← All skills
soe
57 / 100 · Review before installing
Check before installing. Some of what it can do is expected: a security skill usually runs scanners and checks websites.
By infometa/workbuddyskills (GitHub) · security · 443 stars · scanned at commit 33b6151
This skill should be used when the user asks to "analyze security alerts", "parse vulnerability scan report", "analyze vulnerability scan report", "verify CVE fix", "analyze WAF attack log", "analyze CFW firewall log", "analyze cloud firewall alert", "investigate host intrusion", "analyze DDoS traffic", "check host asset", "troubleshoot application logs", "troubleshoot Tencent iOA", "iOA login or intranet access", "iOA policy delivery", or needs security operations analysis covering CWP/WAF/Yuj…
Works with any agent that supports SKILL.md skills.
Partially scanned — some files couldn't be read; we'll retry on the next scan
What this skill can do
Runs commands on your computer
This is disclosed by the author in the skill's SKILL.md or README. Expected for a security skill.
Found in 16 places.
Show 13 more
- experts/soe/skills/soe/references/alert-analysis/cwp-analyzer/SKILL.md, line 61
python3 ../soc-alert-pipeline/scripts/l0_parse.py \ - experts/soe/skills/soe/references/alert-analysis/cwp-analyzer/scripts/ttp_detectors/reverse_shell.py, line 14
(r"python[23]?\s+-c\s+['\"].*subprocess.*Popen", "T1059.006", "python subprocess"), - experts/soe/skills/soe/references/alert-analysis/soc-alert-pipeline/SKILL.md, line 64
python3 "${CODEBUDDY_PLUGIN_ROOT}/skills/soe/references/alert-analysis/soc-alert-pipeline/scripts/l0_parse.py" \ - experts/soe/skills/soe/references/alert-analysis/soc-alert-pipeline/SKILL.md, line 164
python3 l0_parse.py input.xlsx --out output.jsonl - experts/soe/skills/soe/references/vulnerability-analysis/host-cve-validator/scripts/generate_word_report.py, line 13
subprocess.check_call([sys.executable, "-m", "pip", "install", "python-docx", "-q"]) - experts/soe/skills/soe/references/vulnerability-analysis/host-cve-validator/scripts/recover_failed.py, line 281
r = subprocess.run(cmd, capture_output=True, text=True, timeout=30) - experts/soe/skills/soe/references/vulnerability-analysis/host-cve-validator/scripts/run_pipeline.py, line 549
r = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout) - experts/soe/skills/soe/references/vulnerability-analysis/host-cve-validator/scripts/run_pipeline.py, line 551
except subprocess.TimeoutExpired as e: - experts/soe/skills/soe/references/vulnerability-analysis/host-cve-validator/scripts/run_pipeline.py, line 798
proc = subprocess.run(ssh_args, capture_output=True, text=True, timeout=30) - experts/soe/skills/soe/references/vulnerability-analysis/host-cve-validator/scripts/run_pipeline.py, line 2010
result = subprocess.run( - experts/soe/skills/soe/references/vulnerability-analysis/host-cve-validator/scripts/run_pipeline.py, line 2018
except subprocess.TimeoutExpired: - experts/soe/skills/soe/references/vulnerability-analysis/host-cve-validator/scripts/run_pipeline.py, line 2082
result = subprocess.run( - experts/soe/skills/soe/references/vulnerability-analysis/host-cve-validator/scripts/run_pipeline.py, line 2092
except subprocess.TimeoutExpired:
Downloads and installs other software
The author does not mention this.
Found in 13 places.
Show 10 more
- experts/soe/skills/soe/references/alert-analysis/cwp-analyzer/scripts/ttp_detectors/reverse_shell.py, line 17
(r"wget\s+[^\s]+\s*\|\s*bash", "T1059.004", "wget | bash"), - experts/soe/skills/soe/references/alert-analysis/cwp-analyzer/scripts/ttp_detectors/reverse_shell.py, line 18
(r"curl\s+[^\s]+\s*\|\s*sh", "T1059.004", "curl | sh"), - experts/soe/skills/soe/references/alert-analysis/cwp-analyzer/scripts/ttp_detectors/reverse_shell.py, line 19
(r"wget\s+[^\s]+\s*\|\s*sh", "T1059.004", "wget | sh"), - experts/soe/skills/soe/references/ioa-troubleshooting/ioa-openapi-invoke/scripts/crypto_utils.py, line 78
print("Warning: 未安装 cryptography,回退 base64(不安全)。请执行: pip install cryptography") - experts/soe/skills/soe/references/vulnerability-analysis/host-cve-validator/scripts/default_intel.py, line 146
"未安装 httpx,请先 pip install httpx>=0.27" - experts/soe/skills/soe/references/vulnerability-analysis/host-cve-validator/scripts/generate_word_report.py, line 211
apt-get install -y --only-upgrade {component} - experts/soe/skills/soe/references/vulnerability-analysis/host-cve-validator/scripts/run_pipeline.py, line 449
"apply_fix_cmd": "python scripts/apply_fix.py --inject-script {vuln_key} 'sed -i \"s/yum install/yum install --nogpgcheck/g\" fix.sh'", - experts/soe/skills/soe/references/vulnerability-analysis/vul-analyse/scripts/default_intel.py, line 148
"未安装 httpx,请先 pip install httpx>=0.27" - experts/soe/skills/soe/references/vulnerability-analysis/vul-analyse/scripts/extract_vulns.py, line 18
pip install pandas openpyxl pyyaml beautifulsoup4 httpx - experts/soe/skills/soe/references/vulnerability-analysis/vul-analyse/scripts/extract_vulns.py, line 39
print(f"缺少依赖: {e}\n请先运行: pip install pandas openpyxl pyyaml beautifulsoup4 httpx")
Reads your saved credentials, such as SSH keys or .env files
The author does not mention this.
Found in 2 places.
Connects to the internet
The author does not mention this. Expected for a security skill.
Found in 10 places.
Show 7 more
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'soe' ] || [ -L ~/.agents/skills/'soe' ]; then echo 'A skill folder named soe already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/infometa/workbuddyskills' "$d" && git -C "$d" checkout --quiet '33b6151ccee9aa0816c6f32d021be77d82772755' -- 'experts/soe/skills/soe' && mkdir -p ~/.agents/skills && cp -R "$d"/'experts/soe/skills/soe' ~/.agents/skills/'soe' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'soe' ~/.claude/skills/'soe' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for infometa/workbuddyskills shows the score of its lowest-scoring skill.

[](https://zalavijaysinh.github.io/skilltrust/repos/infometa/workbuddyskills/)
Score history
| Date | Version | Score |
|---|
| 2026-11-13 | 33b6151 | 57 |
| 2026-11-09 | 0749999 | 47 |
| 2026-11-07 | 1e18d8c | 80 |