Detecting Insider Threat Behaviors
mukul975/Anthropic-Cybersecurity-Skills
Detect insider threat behavioral indicators including unusual data access, off-hours activity, mass file downloads, privilege abuse, and resignation-correlated data theft.
A skill your agent uses when deciding what goes inside a SIGIR paper's page budget versus the cited repository — SIGIR counts appendices inside the 9-page (full) and 4-page (short) limits with only…
$ npx skills add brycewang-stanford/Awesome-Journal-Skills --skill sigir-supplementary -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install brycewang-stanford/Awesome-Journal-Skills sigir-supplementary --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/brycewang-stanford/Awesome-Journal-Skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/SIGIR-Skills/skills/sigir-supplementary .claude/skills/sigir-supplementary && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "sigir-supplementary" agent skill from https://github.com/brycewang-stanford/Awesome-Journal-Skills/tree/main/SIGIR-Skills/skills/sigir-supplementary into .claude/skills/sigir-supplementary/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "sigir-supplementary", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/brycewang-stanford/Awesome-Journal-Skills/tree/main/SIGIR-Skills/skills/sigir-supplementaryType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add brycewang-stanford/Awesome-Journal-Skills --skill sigir-supplementary -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install brycewang-stanford/Awesome-Journal-Skills sigir-supplementary --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/brycewang-stanford/Awesome-Journal-Skills.git skills-src && mkdir -p .agents/skills && cp -r skills-src/SIGIR-Skills/skills/sigir-supplementary .agents/skills/sigir-supplementary && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "sigir-supplementary" agent skill from https://github.com/brycewang-stanford/Awesome-Journal-Skills/tree/main/SIGIR-Skills/skills/sigir-supplementary into .agents/skills/sigir-supplementary/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "sigir-supplementary", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add brycewang-stanford/Awesome-Journal-Skills --skill sigir-supplementary -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install brycewang-stanford/Awesome-Journal-Skills sigir-supplementary --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/brycewang-stanford/Awesome-Journal-Skills.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/SIGIR-Skills/skills/sigir-supplementary .cursor/skills/sigir-supplementary && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "sigir-supplementary" agent skill from https://github.com/brycewang-stanford/Awesome-Journal-Skills/tree/main/SIGIR-Skills/skills/sigir-supplementary into .cursor/skills/sigir-supplementary/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "sigir-supplementary", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/brycewang-stanford/Awesome-Journal-Skills.git --path SIGIR-Skills/skills/sigir-supplementary--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add brycewang-stanford/Awesome-Journal-Skills --skill sigir-supplementary -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install brycewang-stanford/Awesome-Journal-Skills sigir-supplementary --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/brycewang-stanford/Awesome-Journal-Skills.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/SIGIR-Skills/skills/sigir-supplementary .gemini/skills/sigir-supplementary && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "sigir-supplementary" agent skill from https://github.com/brycewang-stanford/Awesome-Journal-Skills/tree/main/SIGIR-Skills/skills/sigir-supplementary into .gemini/skills/sigir-supplementary/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "sigir-supplementary", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install brycewang-stanford/Awesome-Journal-Skills sigir-supplementaryInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add brycewang-stanford/Awesome-Journal-Skills --skill sigir-supplementary -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/brycewang-stanford/Awesome-Journal-Skills.git skills-src && mkdir -p .github/skills && cp -r skills-src/SIGIR-Skills/skills/sigir-supplementary .github/skills/sigir-supplementary && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "sigir-supplementary" agent skill from https://github.com/brycewang-stanford/Awesome-Journal-Skills/tree/main/SIGIR-Skills/skills/sigir-supplementary into .github/skills/sigir-supplementary/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "sigir-supplementary", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add brycewang-stanford/Awesome-Journal-Skills --skill sigir-supplementary -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install brycewang-stanford/Awesome-Journal-Skills sigir-supplementary --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/brycewang-stanford/Awesome-Journal-Skills.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/SIGIR-Skills/skills/sigir-supplementary .opencode/skills/sigir-supplementary && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "sigir-supplementary" agent skill from https://github.com/brycewang-stanford/Awesome-Journal-Skills/tree/main/SIGIR-Skills/skills/sigir-supplementary into .opencode/skills/sigir-supplementary/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "sigir-supplementary", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
sigir-supplementaryA skill your agent uses when deciding what goes inside a SIGIR paper's page budget versus the cited repository — SIGIR counts appendices inside the 9-page (full) and 4-page (short) limits with only…
Sigir Supplementary is an agent skill from brycewang-stanford/Awesome-Journal-Skills. Use when deciding what goes inside a SIGIR paper's page budget versus the cited repository — SIGIR counts appendices inside the 9-page (full) and 4-page (short) limits with only references free, so overflow material must be re-homed into run files, repository docs, or cut, without hiding review-critical evidence outside the paper.
Its SKILL.md is about 1.6k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
The repository describes itself as: Journal-specific Claude Code/Codex skill packs covering mainstream journals — AER, QJE, Nature, Cell, 管理世界, 经济研究 & 200+ more — your fast track to getting published. | 覆盖主流期刊的… The licence is MIT.
6 steps, taken from the first numbered list in SKILL.md.
Read from SKILL.md and the folder at commit 932eb23. It shows what the files ask for, not the result of running them.
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
No scripts in the folder and no shell commands in SKILL.md (its code samples are latex).
From the folder's file list and the shell code blocks in SKILL.md.
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Sigir Supplementary loads about 1.6k tokens when it runs. Until then it costs about 88 tokens; SKILL.md has 712 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
The full file from brycewang-stanford/Awesome-Journal-Skills at commit 932eb23, republished under its MIT licence (© brycewang-stanford). 712 words, ~1,600 tokens.
.claude/skills/sigir-supplementary/SKILL.md (or your agent's skills folder).SIGIR has no appendix escape hatch. The 2025 full-paper wording (the clearest recent statement of the standing rule) caps papers at 9 pages including figures, tables, proofs, appendixes, and acknowledgments — everything except references; the 2026 pages restate the budgets as 9/4 pages excluding references. There is no separate supplementary upload in the NeurIPS sense on the verified track pages. Overflow therefore has exactly three destinations: compression, the cited repository, or the bin. This skill is the triage protocol.
| Container | What belongs there | What must never be there |
|---|---|---|
| Paper body (9 or 4 pp) | Every claim a reviewer must verify to accept: method, main tables, significance results, tuning protocol summary, limitations | Filler related work, per-query dumps, prompt walls |
| References (free) | Complete citations — never trimmed for space | Content smuggled into bibnotes |
| Cited repository | Run files, full configs, per-query analyses, extra collections, prompts, proofs of secondary lemmas, negative results | Anything acceptance depends on |
The governing rule: reviewers must be able to accept the paper without opening the repository. Track pages do not oblige reviewers to consult external material, so evidence that lives only in the repo is evidence that may not exist for review.
Rank candidate content by review-criticality, not by effort spent producing it:
What loses its seat first: exhaustive metric grids (report the pre-registered ones; put the grid in the repo), second and third qualitative examples, restated definitions of standard metrics, and architecture recaps of well-known baselines.
% Honest space wins that don't touch \vspace (which risks desk rejection):
% 1. Merge setup prose into the table caption.
\caption{nDCG@10 on \colA{} and \colB{}. Paired t-test vs BM25,
Bonferroni-corrected; $\dagger$: $p<0.05$. 3 seeds, mean$\pm$sd.}
% 2. One combined results table with grouped columns beats three tables.
% 3. booktabs + \small in tables (allowed by class) before cutting content.
% 4. Inline enumerations for contribution lists; drop the roadmap paragraph.Never buy space by deleting the significance-testing sentence, the seed count, or the collection versions — those cuts convert a space problem into a soundness objection, which is a worse trade at this venue than a missing extra ablation.
If the paper says "details in the repository," the repository must behave like an appendix, not a junk drawer:
PAPER_MAP.md that mirrors the paper's section numbering: "§5.2 ablation →
eval/ablation_table.md + runs/ablate_*.trec."Cross-references must be one-directional: the paper points to the repo; the repo never contains claims absent from the paper (reviewers cannot credit them, and policy-wise unreviewed claims must not ride into the version of record later).
A full-paper draft sits at 10.5 pages against the 9-page budget. Candidate cuts:
eval/full_grid.md. (-0.4 pp)Net: on budget, with zero soundness loss — every cut demoted redundancy or depth, not protocol.
A short paper has no room for a supplementary strategy — it is the strategy. Standard shape that fits: one focused question, one main table, one analysis figure, setup compressed into captions, everything else in the repo. If the triage above still leaves review-critical content homeless, the work is a full paper submitted to the wrong track; re-route rather than compress soundness away.
[Budget state] <pages>/<limit> with acks reserve y/n
[Cut list] <content demoted to repo, in order>
[Kept-by-criticality] main table / tuning protocol / ablation / setup / analysis
[Repo appendix] PAPER_MAP present y/n; per-query files y/n; anonymized y/n
[Soundness guard] significance sentence, seeds, versions all still in-paper y/n
[Re-route flag] none / "this is a full paper in short clothing"© brycewang-stanford, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Just SKILL.md in SIGIR-Skills/skills/sigir-supplementary of brycewang-stanford/Awesome-Journal-Skills.
Open the folder on GitHubat commit 932eb23
Sigir Supplementary next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Sigir Supplementary this skillbrycewang-stanford/Awesome-Journal-Skills | 1.2k | — | ~1.6k | Automated safety check: Pass | MIT | |
| Detecting Insider Threat Behaviorsmukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~897 | Automated safety check: Pass | Apache-2.0 | |
| Performing Insider Threat Investigationmukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~2.9k | Automated safety check: Pass | Apache-2.0 | |
| Investigating Insider Threat Indicatorsmukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~2.9k | Automated safety check: Pass | Apache-2.0 | |
| Detecting Insider Threat With Uebamukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~738 | Automated safety check: Pass | Apache-2.0 | |
| Detecting Insider Data Exfiltration Via Dlpmukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~623 | Automated safety check: Pass | Apache-2.0 |
mukul975/Anthropic-Cybersecurity-Skills
Detect insider threat behavioral indicators including unusual data access, off-hours activity, mass file downloads, privilege abuse, and resignation-correlated data theft.
mukul975/Anthropic-Cybersecurity-Skills
Investigates insider threat incidents involving employees, contractors, or trusted partners who misuse authorized access to steal data, sabotage systems, or violate security policies, combining…
mukul975/Anthropic-Cybersecurity-Skills
Investigates insider threat indicators including data exfiltration attempts, unauthorized access patterns, policy violations, and pre-departure behaviors using SIEM analytics, DLP alerts, and HR…
mukul975/Anthropic-Cybersecurity-Skills
Implement User and Entity Behavior Analytics (UEBA) using Elasticsearch/OpenSearch to build behavioral baselines, calculate anomaly scores, perform peer group analysis, and alert on insider threat…
mukul975/Anthropic-Cybersecurity-Skills
Detects insider data exfiltration by analyzing DLP policy violations, file access patterns, upload volume anomalies, and off-hours activity in endpoint and cloud logs.
brycewang-stanford/Awesome-Journal-Skills
A skill your agent uses when organizing the back matter of a SODA (ACM-SIAM Symposium on Discrete Algorithms) submission — there is no supplementary channel, so appendix architecture inside the…
brycewang-stanford/Awesome-Journal-Skills
A skill your agent uses when running and reporting the analysis for an Annals of the American Association of Geographers manuscript — spatial statistics and modeling, remote-sensing accuracy, or…
brycewang-stanford/Awesome-Journal-Skills
A skill your agent uses when positioning an Annals of the American Association of Geographers manuscript in the literature — engaging geographic scholarship across the relevant area and the…
brycewang-stanford/Awesome-Journal-Skills
A skill your agent uses when responding to an Annals of the American Association of Geographers decision letter (major/minor revision) — building a point-by-point response to the subject editor and…
brycewang-stanford/Awesome-Journal-Skills
A skill your agent uses when defending the research design of an Annals of the American Association of Geographers manuscript — spatial/quantitative analysis and GIScience, remote-sensing and…
brycewang-stanford/Awesome-Journal-Skills
A skill your agent uses when you need to understand how the Annals of the American Association of Geographers evaluates a manuscript — double-anonymous review routed through a subject editor by…
brycewang-stanford/Awesome-Journal-Skills
A skill your agent uses when running the final pre-submission preflight for the Annals of the American Association of Geographers via ScholarOne Manuscripts — area/article-type selection…
A skill your agent uses when deciding what goes inside a SIGIR paper's page budget versus the cited repository — SIGIR counts appendices inside the 9-page (full) and 4-page (short) limits with only…. Sigir Supplementary is an agent skill from brycewang-stanford/Awesome-Journal-Skills. Use when deciding what goes inside a SIGIR paper's page budget versus the cited repository — SIGIR counts appendices inside the 9-page (full) and 4-page (short) limits with only references free, so overflow material must be re-homed into run files, repository docs, or cut, without hiding review-critical evidence outside the paper.
Sigir Supplementary fits situations like: so overflow material must be re-homed into run files; repository docs; without hiding review-critical evidence outside the paper.
Run `npx skills add brycewang-stanford/Awesome-Journal-Skills --skill sigir-supplementary -a claude-code`. Or copy the skill folder (SIGIR-Skills/skills/sigir-supplementary in brycewang-stanford/Awesome-Journal-Skills) into .claude/skills/sigir-supplementary in your project. Claude Code loads it when a task matches its description.
Run `npx skills add brycewang-stanford/Awesome-Journal-Skills --skill sigir-supplementary -a codex`. Or copy the skill folder (SIGIR-Skills/skills/sigir-supplementary in brycewang-stanford/Awesome-Journal-Skills) into .agents/skills/sigir-supplementary in your project. Codex loads it when a task matches its description.
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add brycewang-stanford/Awesome-Journal-Skills --skill sigir-supplementary -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/sigir-supplementary, .gemini/skills/sigir-supplementary, .github/skills/sigir-supplementary and .opencode/skills/sigir-supplementary in your project.
SKILL.md names no scripts, command-line tools or credentials: Sigir Supplementary is instructions for the agent only.
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
Sigir Supplementary is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
About 1.6k tokens (SKILL.md is roughly 6.4k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
Skills that share tags, products or a category with Sigir Supplementary: Detecting Insider Threat Behaviors (mukul975/Anthropic-Cybersecurity-Skills, 34k stars), Performing Insider Threat Investigation (mukul975/Anthropic-Cybersecurity-Skills, 34k stars), Investigating Insider Threat Indicators (mukul975/Anthropic-Cybersecurity-Skills, 34k stars) and Detecting Insider Threat With Ueba (mukul975/Anthropic-Cybersecurity-Skills, 34k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
brycewang-stanford (a GitHub user) maintains it in brycewang-stanford/Awesome-Journal-Skills, which has 1,231 GitHub stars. The repository holds 2,387 skills in this directory. The repository was last updated on September 27, 2026.
Source: brycewang-stanford/Awesome-Journal-Skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.