning-docker-images-with-trivy", "leaf:dist:scanning-network-with-nmap-advanced", "leaf:dist:scenario-war-room", "leaf:dist:scrape", "leaf:dist:screenshot-automation", "leaf:dist:securing-agentic-ai-tool-invocation", "leaf:dist:securing-aws-iam-permissions", "leaf:dist:securing-azure-with-microsoft-defender", "leaf:dist:securing-kubernetes-on-cloud", "leaf:dist:security-best-practices", "leaf:dist:self-improving-champion-loop", "leaf:dist:session-report", "leaf:dist:session-usage-report", "leaf:dist:simmer-refinement", "leaf:dist:site-architecture", "leaf:dist:skill-contract-schema", "leaf:dist:skill-creator", "leaf:dist:skill-factory-review", "leaf:dist:skill-installer", "leaf:dist:skill-library-evolution", "leaf:dist:skillopt-sleep", "leaf:dist:slack-gif-creator", "leaf:dist:slides", "leaf:dist:slideshow", "leaf:dist:snowflake-development", "leaf:dist:soc2-audit-prep", "leaf:dist:spreadsheets", "leaf:dist:stripe-link-cli", "leaf:dist:stripe-projects", "leaf:dist:syllabus", "leaf:dist:sync-gbrain", "leaf:dist:talking-head-recut", "leaf:dist:tdd", "leaf:dist:terraform-patterns", "leaf:dist:testing-api-authentication-weaknesses", "leaf:dist:testing-api-security-with-owasp-top-10", "leaf:dist:testing-for-broken-access-control", "leaf:dist:testing-for-business-logic-vulnerabilities", "leaf:dist:testing-for-email-header-injection", "leaf:dist:testing-for-json-web-token-vulnerabilities", "leaf:dist:testing-for-open-redirect-vulnerabilities", "leaf:dist:testing-for-system-prompt-leakage", "leaf:dist:testing-for-xml-injection-vulnerabilities", "leaf:dist:testing-for-xss-vulnerabilities-with-burpsuite", "leaf:dist:testing-ransomware-recovery-procedures", "leaf:dist:theme-factory", "leaf:dist:validating-backup-integrity-for-recovery", "leaf:dist:validating-tpm-measured-boot-attestation", "leaf:dist:vendor-skill-packaging", "leaf:dist:video-generation", "leaf:dist:web-artifacts-builder", "leaf:dist:web-design-guidelines", "leaf:dist:website-to-video", "leaf:dist:workflow-builder", "leaf:dist:workflow-orchestration" ] }, { "id": "leaf:dist:indexing-issue-auditor", "kind": "leaf", "title": "Indexing Issue Auditor & Technical SEO Architect", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/indexing-issue-auditor/SKILL.md", "slug": "indexing-issue-auditor" }, "description": "Technical SEO auditor for indexing, crawl budget, and structural errors. Use when auditing Google Search Console health, diagnosing 'Discovered but not currently indexed' errors, auditing sitemaps/robots.txt, or performing site reliability audits focused on SEO stability.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:performing-cve-prioritization-with-kev-catalog", "kind": "leaf", "title": "Performing CVE Prioritization with KEV Catalog", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-cve-prioritization-with-kev-catalog/SKILL.md", "slug": "Performing CVE Prioritization with KEV Catalog" }, "description": "Leverage the CISA Known Exploited Vulnerabilities catalog alongside EPSS", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "leaf:dist:plugin-settings", "kind": "leaf", "title": "Plugin Settings Pattern for Claude Code Plugins", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/plugin-settings/SKILL.md", "slug": "plugin-settings" }, "description": "This skill should be used when the user asks about \"plugin settings\", \"store plugin configuration\", \"user-configurable plugin\", \".local.md files\", \"plugin state files\", \"read YAML frontmatter\", \"per-project plugin settings\", or wants to make plugin behavior configurable. Documents the .claude/plugin-name.local.md pattern for storing plugin-specific configuration with YAML frontmatter and markdown content.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "unclassified", "catalog_decision": false } }, { "id": "group:dist:uncategorized:reference", "kind": "group", "title": "Reference", "children": [ "leaf:dist:indexing-issue-auditor", "leaf:dist:performing-cve-prioritization-with-kev-catalog", "leaf:dist:plugin-settings" ] }, { "id": "category:dist:uncategorized", "kind": "category", "title": "Uncategorized", "children": [ "group:dist:uncategorized:playbook", "group:dist:uncategorized:reference" ] }, { "id": "leaf:dist:detecting-email-account-compromise", "kind": "leaf", "title": "Detecting Email Account Compromise", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/detecting-email-account-compromise/SKILL.md", "slug": "Detecting Email Account Compromise" }, "description": "Detect compromised O365 and Google Workspace email accounts by analyzing", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:devex-review", "kind": "leaf", "title": "devex-review", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/devex-review/SKILL.md", "slug": "devex-review" }, "description": "Live developer experience audit. (gstack)", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:eu-ai-act-specialist", "kind": "leaf", "title": "EU AI Act Compliance Specialist", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/eu-ai-act-specialist/SKILL.md", "slug": "eu-ai-act-specialist" }, "description": "Operational skill for Regulation (EU) 2024/1689. **Three decisions, no executive AI strategy:**", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:idea-lineage", "kind": "leaf", "title": "Idea Lineage — Single-Idea Evolution", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/idea-lineage/SKILL.md", "slug": "idea-lineage" }, "description": "Trace how one idea changed across time: when it first appeared, when it became sharp, what it displaced, what it contradicted, and what version is alive now.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:implementing-gdpr-data-subject-access-request", "kind": "leaf", "title": "Implementing GDPR Data Subject Access Request (DSAR) Workflow", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/implementing-gdpr-data-subject-access-request/SKILL.md", "slug": "Implementing GDPR Data Subject Access Request (DSAR) Workflow" }, "description": "Automates GDPR Data Subject Access Request (DSAR) workflows including", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:internal-comms", "kind": "leaf", "title": "Internal Communications", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/internal-comms/SKILL.md", "slug": "Internal Communications" }, "description": "A set of resources to help write all kinds of internal communications, using the formats that your company likes to use. Use whenever asked to write some sort of internal communications (status reports, leadership updates, 3P updates, company newsletters, FAQs, incident reports, project updates, etc.).", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "unspecified", "classification_status": "partial", "catalog_decision": false } }, { "id": "leaf:dist:okf-knowledge-extraction", "kind": "leaf", "title": "OKF Knowledge Extraction", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/okf-knowledge-extraction/SKILL.md", "slug": "OKF Knowledge Extraction" }, "description": "How to extract, normalize, and store public knowledge in OKF-compatible format. Use when adding any external source to the catalog, creating new knowledge files, or converting raw source material into canonical AOMK entries.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-cryptographic-audit-of-application", "kind": "leaf", "title": "Performing Cryptographic Audit of Application", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-cryptographic-audit-of-application/SKILL.md", "slug": "Performing Cryptographic Audit of Application" }, "description": "A cryptographic audit systematically reviews an application's use of", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-dns-enumeration-and-zone-transfer", "kind": "leaf", "title": "Performing DNS Enumeration and Zone Transfer", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-dns-enumeration-and-zone-transfer/SKILL.md", "slug": "Performing DNS Enumeration and Zone Transfer" }, "description": "Enumerates DNS records, attempts zone transfers, brute-forces subdomains,", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:performing-privileged-account-access-review", "kind": "leaf", "title": "Performing Privileged Account Access Review", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/performing-privileged-account-access-review/SKILL.md", "slug": "Performing Privileged Account Access Review" }, "description": "Conduct systematic reviews of privileged accounts to validate access", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:plan-tune", "kind": "leaf", "title": "plan-tune", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/plan-tune/SKILL.md", "slug": "plan-tune" }, "description": "Review which AskUserQuestion prompts fire across gstack skills, set per-question preferences (never-ask / always-ask / ask-only-for-one-way), inspect the dual-track profile (what you declared vs what your behavior suggests), and enable/disable", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:skill-writing-style", "kind": "leaf", "title": "Skill Writing Style", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/skill-writing-style/SKILL.md", "slug": "Skill Writing Style" }, "description": "Follow writing conventions for agent skills — imperative voice, third-person description, trigger phrases, and progressive disclosure. Use when writing or reviewing any skill document.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:testing-android-intents-for-vulnerabilities", "kind": "leaf", "title": "Testing Android Intents for Vulnerabilities", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/testing-android-intents-for-vulnerabilities/SKILL.md", "slug": "Testing Android Intents for Vulnerabilities" }, "description": "Tests Android inter-process communication (IPC) through intents for", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:writing-beats", "kind": "leaf", "title": "writing-beats", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/writing-beats/SKILL.md", "slug": "writing-beats" }, "description": "Shape an article as a journey of beats, choose-your-own-adventure style. The user picks a starting beat from the raw material, you write only that beat, then offer options for where to pivot next, beat by beat, until the article reaches a natural end. Use when the user has raw material and wants to assemble it as a narrative rather than an argument.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:writing-fragments", "kind": "leaf", "title": "writing-fragments", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/writing-fragments/SKILL.md", "slug": "writing-fragments" }, "description": "Grilling session that mines the user for fragments — heterogeneous nuggets of writing (claims, vignettes, sharp sentences, half-thoughts) — and appends them to a single document as raw material for a future article. Use when the user wants to develop ideas before imposing structure, or mentions \"fragments\", \"ideate\", or \"raw material\" for writing.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:writing-shape", "kind": "leaf", "title": "writing-shape", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/writing-shape/SKILL.md", "slug": "writing-shape" }, "description": "Take a markdown file of raw material and shape it into an article through a conversational session — drafting candidate openings, growing the piece paragraph by paragraph, arguing about format (lists, tables, callouts, quotes) at each step. Use when the user has a pile of notes, fragments, or a rough draft and wants help turning it into something publishable.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "group:dist:writing:playbook", "kind": "group", "title": "Playbook", "children": [ "leaf:dist:detecting-email-account-compromise", "leaf:dist:devex-review", "leaf:dist:eu-ai-act-specialist", "leaf:dist:idea-lineage", "leaf:dist:implementing-gdpr-data-subject-access-request", "leaf:dist:internal-comms", "leaf:dist:okf-knowledge-extraction", "leaf:dist:performing-cryptographic-audit-of-application", "leaf:dist:performing-dns-enumeration-and-zone-transfer", "leaf:dist:performing-privileged-account-access-review", "leaf:dist:plan-tune", "leaf:dist:skill-writing-style", "leaf:dist:testing-android-intents-for-vulnerabilities", "leaf:dist:writing-beats", "leaf:dist:writing-fragments", "leaf:dist:writing-shape" ] }, { "id": "leaf:dist:changelog-generator", "kind": "leaf", "title": "Changelog Generator", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/changelog-generator/SKILL.md", "slug": "changelog-generator" }, "description": "Produce consistent, auditable release notes from Conventional Commits. Separates commit parsing, semantic-bump logic, and changelog rendering for automated releases with editorial control. Use when cutting a release, generating CHANGELOG.md from git history, computing the next semantic version, or automating release notes in CI.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "low", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:document-generate", "kind": "leaf", "title": "document-generate", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/document-generate/SKILL.md", "slug": "document-generate" }, "description": "Generate missing documentation from scratch for a feature, module, or entire project. (gstack)", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:docx", "kind": "leaf", "title": "docx", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/docx/SKILL.md", "slug": "docx" }, "description": "Create, edit, redline, and comment on `.docx` files. Use when the user needs to create or modify Word documents, including reading, creating, editing, redlining, commenting, accessibility audits, redaction, merging, and template work. Render to images for visual QA before delivering.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:edit-article", "kind": "leaf", "title": "edit-article", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/edit-article/SKILL.md", "slug": "edit-article" }, "description": "Edit and improve articles by restructuring sections, improving clarity, and tightening prose. Use when user wants to edit, revise, or improve an article draft.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "low", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:make-pdf", "kind": "leaf", "title": "make-pdf", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/make-pdf/SKILL.md", "slug": "make-pdf" }, "description": "Turn any markdown file into a publication-quality PDF. (gstack)", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "group:dist:writing:skill", "kind": "group", "title": "Skill", "children": [ "leaf:dist:changelog-generator", "leaf:dist:document-generate", "leaf:dist:docx", "leaf:dist:edit-article", "leaf:dist:make-pdf" ] }, { "id": "leaf:dist:doc-coauthoring", "kind": "leaf", "title": "Doc Co-Authoring Workflow", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/doc-coauthoring/SKILL.md", "slug": "Doc Co-Authoring Workflow" }, "description": "Guide users through a structured workflow for co-authoring documentation. Use when user wants to write documentation, proposals, technical specs, decision docs, or similar structured content. This workflow helps users efficiently transfer context, refine content through iteration, and verify the doc works for readers.", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "low", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:document-release", "kind": "leaf", "title": "document-release", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/document-release/SKILL.md", "slug": "document-release" }, "description": "Post-ship documentation update. (gstack)", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "medium", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:dossier", "kind": "leaf", "title": "Dossier — Decision-Grade Entity Research", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/dossier/SKILL.md", "slug": "dossier" }, "description": "Decision-grade entity research — produces a hypothesis-tested dossier on a specific company, person, nonprofit, or government org. Forces intake to state a hypothesis upfront so the dossier tests it rather than confirms it. Output is a structured report with verdict on hypothesis, identity facts, 12-month activity timeline, network and reputation signals, red flags, conversation hooks tied to specific findings, and source-provenance audit log. Use when the user asks for background research, diligence, or meeting prep on a specific entity (e.g., 'prep me for a meeting with [person/company]', 'due diligence on [company]').", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "low", "classification_status": "complete", "catalog_decision": false } }, { "id": "leaf:dist:newsletter-generation", "kind": "leaf", "title": "newsletter-generation", "browse_default": false, "ref": { "source_repo": "architectonic/skills", "source_path": "dist/skills/newsletter-generation/SKILL.md", "slug": "newsletter-generation" }, "description": "Use this skill when the user requests to generate, create, write, or draft a newsletter, email digest, weekly roundup, industry briefing, or curated content summary. Supports topic-based research, content curation from multiple sources, and professional formatting for email or web distribution. Trigger on requests like \"create a newsletter about X\", \"write a weekly digest\", \"generate a tech roundup\", or \"curate news about Y\".", "trust": { "lifecycle_status": "unreviewed", "install_recommendation": "inspect", "risk_level": "low", "classification_status": "complete", "catalog_decision": false } }, { "id": "group:dist:writing:workflow", "kind": "group", "title": "Workflow", "children": [ "leaf:dist:doc-coauthoring", "leaf:dist:document-release", "leaf:dist:dossier", "leaf:dist:newsletter-generation" ] }, { "id": "category:dist:writing", "kind": "category", "title": "Writing", "children": [ "group:dist:writing:playbook", "group:dist:writing:skill", "group:dist:writing:workflow" ] }, { "id": "section:distribution", "kind": "section", "title": "Distribution catalog", "children": [ "category:dist:agent-operations", "category:dist:business", "category:dist:cloud-security", "category:dist:design", "category:dist:forensics", "category:dist:media", "category:dist:research", "category:dist:runtime-tools", "category:dist:security-defensive", "category:dist:security-offensive", "category:dist:software-engineering", "category:dist:uncategorized", "category:dist:writing" ], "description": "Generated external registry organized by domain and artifact kind." }, { "id": "root", "kind": "root", "title": "Architectonic Skills", "children": [ "section:reviewed-core", "section:reviewed-packs", "section:distribution" ] } ], "edges": [ { "from": "leaf:dist:ai-seo", "to": "leaf:pack:seo-visibility:ai-search-visibility-audit", "kind": "superseded_by" }, { "from": "leaf:dist:frontend-design", "to": "leaf:pack:design-interface:orchestrator", "kind": "superseded_by" }, { "from": "leaf:dist:hyperframes-media", "to": "leaf:dist:media-use", "kind": "superseded_by" } ] }