Markitdown
ImCa0/just-laws
Convert files and office documents to Markdown. An agent skill from ImCa0/just-laws.
SOC 告警分析流水线 (L0 适配层) - 项目级 skill 提供腾讯安全产品 rawlog 的统一解析入口, 作为 L1 产品分析 (cwp-analyzer / yujie-analyzer) 和 L2 跨产品关联的共同底座。
Install Soc Alert Pipeline
$ npx skills add infometa/workbuddyskills --skill soc-alert-pipeline -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install infometa/workbuddyskills soc-alert-pipeline --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/infometa/workbuddyskills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/experts/soe/skills/soe/references/alert-analysis/soc-alert-pipeline .claude/skills/soc-alert-pipeline && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "soc-alert-pipeline" agent skill from https://github.com/infometa/workbuddyskills/tree/main/experts/soe/skills/soe/references/alert-analysis/soc-alert-pipeline into .claude/skills/soc-alert-pipeline/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "soc-alert-pipeline", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/infometa/workbuddyskills/tree/main/experts/soe/skills/soe/references/alert-analysis/soc-alert-pipelineType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add infometa/workbuddyskills --skill soc-alert-pipeline -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install infometa/workbuddyskills soc-alert-pipeline --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/infometa/workbuddyskills.git skills-src && mkdir -p .agents/skills && cp -r skills-src/experts/soe/skills/soe/references/alert-analysis/soc-alert-pipeline .agents/skills/soc-alert-pipeline && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "soc-alert-pipeline" agent skill from https://github.com/infometa/workbuddyskills/tree/main/experts/soe/skills/soe/references/alert-analysis/soc-alert-pipeline into .agents/skills/soc-alert-pipeline/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "soc-alert-pipeline", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add infometa/workbuddyskills --skill soc-alert-pipeline -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install infometa/workbuddyskills soc-alert-pipeline --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/infometa/workbuddyskills.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/experts/soe/skills/soe/references/alert-analysis/soc-alert-pipeline .cursor/skills/soc-alert-pipeline && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "soc-alert-pipeline" agent skill from https://github.com/infometa/workbuddyskills/tree/main/experts/soe/skills/soe/references/alert-analysis/soc-alert-pipeline into .cursor/skills/soc-alert-pipeline/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "soc-alert-pipeline", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/infometa/workbuddyskills.git --path experts/soe/skills/soe/references/alert-analysis/soc-alert-pipeline--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add infometa/workbuddyskills --skill soc-alert-pipeline -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install infometa/workbuddyskills soc-alert-pipeline --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/infometa/workbuddyskills.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/experts/soe/skills/soe/references/alert-analysis/soc-alert-pipeline .gemini/skills/soc-alert-pipeline && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "soc-alert-pipeline" agent skill from https://github.com/infometa/workbuddyskills/tree/main/experts/soe/skills/soe/references/alert-analysis/soc-alert-pipeline into .gemini/skills/soc-alert-pipeline/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "soc-alert-pipeline", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install infometa/workbuddyskills soc-alert-pipelineInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add infometa/workbuddyskills --skill soc-alert-pipeline -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/infometa/workbuddyskills.git skills-src && mkdir -p .github/skills && cp -r skills-src/experts/soe/skills/soe/references/alert-analysis/soc-alert-pipeline .github/skills/soc-alert-pipeline && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "soc-alert-pipeline" agent skill from https://github.com/infometa/workbuddyskills/tree/main/experts/soe/skills/soe/references/alert-analysis/soc-alert-pipeline into .github/skills/soc-alert-pipeline/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "soc-alert-pipeline", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add infometa/workbuddyskills --skill soc-alert-pipeline -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install infometa/workbuddyskills soc-alert-pipeline --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/infometa/workbuddyskills.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/experts/soe/skills/soe/references/alert-analysis/soc-alert-pipeline .opencode/skills/soc-alert-pipeline && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "soc-alert-pipeline" agent skill from https://github.com/infometa/workbuddyskills/tree/main/experts/soe/skills/soe/references/alert-analysis/soc-alert-pipeline into .opencode/skills/soc-alert-pipeline/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "soc-alert-pipeline", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
soc-alert-pipeline- GitHub stars
- 348
- Token cost
- ~1.4k tokens
- SKILL.md length
- 320 words
- Files
- 22 (incl. scripts, references)
- Skills in repo
- 218
- Repo updated
- First seen
- Licence
- None found
At a glance
SOC 告警分析流水线 (L0 适配层) - 项目级 skill 提供腾讯安全产品 rawlog 的统一解析入口, 作为 L1 产品分析 (cwp-analyzer / yujie-analyzer) 和 L2 跨产品关联的共同底座。
- Works in 3 steps: 解析单文件 → 加新产品 → 在 Python 里直接调用
- Tasks that involve Excel spreadsheets
- SKILL.md covers 一、定位, 二、目录速查, 三、快速开始 and 四、当前支持的产品, plus 4 more sections
- Runs Python scripts from its folder; calls python3
What it does
Soc Alert Pipeline is an agent skill from infometa/workbuddyskills. SOC 告警分析流水线 (L0 适配层) - 项目级 skill 提供腾讯安全产品 rawlog 的统一解析入口, 作为 L1 产品分析 (cwp-analyzer / yujie-analyzer) 和 L2 跨产品关联的共同底座。 适用场景: - 解析从 SOC 导出的 xlsx (含 OCSF 透出字段 + rawlog) - 把异构 rawlog (JSON / key=value / packet hex) 统一成结构化事件 - 跑批处理 / 单元测试 / 二次开发 不适用: - 单产品深度威胁分析 → 用 cwp-analyzer / yujie-analyzer - 跨产品关联 → 暂未实现 (等 L1 落地) - 在线 SOC API 实时拉取 → 当前仅支持 xlsx 离线导入
Its SKILL.md is about 1.4k tokens, which your agent loads only when the skill is triggered. The skill folder holds 24 other files, including scripts and reference files (for example `references/event-schema.md`, `references/l0-parser-contract.md` and `references/raw_yujie_sample.json`).
It sits in Documents & Office, covering Excel spreadsheets. It works with Microsoft Excel. The repository describes itself as: WorkBuddy skills / connectors / experts archive for offline study.
When your agent uses it
- Tasks that involve Excel spreadsheets
Example prompts
- “/soc-alert-pipeline”
Requirements
- Python 3
Workflow steps
3 steps, taken from the step headings in SKILL.md.
- 解析单文件
- 加新产品
- 在 Python 里直接调用
What it can do on your machine
Read from SKILL.md and the folder at commit 91b77ea. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Ships 11 files in scripts/ (Python, from the files we listed), which the agent can run.
Shell commands in SKILL.md call:
python3
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Soc Alert Pipeline loads about 1.4k tokens when it runs, and up to ~7.6k if it reads all its reference files. Until then it costs about 94 tokens; SKILL.md has 320 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.
SKILL.md
Without a licence we can't republish the file, so here is its outline and opening line. It has 320 words (~1,419 tokens).
- name
- soc-alert-pipeline
- version
- 1.0.0
- triggers
- SOC, 安全运营中心, raw_log解析, 告警流水线, SIEM
Files
SKILL.md and 21 other files (scripts, references) in experts/soe/skills/soe/references/alert-analysis/soc-alert-pipeline of infometa/workbuddyskills.
- SKILL.md
- references/event-schema.md
- references/l0-parser-contract.md
- references/raw_cwp_sample.txt
- references/raw_yujie_sample.json
- references/soc-export-format.md
- references/tencent-product-naming.md
- scripts/__init__.py
- scripts/gen_report.py
- scripts/l0_parse.py
- scripts/l2_correlate.py
- scripts/packet_decode.py
- scripts/parsers/__init__.py
- scripts/parsers/_base.py
- scripts/parsers/cwp_parser.py
- scripts/parsers/registry.py
- scripts/parsers/tianmu_parser.py
- scripts/parsers/waf_parser.py
- … and 4 more
Open the folder on GitHubat commit 91b77ea
Compare with similar skills
Soc Alert Pipeline next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Soc Alert Pipeline this skillinfometa/workbuddyskills | 348 | — | ~1.4k | Automated safety check: Pass | None | |
| MarkitdownImCa0/just-laws | 781 | 14 repos | ~3.2k | Automated safety check: Notes | MIT | |
| Data Table Managern8n-io/n8n | 207k | — | ~2.3k | Automated safety check: Pass | Custom licence | |
| Docx4jplutext/docx4j | 2.4k | — | ~2.5k | Automated safety check: Pass | None | |
| Instrument Data To Allotropeaws-samples/amazon-bedrock-agents-healthcare-lifesciences | 274 | 2 repos | ~2.7k | Automated safety check: Pass | Apache-2.0 | |
| Cyber Pptcrazyykhllc-bit/CyberPPT | 1.8k | — | ~10k | Automated safety check: Pass | MIT |
Similar skills
- Official
Data Table Manager
n8n-io/n8n
Load before calling data-tables or parse-file. An agent skill from n8n-io/n8n.
Docx4j
plutext/docx4j
A skill your agent uses when writing Java code that creates, reads or edits Word (.docx), PowerPoint (.pptx) or Excel (.xlsx) files with docx4j — including generating documents, editing existing…
- Official
Instrument Data To Allotrope
aws-samples/amazon-bedrock-agents-healthcare-lifesciences
Convert laboratory instrument output files (PDF, CSV, Excel, TXT) to Allotrope Simple Model (ASM) JSON format or flattened 2D CSV.
Cyber Ppt
crazyykhllc-bit/CyberPPT
当用户需要把 DOCX、PDF、TXT、XLSX、研究报告、业务材料或原始数据转成高密度、可编辑、咨询风格 PPTX 时使用；也适用于需要 SCR 论证、视觉风格探索、详细图表和渲染质检的 PPT。
PDF
zai-org/ZCode
Professional PDF toolkit covering four production workflows: reports, creative visuals, academic LaTeX, and existing PDF processing.
More from infometa/workbuddyskills
All 218 skills in this repoCampus Event Playbook
infometa/workbuddyskills
This skill should be used when planning, coordinating, running, or reviewing student-led campus events, including club recruitment, freshman mixers, welcome activities, small talks, competitions…
Teachany
infometa/workbuddyskills
K-12 interactive courseware creation. An agent skill from infometa/workbuddyskills.
Weight Management HTML
infometa/workbuddyskills
A skill your agent uses when the adult weight-management MCP needs to be installed/set up in WorkBuddy (connector) or its result must be rendered as a standalone Chinese HTML plan.
Agent Browser
infometa/workbuddyskills
A skill your agent uses when the user needs browser automation, including opening web pages, taking screenshots, extracting page content, clicking elements, filling forms, or testing web flows.
AI Research Radar
infometa/workbuddyskills
定时任务：每日研究简报。漏掉重要论文和行业报告？每天帮你盯着，关键信息一条不漏 This skill should be used when the user asks about 定时任务：每日研究简报.
Check Deck
infometa/workbuddyskills
Investment banking presentation quality checker. An agent skill from infometa/workbuddyskills.
Related
Works with
Categories
Questions about Soc Alert Pipeline
What does Soc Alert Pipeline do?
SOC 告警分析流水线 (L0 适配层) - 项目级 skill 提供腾讯安全产品 rawlog 的统一解析入口, 作为 L1 产品分析 (cwp-analyzer / yujie-analyzer) 和 L2 跨产品关联的共同底座。. Soc Alert Pipeline is an agent skill from infometa/workbuddyskills.
When should I use Soc Alert Pipeline?
Soc Alert Pipeline fits situations like: tasks that involve Excel spreadsheets.
How do I install Soc Alert Pipeline in Claude Code?
Run `npx skills add infometa/workbuddyskills --skill soc-alert-pipeline -a claude-code`. Or copy the skill folder (experts/soe/skills/soe/references/alert-analysis/soc-alert-pipeline in infometa/workbuddyskills) into .claude/skills/soc-alert-pipeline in your project. Claude Code loads it when a task matches its description.
How do I install Soc Alert Pipeline in Codex?
Run `npx skills add infometa/workbuddyskills --skill soc-alert-pipeline -a codex`. Or copy the skill folder (experts/soe/skills/soe/references/alert-analysis/soc-alert-pipeline in infometa/workbuddyskills) into .agents/skills/soc-alert-pipeline in your project. Codex loads it when a task matches its description.
Can I use Soc Alert Pipeline in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add infometa/workbuddyskills --skill soc-alert-pipeline -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/soc-alert-pipeline, .gemini/skills/soc-alert-pipeline, .github/skills/soc-alert-pipeline and .opencode/skills/soc-alert-pipeline in your project.
What does Soc Alert Pipeline need to run?
Going by SKILL.md and its folder, Soc Alert Pipeline needs Python for the scripts in its folder and the command-line tools its instructions call (python3). Our summary lists: Python 3.
Does Soc Alert Pipeline access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Soc Alert Pipeline safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.
What licence does Soc Alert Pipeline use?
No licence was found for Soc Alert Pipeline or its repository. Without one, default copyright applies: ask the author before reusing or redistributing it.
How many tokens does Soc Alert Pipeline use?
About 1.4k tokens (SKILL.md is roughly 5.7k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 6.2k tokens, read only when the agent opens those files.
What are the alternatives to Soc Alert Pipeline?
Skills that share tags, products or a category with Soc Alert Pipeline: Markitdown (ImCa0/just-laws, 781 stars), Data Table Manager (n8n-io/n8n, 207k stars), Docx4j (plutext/docx4j, 2.4k stars) and Instrument Data To Allotrope (aws-samples/amazon-bedrock-agents-healthcare-lifesciences, 274 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Soc Alert Pipeline?
infometa (a GitHub user) maintains it in infometa/workbuddyskills, which has 348 GitHub stars. The repository holds 218 skills in this directory. The repository was last updated on October 9, 2026.
Source: infometa/workbuddyskills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.